I85PREP
⌘ K
Cloudflare Application Security study materials
Cloudflare Application Security study resources

Cloudflare Application Security practice questions

One question at a time. Build your Cloudflare Application Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Security Fundamentals

Which HTTP response header instructs the browser to only load resources over HTTPS for a specified period after the first secure visit?

  1. X-Frame-Options
  2. Referrer-Policy
  3. Strict-Transport-Security Correct answer.
  4. Content-Security-Policy

Explanation

Strict-Transport-Security (HSTS) tells the browser to remember that a host must be contacted only over HTTPS for a duration given by max-age. It mitigates protocol-downgrade and cookie-hijacking attacks after the first trusted response. The other headers control content sources, framing, and referrer leakage rather than transport enforcement.

Question 2Web Security Fundamentals

In the same-origin policy, which combination of scheme, host, and port defines an origin?

  1. Scheme and host only
  2. Scheme, host, and port Correct answer.
  3. Host, port, and query string
  4. Host and path only

Explanation

The same-origin policy treats two URLs as same-origin only when their scheme, host, and port all match. Path, query, and fragment are not part of the origin tuple. This means https://example.com and http://example.com are different origins even though the host is identical.

Question 3Web Security Fundamentals

Which cookie attribute prevents JavaScript running on the page from reading the cookie value?

  1. Domain
  2. Secure
  3. SameSite=Strict
  4. HttpOnly Correct answer.

Explanation

HttpOnly marks a cookie so that it is inaccessible to document.cookie and other script APIs, reducing the impact of cross-site scripting. Secure only restricts the cookie to HTTPS transport, and SameSite limits cross-site sending. The Domain attribute widens which hosts receive the cookie.

Question 4Web Security Fundamentals

A reflected cross-site scripting vulnerability occurs when user-supplied input is:

  1. Echoed back in the immediate response without proper output encoding Correct answer.
  2. Stored in a database and rendered to other users later
  3. Injected into a server-side template at build time
  4. Executed only inside a sandboxed iframe

Explanation

Reflected XSS happens when the application includes untrusted input in the response it returns to the same request, without context-appropriate encoding. The payload is not persisted, so the attacker must deliver a crafted link or form to the victim. Stored XSS instead persists the payload server-side.

Question 5Web Security Fundamentals

What is the primary purpose of the Content-Security-Policy header?

  1. To declare which sources of scripts, styles, and other resources the browser may load Correct answer.
  2. To cache static assets at the edge
  3. To compress responses before delivery
  4. To encrypt response bodies in transit

Explanation

CSP lets a site declare an allowlist of origins and directives that constrain resource loading, which limits the impact of injected scripts. It is a defense-in-depth control against XSS and data injection. It does not handle transport encryption, compression, or caching.

Question 6Web Security Fundamentals

Which attack tricks a logged-in user's browser into submitting an authenticated state-changing request to a different site?

  1. Server-side request forgery
  2. SQL injection
  3. Cross-site request forgery Correct answer.
  4. Directory traversal

Explanation

Cross-site request forgery (CSRF) exploits the browser's automatic inclusion of credentials such as cookies when a request is sent to a target site. The attacker does not read the response; the goal is to cause an unwanted state change. Defenses include anti-CSRF tokens and SameSite cookies.

Question 7Web Security Fundamentals

What distinguishes a stored XSS payload from a reflected one?

  1. Stored payloads only work over HTTP
  2. Stored payloads require no JavaScript execution
  3. Stored payloads are persisted server-side and served to later visitors Correct answer.
  4. Stored payloads only affect the attacker's own session

Explanation

Stored XSS is saved by the application, for example in a comment or profile field, and rendered to other users later without encoding. This makes it potentially far more damaging because it does not require a crafted link per victim. Reflected XSS is returned in the immediate response instead.

Question 8Web Security Fundamentals

Which response header value of X-Frame-Options prevents any site from framing the page?

  1. SAMEORIGIN
  2. ALLOW-FROM
  3. NOFRAME
  4. DENY Correct answer.

Explanation

DENY instructs the browser to refuse framing entirely, while SAMEORIGIN permits framing only by pages of the same origin. The ALLOW-FROM directive is obsolete and not reliably supported. NOFRAME is not a valid X-Frame-Options value.

Question 9Web Security Fundamentals

A site sets a cookie with SameSite=Lax. Under which circumstance will the browser typically include the cookie on a cross-site request?

