I85PREP
⌘ K
HTB CWPE study materials
HTB CWPE study resources

HTB CWPE practice questions

One question at a time. Build your HTB CWPE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Application Reconnaissance and Enumeration

During web content discovery against a target, which HTTP status code most reliably indicates that a discovered path exists but requires authentication?

  1. 500 Internal Server Error
  2. 404 Not Found
  3. 401 Unauthorized Correct answer.
  4. 301 Moved Permanently

Explanation

A 401 response means the resource exists but the request lacks valid authentication credentials, which is a strong signal during enumeration that the path is real. A 404 signals absence, a 301 signals a redirect to another location, and a 500 indicates a server-side fault rather than an access-control boundary.

Question 2Web Application Reconnaissance and Enumeration

A tester wants to enumerate virtual hosts on a single IP address without modifying the local hosts file. Which approach best accomplishes this?

  1. Run a full TCP port scan and treat every open port as a virtual host
  2. Send requests with different Host headers and compare response bodies and status codes Correct answer.
  3. Resolve the IP with a reverse DNS lookup and trust the returned PTR record
  4. Query the target's DNS zone transfer on port 53 and read the A records

Explanation

Virtual host enumeration relies on varying the Host header while keeping the destination IP constant, then filtering on differences in response length, status, or body content. Reverse DNS and port scanning do not reveal name-based routing, and zone transfers are rarely permitted and only expose DNS records.

Question 3Web Application Reconnaissance and Enumeration

Which file is most commonly checked first to identify disallowed paths that a site owner intended to hide from crawlers?

  1. robots.txt Correct answer.
  2. crossdomain.xml
  3. security.txt
  4. sitemap.xml

Explanation

robots.txt contains Disallow directives that frequently point to administrative or sensitive directories the owner wanted excluded from indexing. sitemap.xml advertises intended public pages, crossdomain.xml governs Flash/Silverlight cross-domain policy, and security.txt holds vulnerability disclosure contacts.

Question 4Web Application Reconnaissance and Enumeration

An analyst inspects a response and sees the header `Server: nginx/1.18.0`. What is the most accurate interpretation for reconnaissance purposes?

  1. The server advertises its product and version, which can guide targeted vulnerability research Correct answer.
  2. The header confirms the operating system distribution and kernel version
  3. The header is a client-supplied value and cannot be trusted as server information
  4. The header proves the backend application framework and language in use

Explanation

The Server header is set by the web server and often leaks product and version, which an attacker maps to known CVEs or default configurations. It does not identify the application framework, the OS distribution, or a client-supplied value.

Question 5Web Application Reconnaissance and Enumeration

Which technique best reveals endpoints referenced by a single-page application's JavaScript bundle during reconnaissance?

  1. Extracting string literals and API paths from the downloaded JS files Correct answer.
  2. Reading the HTTP response's Date header
  3. Requesting the favicon and hashing its contents
  4. Sending an OPTIONS request to the root path only

Explanation

Client-side bundles frequently embed API routes, parameter names, and internal hostnames as string literals, so extracting them exposes endpoints that are not linked in HTML. OPTIONS on the root, the Date header, and favicon hashing do not enumerate application routes.

Question 6Web Application Reconnaissance and Enumeration

A directory brute-force run returns 200 for every requested path with nearly identical body sizes. What is the most likely cause?

  1. The scanner is sending malformed HTTP requests
  2. A catch-all or soft-404 handler returning a generic page for unknown paths Correct answer.
  3. The server is redirecting all requests to HTTPS
  4. The wordlist contains only valid directories

Explanation

A wildcard response, often called a soft 404, returns a normal status with a generic body for nonexistent paths, producing false positives across the entire wordlist. The fix is to baseline a random path and filter results by response size, hash, or body similarity.

Question 7Web Application Reconnaissance and Enumeration

Which DNS record type is most useful for confirming that a subdomain is delegated to a third-party service such as a cloud provider?

