Web Security Practice Exam — LearnCoachAssist

Question 1 Web Security

What is token replay across services?

It is when an attacker tricks a cache to store a response keyed on a value the attacker controls (e.g. an unkeyed header), then serves that poisoned response to other users. Tokens issued for one service being accepted by another, often due to broad audiences or shared signing keys; tokens must have explicit audience (aud) claims and services must validate them. Secure code and proper input validation: WAFs can be bypassed with encoding, parameter pollution, or novel payloads, and they add latency and false positives. It is a Padding Oracle On Downgraded Legacy Encryption attack against SSL 3.0 that allowed attackers to decrypt portions of HTTPS cookies via padding-oracle attacks.

Question 2 Web Security

What is an API key vs an OAuth token?

API keys are opaque long-lived identifiers identifying the calling application; OAuth tokens (often JWTs) are scoped, time-limited credentials that represent delegated user access. Session fixation is an attack where the attacker forces a known session identifier on the victim before login. Third-party packages can contain vulnerabilities that become part of your application attack surface. A rule that temporarily disables an account or login method after a threshold of failures, balancing brute-force defense with DoS-via-lockout risk.

Question 3 Web Security

Why should error messages avoid sensitive detail?

Rate limiting restricts how often requests can be made in a time window to reduce abuse and brute-force attacks. SRI lets the browser verify that a fetched script or stylesheet matches a known hash, so a compromised CDN cannot serve modified code. Detailed internal errors can help attackers learn about infrastructure, queries, or validation behavior. The server generates a per-request random nonce, includes it in the CSP header (e.g. script-src 'nonce-abc123') and on each allowed

LearnCoachAssist

Free flashcards for any subject. Powered by spaced repetition to help you learn faster and retain more.

What is token replay across services?

What is an API key vs an OAuth token?

Why should error messages avoid sensitive detail?

Learn

Product

Categories