  1. On any cross-site subresource fetch
  2. On a cross-site fetch with credentials included
  3. On a top-level navigation using the safe GET method Correct answer.
  4. On a cross-site POST form submission

Explanation

SameSite=Lax permits cookies on top-level navigations that use safe methods such as GET, but blocks them on cross-site POSTs and subresource requests. This provides partial CSRF protection while preserving ordinary link navigation. Strict mode blocks even top-level cross-site navigation.

Question 10Web Security Fundamentals

An application reflects a search term inside an HTML attribute value. Which output encoding is most appropriate?

  1. URL encoding only
  2. HTML entity encoding for element content
  3. Attribute-context encoding that escapes quotes and special characters Correct answer.
  4. Base64 encoding

Explanation

Encoding must match the syntactic context where untrusted data lands. Inside an attribute, quotes and other attribute-breaking characters must be escaped to prevent breaking out of the attribute. Element-content encoding does not neutralize attribute delimiters, and URL or Base64 encoding does not make data safe for HTML attributes.

Question 11Web Security Fundamentals

A developer adds the CSP directive script-src 'self' 'unsafe-inline'. What weakness does 'unsafe-inline' introduce?

  1. It disables HTTPS enforcement
  2. It blocks all scripts from the same origin
  3. It allows inline scripts and event handlers to execute, weakening XSS mitigation Correct answer.
  4. It allows framing from any origin

Explanation

'unsafe-inline' permits inline script blocks and inline event handlers, which is precisely what injected XSS payloads often rely on. Including it largely defeats the script-src allowlist as an XSS defense. Nonce- or hash-based policies avoid this weakness.

Question 12Web Security Fundamentals

Why does a per-request anti-CSRF token provide stronger protection than checking the Origin header alone?

  1. The token encrypts the request body
  2. The token prevents SQL injection
  3. The token is unpredictable and bound to the user's session, so cross-site attackers cannot forge it Correct answer.
  4. The token replaces the need for authentication

Explanation

A synchronizer token is generated with sufficient entropy and tied to the user's session, so a cross-site attacker cannot guess or read it. Origin checking is useful but can be absent or unreliable in some clients and legacy flows. Combining both yields defense in depth.

Question 13Web Security Fundamentals

Which technique best mitigates clickjacking when legacy browser support is required?

  1. Serving the page with X-Frame-Options: DENY or SAMEORIGIN Correct answer.
  2. Removing all JavaScript from the page
  3. Using HTTP instead of HTTPS
  4. Disabling cookies entirely

Explanation

X-Frame-Options with DENY or SAMEORIGIN prevents the page from being framed by foreign origins, which is the core clickjacking vector. CSP frame-ancestors is the modern equivalent but older browsers may ignore it. Combining the header and CSP covers both modern and legacy clients.

Question 14Web Security Fundamentals

An attacker submits a comment containing an image tag whose onerror handler steals cookies. Which two controls most directly address this stored XSS?

  1. Output encoding at render time and a restrictive CSP Correct answer.
  2. TLS and HSTS
  3. Compression and minification
  4. Rate limiting and caching

Explanation

Context-aware output encoding prevents the injected markup from being interpreted as HTML, while a CSP without 'unsafe-inline' blocks inline event handlers from executing. Together they address both the injection and its execution. TLS, caching, and compression do not neutralize script injection.

Question 15Web Security Fundamentals

What does the CSP directive frame-ancestors 'none' accomplish?

  1. It prevents the page from being embedded in any frame Correct answer.
  2. It disables inline styles
  3. It forces all subresources to load over HTTPS
  4. It blocks all outbound network requests

Explanation

frame-ancestors controls which origins may embed the current page in a frame, and 'none' forbids all embedding. It is the modern replacement for X-Frame-Options. The directive does not govern outbound requests, styles, or transport.

Question 16Web Security Fundamentals

A session cookie is set without the Secure attribute. What is the primary risk?

  1. The cookie is shared across all domains
  2. The cookie becomes readable by JavaScript
  3. The cookie may be transmitted over plain HTTP and intercepted Correct answer.
  4. The cookie expires immediately

Explanation

Without Secure, the browser may send the cookie over an unencrypted HTTP connection, where a network attacker could capture it. Secure restricts transmission to HTTPS. Script readability is controlled by HttpOnly, and scope is controlled by Domain and Path.

Question 17Web Security Fundamentals

Which input handling practice most reliably prevents SQL injection?

  1. Relying on client-side validation
  2. Blocking the word SELECT in input
  3. Escaping single quotes only
  4. Using parameterized queries with bound parameters Correct answer.