  1. TXT
  2. CNAME Correct answer.
  3. SOA
  4. MX

Explanation

A CNAME maps the subdomain to another canonical name, often a provider-controlled hostname, which reveals third-party delegation and potential subdomain takeover risk. MX handles mail routing, TXT holds arbitrary text such as SPF, and SOA describes zone authority.

Question 8Web Application Reconnaissance and Enumeration

During recon, an analyst observes that requesting `/admin` returns 302 to `/login`, while `/admin/` returns 200 with a login form. What does this most likely indicate?

  1. The 302 response proves the admin panel is publicly accessible
  2. The server has no administrative interface at all
  3. Path normalization differences cause the server to treat the two paths as distinct resources Correct answer.
  4. The 200 response is a false positive caused by a soft-404 handler

Explanation

Trailing-slash and normalization handling can route the same logical resource differently, producing a redirect in one case and content in another. This behavior is a useful enumeration signal because it reveals how the server maps directories and where real resources live.

Question 9Web Application Reconnaissance and Enumeration

Which request is most appropriate for checking which HTTP methods a specific API endpoint advertises?

  1. CONNECT /api/users
  2. HEAD /api/users
  3. TRACE /api/users
  4. OPTIONS /api/users Correct answer.

Explanation

The OPTIONS method asks the server which methods are permitted for the target resource and often returns an Allow header. HEAD returns headers only for a GET, TRACE echoes the request, and CONNECT establishes a tunnel.

Question 10Web Application Reconnaissance and Enumeration

A tester wants to identify the technology stack behind a web application from passive reconnaissance. Which source is most directly useful?

  1. The TLS certificate's serial number
  2. Publicly indexed response headers and HTML generator meta tags captured by search engines or archives Correct answer.
  3. The target's WHOIS registrant email address
  4. The number of open ports on the host

Explanation

Archived responses and indexed headers or generator meta tags reveal frameworks, CMS versions, and server software without touching the target. WHOIS, port counts, and certificate serials do not identify the application stack.

Question 11Web Application Reconnaissance and Enumeration

Which action best helps distinguish a genuine hidden directory from a wildcard response during content discovery?

  1. Increase the thread count until responses stop timing out
  2. Request a randomly generated path and record the baseline response for comparison Correct answer.
  3. Switch the wordlist to a larger generic list
  4. Disable redirect following in the scanner

Explanation

Requesting a random, almost certainly nonexistent path establishes the server's default response, which can then be filtered out by status, length, or body hash. Raising threads or enlarging the wordlist amplifies false positives rather than resolving them.

Question 12Web Application Reconnaissance and Enumeration

An analyst finds a `.git` directory exposed on a web server. What is the primary reconnaissance value of this finding?

  1. It allows the analyst to push changes to the production repository
  2. It proves the server is running a Git daemon on port 9418
  3. It guarantees the application is written in a specific language
  4. The repository metadata and objects may reveal source code, commit history, and hardcoded secrets Correct answer.

Explanation

An exposed .git directory lets an attacker reconstruct source and history from objects and refs, often exposing credentials and internal logic. It does not imply a Git daemon, write access, or a specific language.

Question 13Web Application Reconnaissance and Enumeration

Which header is most relevant when assessing whether a target application leaks internal infrastructure through proxy behavior?

  1. Content-Length
  2. Referer
  3. Accept-Language
  4. Via Correct answer.

Explanation

The Via header is added by proxies and can disclose intermediary hostnames or software, revealing internal infrastructure. Accept-Language and Referer are client-driven, and Content-Length describes body size.

Question 14Web Application Reconnaissance and Enumeration

A tester discovers a parameter named `debug` that, when set to `true`, returns a stack trace with file paths. Which conclusion is best supported?

  1. The parameter is ignored and the trace is a static page
  2. The application is vulnerable to remote code execution through this parameter
  3. The stack trace confirms the database credentials are valid
  4. The application exposes verbose error handling that can aid further mapping of the codebase Correct answer.

Explanation

A debug toggle that returns stack traces leaks internal paths, framework versions, and code structure, which supports further enumeration. It does not by itself prove code execution or credential validity, and a changing trace indicates dynamic behavior.

