Web security essentials check

Loading learning content…

Question 1 of 12How should data received from a browser or external API generally be treated at a server boundary?

Treat it as untrusted and validate itTrust it because the frontend already checked itTrust it whenever it is valid JSON

Question 2 of 12Which three URL properties define a web origin?

Scheme, host, and portPath, query string, and fragmentDomain, path, and cookie name

Question 3 of 12What does CORS primarily control?

Whether browser code from another origin may read a server responseWhich application permissions an authenticated user hasWhich database tables a server may query

Question 4 of 12Which practice most directly reduces XSS risk when displaying untrusted user comments?

Render the comments as escaped textInsert the comments directly as executable HTMLEvaluate the comments as JavaScript before displaying them

Question 5 of 12Which database practice is the standard defense against SQL injection?

Use parameterized queriesConcatenate user input into the SQL stringRely only on validation performed by the frontend

Question 6 of 12CSRF is especially relevant when which type of credential is automatically attached by the browser?

A session cookieA private server environment variableA database password stored only on the backend

Question 7 of 12What does authorization determine?

What an authenticated caller is allowed to doWhether the caller's claimed identity is validWhich hashing algorithm stores the user's password

Question 8 of 12What is the purpose of the HttpOnly cookie attribute?

Prevent ordinary browser JavaScript from reading the cookieAllow the cookie to be transmitted only over unencrypted HTTPAllow every origin to read the cookie

Question 9 of 12How should application passwords normally be stored?

Using an established password-hashing algorithmAs plaintext so the original password can be recoveredAs Base64-encoded text

Question 10 of 12Where should a privileged private API key normally be stored in a web application?

On a trusted server that performs the privileged requestInside the browser JavaScript bundleIn localStorage so users cannot inspect it

Question 11 of 12What is the primary purpose of Content Security Policy?

Restrict which sources the browser may load or executeHash passwords before database storageAssign application permissions to authenticated users

Question 12 of 12What protection does HTTPS primarily provide?

Encryption and integrity protection for data traveling between client and serverAutomatic prevention of every XSS vulnerabilityAutomatic authorization for every application endpoint

Choose one answer for every question, then check your answers.