Explanation

Parameterized queries separate SQL code from data, so user input cannot alter query structure regardless of its content. Manual escaping is error-prone and context-dependent. Client-side validation is trivially bypassed and blocking keywords is easily evaded.

Question 18Web Security Fundamentals

What is the security purpose of the Subresource Integrity (SRI) attribute on a script tag?

  1. It restricts the script to same-origin loading
  2. It prevents the script from accessing cookies
  3. It encrypts the resource in transit
  4. It verifies that the fetched resource matches an expected cryptographic hash Correct answer.

Explanation

SRI lets a page specify a hash of the expected file so the browser rejects a resource whose contents do not match. This protects against a compromised or malicious third-party CDN. It does not provide transport encryption or origin restriction by itself.

Question 19Web Security Fundamentals

A team wants to gradually roll out a strict CSP without breaking the site. Which approach supports this?

  1. Deploy the policy in Content-Security-Policy-Report-Only and collect violation reports Correct answer.
  2. Remove all CSP headers and rely on HTTPS
  3. Set the policy to block-all-mixed-content only
  4. Add 'unsafe-eval' to every directive

Explanation

Report-Only mode enforces nothing but sends violation reports to a configured endpoint, letting teams observe what a strict policy would break. Once violations are addressed, the policy can be promoted to enforcing mode. Adding permissive keywords defeats the purpose of the policy.

Question 20Web Security Fundamentals

An application sets Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true. What is the security consequence?

  1. Browsers reject the combination, so credentialed cross-origin reads fail Correct answer.
  2. The site becomes immune to CSRF
  3. Cookies are automatically encrypted
  4. Any origin can read authenticated responses from the site

Explanation

The CORS specification forbids using the wildcard origin together with credentials, so browsers refuse to expose the response. This prevents an accidental blanket exposure of authenticated data. It does not by itself make the site immune to CSRF, nor does it encrypt cookies.

Question 21Web Security Fundamentals

Why is DOM-based XSS harder to detect with server-side input filtering alone?

  1. The attack only works on mobile browsers
  2. The payload requires database persistence
  3. The payload is always encrypted
  4. The payload never reaches the server because the sink executes in the browser Correct answer.

Explanation

In DOM-based XSS, a client-side source such as location.hash flows into a dangerous sink like innerHTML entirely within the browser, so the server may never see the payload. Server-side filtering cannot inspect what never arrives. Mitigation requires safe DOM APIs and client-side encoding.

Question 22Web Security Fundamentals

A site uses a strict CSP with per-response nonces. An attacker injects a script tag without the correct nonce. What is the outcome?

  1. The browser blocks the injected script because its nonce does not match Correct answer.
  2. The browser rewrites the nonce to match
  3. The browser executes it because script-src is present
  4. The browser ignores CSP for injected markup

Explanation

With a nonce-based policy, only script elements carrying the current unpredictable nonce are allowed to execute. An injected tag cannot guess the per-response value, so the browser blocks it. This is why nonce policies resist reflected and stored XSS better than allowlists alone.

Question 23Web Security Fundamentals

Which combination best defends a state-changing endpoint against CSRF while preserving usability?

  1. HttpOnly cookies alone
  2. A wildcard CORS policy
  3. TLS with HSTS only
  4. SameSite=Lax cookies plus a per-session synchronizer token validated server-side Correct answer.

Explanation

SameSite=Lax blocks most cross-site requests from carrying the session cookie, while the synchronizer token ensures the request originated from the application's own forms. Together they cover both cookie-based and token-based attack paths. Neither control alone is as robust.

Question 24Web Security Fundamentals

An application reflects user input into a JavaScript string literal inside a script block. Which defense is most appropriate?

  1. Relying on X-XSS-Protection
  2. URL encoding only
  3. HTML entity encoding only
  4. JavaScript string escaping plus a CSP nonce, avoiding inline data where possible Correct answer.

Explanation

Data placed in a script context must be escaped for JavaScript string syntax, and better still passed via safe mechanisms such as JSON serialization or data attributes. A CSP nonce further constrains execution of injected script. HTML entity encoding does not neutralize JavaScript string delimiters.

Question 25Web Security Fundamentals

What is the primary security benefit of isolating untrusted third-party scripts in a sandboxed iframe with a restrictive sandbox attribute?

