Start learning →

BCA Cyber Security Web Security — OWASP — practice questions

Explore 12 free Web Security — OWASP questions in BCA Cyber Security Cybersecurity. Open each question or exercise to read its content, reference answers and available explanation.

Practise Web Security — OWASP with Quill →

Web Security — OWASP questions and exercises with answers

Showing questions 1–12 of 12.

The OWASP TOP 10 is a regularly updated list ofRead the answer and worked solution →Which OWASP Top 10 2021 category occupies the #1 position?Read the answer and worked solution →SQL INJECTION (SQLi) is a vulnerability where an attackerRead the answer and worked solution →CROSS-SITE SCRIPTING (XSS) allows an attacker toRead the answer and worked solution →The OWASP 2021 category A04 'INSECURE DESIGN' is a NEW category that addressesRead the answer and worked solution →What does the SECURITY MISCONFIGURATION category (A05 in 2021) typically include?Read the answer and worked solution →Which mitigation is the SINGLE most effective defense against SQL Injection?Read the answer and worked solution →CROSS-SITE REQUEST FORGERY (CSRF) is best mitigated byRead the answer and worked solution →An IDOR (Insecure Direct Object Reference) attack happens whenRead the answer and worked solution →Which OWASP category covers using libraries with KNOWN CVEs?Read the answer and worked solution →What does HTTPS provide over plain HTTP?Read the answer and worked solution →Tap what belongs to the named riskRead the answer and worked solution →

Worked practice questions

The OWASP TOP 10 is a regularly updated list of

  1. the best programming languages
  2. most CRITICAL web application security risks
  3. top free antivirus tools
  4. the fastest growing cybersecurity companies
Show answer and solution

Correct answer: B. most CRITICAL web application security risks

1. The OWASP Top 10 is a community-driven document that ranks the most CRITICAL web application security risks. 2. Updated approximately every 3-4 years based on real-world breach data, vulnerability databases, and community surveys. 3. Major editions: 2017, 2021 (current at time of writing). 4. Used as the GOLDEN STANDARD for security training, code review checklists, and security testing scope. 5. Other options describe unrelated rankings. _Source: OWASP Top 10 2021 — official project at owasp.org/Top10._

Open this question →

Which OWASP Top 10 2021 category occupies the #1 position?

  1. Injection
  2. Security Misconfiguration
  3. Cross-Site Scripting (XSS)
  4. Broken Access Control
Show answer and solution

Correct answer: D. Broken Access Control

1. OWASP Top 10 2021 ranks BROKEN ACCESS CONTROL as A01 — the #1 risk. 2. Moved up from #5 in 2017 due to its prevalence: 94% of applications tested had some form of broken access control. 3. Examples: a regular user accessing /admin endpoints, IDOR (changing ?id=42 to ?id=43 to see another user's data), missing access checks on API calls. 4. Mitigation: enforce access controls SERVER-SIDE on every request, deny by default, log access control failures. 5. INJECTION (option A) is A03 in 2021. XSS is now grouped INTO Injection. Misconfiguration is A05. _Source: OWASP Top 10 2021 — A01: Broken Access Control._

Open this question →

SQL INJECTION (SQLi) is a vulnerability where an attacker

  1. guesses the database password
  2. inserts malicious SQL via user input
  3. physically steals the database server
  4. DDoSes the database
Show answer and solution

Correct answer: B. inserts malicious SQL via user input

1. SQL INJECTION: when application code builds SQL by string-concatenating user input. 2. Example: `SELECT * FROM users WHERE name = '` + userInput + `'`. If userInput = `' OR '1'='1`, the query becomes `... WHERE name = '' OR '1'='1'` — returns all rows. 3. PRIMARY MITIGATION: PARAMETERISED QUERIES (prepared statements). User input is passed as a separate parameter, never inlined into SQL string. 4. Secondary mitigations: input validation, least-privilege DB user, web application firewall (WAF). 5. Falls under A03: Injection in OWASP Top 10 2021. _Source: OWASP Top 10 2021 — A03: Injection._

Open this question →

How to practise

  1. Choose a Web Security — OWASP question and try to work out your answer.
  2. Open the question to check the correct answer and read its worked solution.
  3. Continue in the app for bite-sized lessons, explanations and review with Quill. You can start without creating an account.

More Cybersecurity topics

CryptographyNetwork SecurityCybersecurity FundamentalsCybersecurity Framework CoreIncident Response Life Cycle