Question 15Web Application Reconnaissance and Enumeration

Which approach most effectively enumerates subdomains when the target domain does not allow zone transfers?

  1. Sending an ANY query to the apex nameserver
  2. Requesting the apex A record repeatedly
  3. Combining certificate transparency logs with passive DNS and brute force of a wordlist Correct answer.
  4. Querying the SOA record of the apex domain

Explanation

Certificate transparency logs, passive DNS datasets, and wordlist brute forcing complement each other to reveal subdomains without zone transfer access. SOA, ANY, and repeated apex queries return limited apex data rather than enumerating names.

Question 16Web Application Reconnaissance and Enumeration

During recon, an analyst notices that responses include `X-Powered-By: PHP/7.4.3`. What is the appropriate next step?

  1. Conclude the application uses ASP.NET Core
  2. Correlate the disclosed version with known vulnerabilities and look for PHP-specific endpoints Correct answer.
  3. Report the header as a critical vulnerability by itself
  4. Assume the server is fully patched because the header is present

Explanation

Version disclosure should be mapped to known issues for that runtime and used to guide targeted testing of PHP-specific files and parameters. It does not indicate ASP.NET, prove patching, or constitute a critical finding alone.

Question 17Web Application Reconnaissance and Enumeration

An analyst wants to discover API versions and undocumented endpoints on a REST service. Which technique is most direct?

  1. Reading the TLS cipher suite negotiated by the server
  2. Resolving the domain's NS records
  3. Fuzzing path segments such as /v1, /v2, and /api and comparing responses Correct answer.
  4. Checking the server's uptime via the Date header

Explanation

Path fuzzing across version and base segments reveals which API versions exist and how the server responds to unknown routes. TLS ciphers, Date headers, and NS records provide no information about API structure.

Question 18Web Application Reconnaissance and Enumeration

A scan of a target returns a 403 for `/backup.zip` while neighboring random paths return 404. What is the most reasonable interpretation?

  1. The server is vulnerable to directory traversal
  2. The file does not exist and the 403 is meaningless
  3. The file likely exists but access is restricted, warranting further investigation Correct answer.
  4. The server is down and returning cached errors

Explanation

A distinct 403 for a specific path while random paths return 404 indicates the resource exists but is protected, which is a meaningful discovery signal. It does not indicate server downtime, nonexistence, or traversal by itself.

Question 19Web Application Reconnaissance and Enumeration

Which source is best for discovering historical URLs of a target that may no longer be linked in the current site?

  1. The server's TLS certificate chain
  2. The target's MX records
  3. Web archives and URL aggregation services Correct answer.
  4. The current site's navigation menu

Explanation

Web archives and URL aggregation services preserve historical paths and parameters that may still be reachable, making them valuable for recon. Current navigation, certificate chains, and MX records do not expose past URLs.

Question 20Web Application Reconnaissance and Enumeration

An analyst finds that the application returns different response lengths for `/user/1` and `/user/2` but identical status codes. What does this most likely suggest?

  1. The endpoint returns object-specific data, indicating a valid resource pattern worth enumerating Correct answer.
  2. The endpoint is a static page unaffected by the path parameter
  3. The responses are identical and the length difference is noise
  4. The server is performing load balancing across backends

Explanation

Varying response bodies for sequential identifiers indicate the path parameter selects real objects, which is a strong signal for further enumeration and access-control testing. Static pages, load balancing, and noise do not explain consistent object-specific differences.

Question 21Web Application Reconnaissance and Enumeration

Which combination of signals most reliably fingerprints a web framework during active reconnaissance?

  1. The negotiated HTTP version and TCP window size
  2. The number of A records for the apex domain
  3. The target's WHOIS creation date and registrar
  4. Cookie names, error page structure, and static asset path conventions Correct answer.

Explanation

Framework fingerprinting relies on correlated artifacts such as session cookie naming, distinctive error templates, and predictable asset directories. WHOIS, record counts, and TCP parameters do not identify application frameworks.

Question 22Web Application Reconnaissance and Enumeration

A tester observes that a target returns a 200 with a full HTML page for `/index.php/anything/here`. What is the most likely explanation?