  1. It guarantees the script contains no vulnerabilities
  2. It limits the script's access to the parent page's DOM, cookies, and APIs Correct answer.
  3. It removes the need for HTTPS
  4. It encrypts the script's network traffic

Explanation

The sandbox attribute, especially without allow-same-origin and allow-scripts combinations that defeat it, restricts what an embedded document can do, including access to the parent DOM and credentials. This contains the blast radius of a compromised third-party script. It does not encrypt traffic or guarantee code quality.

Question 26Web Security Fundamentals

Which HTTP response header instructs supporting browsers to only load a page over HTTPS for a defined period after the first secure visit?

  1. Referrer-Policy
  2. X-Content-Type-Options
  3. Strict-Transport-Security Correct answer.
  4. Content-Security-Policy

Explanation

Strict-Transport-Security (HSTS) tells the browser to rewrite future requests for the host to HTTPS for the max-age window, even if a user types http:// or follows an http link. It closes the window for SSL-stripping on repeat visits after the header has been received once over a trusted connection.

Question 27Web Security Fundamentals

A security team wants to stop browsers from MIME-sniffing a response into an executable type. Which header value achieves this?

  1. X-XSS-Protection: 0
  2. Cache-Control: no-store
  3. Content-Type: text/plain
  4. X-Content-Type-Options: nosniff Correct answer.

Explanation

The nosniff directive stops the browser from overriding the declared Content-Type when the declared type is a script or style context, which prevents a text file from being interpreted as executable code. This reduces content-sniffing-based script injection paths.

Question 28Web Security Fundamentals

Which cookie attribute ensures a session cookie is never sent over an unencrypted HTTP connection?

  1. Secure Correct answer.
  2. Domain
  3. HttpOnly
  4. SameSite=Strict

Explanation

The Secure attribute restricts the cookie to secure (HTTPS) channels, so a network attacker cannot capture it from a plaintext request. It complements, but does not replace, transport-level protections such as HSTS.

Question 29Web Security Fundamentals

What is the primary purpose of the Content-Security-Policy report-uri or report-to directive?

  1. To receive browser reports when resources violate the policy Correct answer.
  2. To encrypt the policy in transit
  3. To block requests that violate the policy
  4. To cache allowed resources at the edge

Explanation

Reporting directives tell the browser where to send JSON violation reports so operators can detect breakage and attempted injections without blocking anything extra. Blocking is performed by the policy directives themselves, while reporting is observational.

Question 30Web Security Fundamentals

Which mechanism lets a server declare which other origins may read its responses in a browser fetch?

  1. Subresource Integrity
  2. Content-Security-Policy
  3. Cross-Origin Resource Sharing Correct answer.
  4. Cross-Origin-Embedder-Policy

Explanation

CORS uses Access-Control-Allow-* response headers to tell the browser which requesting origins may read a cross-origin response. Without a matching allowance, the browser blocks script from reading the body even if the request reaches the server.

Question 31Web Security Fundamentals

In the context of web security, what does the term attack surface describe?

  1. The set of all points where an attacker could try to interact with or influence the application Correct answer.
  2. The cryptographic key length used for TLS
  3. The bandwidth an attacker can consume during a denial-of-service attempt
  4. The number of users who have authenticated in a session

Explanation

Attack surface is the sum of entry points, inputs, and exposed interfaces an adversary can reach, such as forms, APIs, headers, and third-party scripts. Reducing it by removing unused endpoints and features lowers the number of things that must be defended.

Question 32Web Security Fundamentals

Which term describes an attacker placing themselves between a user and a web server to read or modify traffic?

  1. Directory traversal
  2. Cross-site scripting
  3. Privilege escalation
  4. Man-in-the-middle attack Correct answer.

Explanation

A man-in-the-middle attacker intercepts the channel between client and server, enabling eavesdropping or tampering. TLS with proper certificate validation is the main defense because it authenticates the endpoint and protects integrity.

Question 33Web Security Fundamentals

An application stores a user's uploaded HTML file and later serves it from the same origin as the main site. Why is this dangerous?

  1. The uploaded HTML can run script in the site's origin and read its cookies or tokens Correct answer.
  2. The file cannot be served over HTTPS
  3. The upload consumes disk space and slows backups
  4. The file will always fail to render in modern browsers

Explanation

Content served from the application origin inherits that origin's privileges, so attacker-supplied HTML with script can act as the site itself. Serving user content from a separate, sandboxed origin or forcing download with a non-renderable type prevents this.

Question 34Web Security Fundamentals

Which statement best describes the same-origin policy in browsers?

