200-901 Question 129
Select 3As a developer for a web application, you are tasked with ensuring the application is secure against common vulnerabilities. Which of the following scenarios demonstrate a potential security risk related to OWASP's top threats?
- A
A user is able to inject a malicious script into a comment field, which is then executed in another user's browser when they view the comment.
- B
The application allows users to submit SQL queries directly to the database, which can manipulate or delete critical data.
- C
A user submits sensitive data such as passwords over an HTTPS connection, but the data is securely encrypted during transmission.
- D
An attacker tricks a user into clicking a malicious link that performs an unauthorized action on a trusted website where the user is logged in.
Show answer and explanation
Correct answers: A, B, D
Explanation
OWASP's top threats include vulnerabilities such as Cross-Site Scripting (XSS), SQL Injection, and Cross-Site Request Forgery (CSRF). These attacks exploit weaknesses in web applications to execute malicious scripts, compromise databases, or perform unauthorized actions. Understanding and mitigating these risks is critical to securing web applications.
- A. Correct.
This describes a Cross-Site Scripting (XSS) attack, where malicious scripts are injected into web pages viewed by other users.
- B. Correct.
This describes a SQL Injection attack, where malicious SQL code is executed to manipulate or compromise a database.
- C. Incorrect.
This is a secure scenario where sensitive data is properly encrypted during transmission, so it doesn't represent a security threat.
- D. Correct.
This describes a Cross-Site Request Forgery (CSRF) attack, where attackers trick users into performing unauthorized actions without their knowledge.