  1. All cookies are shared across every domain by default
  2. Script from one origin cannot read most data from a different origin unless that origin explicitly permits it Correct answer.
  3. Scripts may read any cross-origin response as long as the request uses HTTPS
  4. The policy blocks all cross-origin network requests from being sent

Explanation

The same-origin policy restricts script from reading responses belonging to a different scheme, host, or port, while still generally allowing requests to be sent. Relaxations must be granted explicitly through mechanisms such as CORS.

Question 35Web Security Fundamentals

A developer sets Content-Security-Policy: default-src 'self'. A page then tries to load a script from a third-party CDN. What happens in a supporting browser?

  1. The script loads but runs in a sandboxed context
  2. The script request is blocked because the CDN origin is not in the source list Correct answer.
  3. The script loads only if the CDN uses HTTPS
  4. The script loads normally because default-src only covers images

Explanation

default-src acts as the fallback for fetch directives including script-src, so only same-origin scripts are allowed when no explicit script-src is present. The third-party CDN is a different origin and is therefore refused.

Question 36Web Security Fundamentals

Why should security headers such as Content-Security-Policy be sent on every response rather than only on the login page?

  1. Because the header must be rotated with each session token
  2. Because browsers cache headers only for authenticated users
  3. Because the policy applies per document, so any page lacking the header is unprotected Correct answer.
  4. Because headers are ignored on POST requests

Explanation

CSP and similar headers are evaluated for each document the browser loads, so a page served without them has no restrictions. Applying them globally through server or edge configuration prevents gaps on secondary routes.

Question 37Web Security Fundamentals

A site sets Referrer-Policy: strict-origin-when-cross-origin. What referrer information is sent when navigating from an HTTPS page to a different HTTPS host?

  1. The full URL only if the destination is also HTTPS
  2. No referrer at all
  3. The full URL including path and query
  4. Only the origin of the source page Correct answer.

Explanation

Under strict-origin-when-cross-origin, cross-origin navigations receive only the scheme, host, and port, while same-origin requests get the full URL. This limits leakage of path and query data that may contain sensitive identifiers.

Question 38Web Security Fundamentals

Which control most directly limits the damage if a third-party script host is compromised and begins serving malicious JavaScript?

  1. Enabling HTTP/2 on the origin
  2. Setting the Secure flag on session cookies
  3. Adding a long Cache-Control max-age to static assets
  4. A restrictive Content-Security-Policy with hashes or nonces for permitted scripts Correct answer.

Explanation

A CSP that requires integrity hashes or per-response nonces prevents an altered or unexpected script from executing even if it is fetched. Cookie flags and protocol or caching settings do not constrain what code the browser will run.

Question 39Web Security Fundamentals

An API returns JSON containing user-supplied text that is later inserted into a page with element.innerHTML. Which risk is introduced?

  1. HTML injection that can escalate to script execution Correct answer.
  2. Server-side request forgery
  3. SQL injection in the database layer
  4. TLS downgrade

Explanation

Assigning untrusted strings to innerHTML parses them as markup, so injected tags and event handlers can execute. Using textContent or a context-aware sanitizer keeps the data as text rather than active markup.

Question 40Web Security Fundamentals

What does the HttpOnly cookie attribute protect against?

  1. Reading the cookie value through client-side script such as document.cookie Correct answer.
  2. Cookie theft through server-side log files
  3. Cross-site request forgery on state-changing endpoints
  4. Sending the cookie over plaintext HTTP

Explanation

HttpOnly removes the cookie from the document.cookie API, so injected script cannot directly read the session identifier. It does not stop the browser from attaching the cookie to requests, which is why CSRF defenses remain necessary.

Question 41Web Security Fundamentals

A team wants to allow inline event handlers while adopting CSP. Which approach is consistent with a strict policy?

  1. Refactor handlers into external scripts permitted by the policy and avoid unsafe-inline Correct answer.
  2. Rely on the browser's legacy XSS auditor
  3. Disable CSP on pages that contain inline handlers
  4. Add 'unsafe-inline' and rely on input filtering for safety

Explanation

Strict CSP requires moving inline code into external files or authorizing it with nonces or hashes, since unsafe-inline reopens the injection path CSP is meant to close. Input filtering alone is not a reliable substitute for a policy that blocks unauthorized script.

Question 42Web Security Fundamentals

Why is validating input on the server essential even when client-side validation is present?

  1. Browsers refuse to submit forms without server validation
  2. Client-side checks always run after the server processes the request
  3. Client-side checks can be bypassed by crafting requests directly to the server Correct answer.
  4. Server validation removes the need for output encoding

Explanation

Any attacker can send arbitrary requests with tools that ignore the browser UI, so client-side checks are usability aids rather than security boundaries. Server-side validation enforces the actual trust decision.

Question 43Web Security Fundamentals

Which header helps a site detect and block framing by an attacker's page in browsers that support the modern directive?

  1. Content-Security-Policy: sandbox
  2. Content-Security-Policy: frame-ancestors 'self' Correct answer.
  3. Referrer-Policy: no-referrer
  4. Permissions-Policy: geolocation=()

Explanation

The frame-ancestors directive lists which origins may embed the page in a frame, so 'self' blocks external framing. It supersedes the older X-Frame-Options header in supporting browsers.

Question 44Web Security Fundamentals

An application must let users embed rich content from a partner domain while limiting what that content can do. Which approach best fits?

  1. Proxy the partner content and serve it from the main origin
  2. Disable CSP on pages that show partner content
  3. Load the partner content directly into the parent DOM after sanitizing tags
  4. Load the partner content in a sandboxed iframe with a minimal allow list Correct answer.

Explanation

A sandboxed iframe isolates the partner content in a separate browsing context, and the sandbox attribute can withhold capabilities such as script or top navigation. This contains the partner's code without granting it the host page's origin.

Question 45Web Security Fundamentals

What is the security significance of the Origin header on a cross-site POST request?

  1. It identifies the initiating origin and lets the server reject requests from unexpected sites Correct answer.
  2. It encrypts the request body
  3. It lists all cookies the browser will send
  4. It carries the user's session identifier for authentication

Explanation

Browsers set the Origin header to the scheme, host, and port of the initiating context, and script cannot forge it. Servers can compare it to an allow list as part of CSRF defense, though combining it with tokens is stronger.

Question 46Web Security Fundamentals

A penetration tester finds that an endpoint returns detailed stack traces and database errors to clients. Which principle does this violate?

  1. Failing securely without disclosing internal implementation details Correct answer.
  2. Least privilege for database accounts
  3. Separation of duties in deployment
  4. Defense in depth through multiple layers

Explanation

Verbose error output leaks schema, file paths, and library versions that help an attacker refine further attacks. Returning generic error messages to clients while logging details server-side is the secure failure pattern.

Question 47Web Security Fundamentals

A site allows file uploads and builds the stored path by concatenating a user-supplied filename with a base directory. Which risk arises if the filename contains ../ sequences?

  1. TLS certificate mismatch on download
  2. Cookie fixation in the session store
  3. Path traversal that writes files outside the intended directory Correct answer.
  4. Cross-site request forgery against the upload form

Explanation

Unsanitized relative segments can escape the intended directory and overwrite or create files elsewhere on the filesystem. Generating server-side names and validating the resolved path against the base directory prevents this.

Question 48Web Security Fundamentals

An organization terminates TLS at a load balancer and forwards plaintext HTTP to application servers. Which statement about this design is accurate?

  1. The end user's connection is also unencrypted because TLS terminates early
  2. Cookies with the Secure attribute will not be sent by browsers
  3. HSTS will refuse to serve the site in this configuration
  4. Traffic inside the trusted network segment is unencrypted and must be protected by network controls Correct answer.

Explanation

TLS termination at the edge means the browser-to-balancer hop is encrypted, but the balancer-to-origin hop is plaintext unless re-encrypted. Segmentation, mutual TLS, or re-encryption inside the network limits exposure to an attacker who gains internal access.

Question 49Web Security Fundamentals

A page includes a script tag with an integrity attribute containing a SHA-384 hash. A CDN compromise causes a modified file to be served. What does a supporting browser do?

  1. Executes the script only if the CDN uses HTTPS
  2. Executes the script but logs a warning to the console
  3. Refuses to execute the script because the hash does not match Correct answer.
  4. Replaces the script with the previously cached version

Explanation

Subresource Integrity compares the fetched resource against the declared hash and blocks execution on mismatch, which defeats tampering with a third-party host. The page must then handle the missing script gracefully.

Question 50Web Security Fundamentals

An application accepts a URL parameter and uses it server-side to fetch remote content for display. Which vulnerability class is most directly introduced?

  1. Cross-site scripting through the response body only
  2. Session fixation through the URL parameter
  3. Insecure deserialization of the fetched content
  4. Server-side request forgery reaching internal services Correct answer.

Explanation

When the server fetches an attacker-chosen URL, the attacker can target internal addresses that are not reachable from the internet, such as metadata endpoints or admin interfaces. Allow-listing destinations and blocking private address ranges are standard mitigations.