  1. A front controller routes all paths through index.php and returns the default page for unknown routes Correct answer.
  2. The response is a soft-404 from an unrelated virtual host
  3. The server is vulnerable to path traversal
  4. The application is statically generated with one file per path

Explanation

Front-controller architectures rewrite arbitrary path suffixes to a single entry script, which then serves a default page for unmatched routes. This explains the consistent 200 and should be baselined to avoid false positives.

Question 23Web Application Reconnaissance and Enumeration

Which recon technique best identifies parameters accepted by an endpoint that are not documented in the visible UI?

  1. Querying the domain's TXT records
  2. Inspecting the server's TLS certificate subject
  3. Parameter fuzzing with a wordlist while monitoring for changes in status, length, or reflected content Correct answer.
  4. Sending a single GET request to the endpoint root

Explanation

Hidden parameters are discovered by fuzzing common names and observing differential responses such as status changes, length shifts, or reflection. A single root request, certificate subject, and TXT records reveal nothing about accepted parameters.

Question 24Web Application Reconnaissance and Enumeration

During enumeration, an analyst finds `/.well-known/security.txt` and `/crossdomain.xml` both present. What is the most useful takeaway?

  1. The site is confirmed vulnerable to cross-site scripting
  2. The site follows some standardized metadata conventions, which can reveal contacts and legacy cross-domain policy Correct answer.
  3. The site is running an outdated web server
  4. The site has no security controls in place

Explanation

These well-known files indicate standardized metadata publication: security.txt provides disclosure contacts and crossdomain.xml defines legacy rich-client policy. Their presence does not prove XSS, server age, or absence of controls.

Question 25Web Application Reconnaissance and Enumeration

An analyst wants to reduce false positives while brute-forcing directories on a target that returns custom 404 pages. Which strategy is most effective?

  1. Use only HEAD requests and accept every response
  2. Disable all filtering and manually review thousands of results
  3. Ignore all responses with status 404 and trust only 200
  4. Filter results by comparing response body similarity and content length against a known nonexistent path Correct answer.

Explanation

Custom error pages can return 200 or misleading statuses, so comparing body similarity, hashes, and length against a baseline nonexistent path filters wildcard responses. Trusting status alone or accepting every response reintroduces false positives.

Question 26Web Application Reconnaissance and Enumeration

An analyst retrieves a target's `robots.txt` and finds a `Disallow` entry for `/internal/reports/`. What is the most accurate way to interpret this finding during web reconnaissance?

  1. It proves the path exists and is exploitable, because servers only list real directories in `robots.txt`.
  2. It should be ignored entirely, because `robots.txt` affects search engine crawlers and never reflects application structure.
  3. It is a hint worth requesting manually, because the file often reveals paths the owner prefers not to be crawled. Correct answer.
  4. It indicates the path is protected by authentication, since disallowed paths are always placed behind a login.

Explanation

`robots.txt` is advisory for crawlers and is frequently used to hide administrative or staging paths from indexing, so its entries are useful reconnaissance leads. The listed paths still must be requested and validated manually, because the file neither guarantees existence nor indicates protection status.

Question 27Web Application Reconnaissance and Enumeration

Which artifact retrieved during reconnaissance most directly reveals the client-side JavaScript files and API base paths an application loads at runtime?

  1. The `Server` response header
  2. The HTML source of the landing page Correct answer.
  3. The TLS certificate subject field
  4. The `Set-Cookie` attributes

Explanation

The HTML source references script tags, bundled assets, and sometimes inline configuration containing API base URLs, which are then fetched and reviewed for endpoints. Response headers, certificates, and cookies expose server software and session behavior but not the application's own asset and endpoint references.

Question 28Web Application Reconnaissance and Enumeration

A tester wants to determine whether a target's content discovery results are trustworthy when the application responds with a soft 404: a 200 status and a generic page for unknown paths. Which approach is most sound?

  1. Disable redirect following so that soft 404 pages return their original status.
  2. Compare each response against a baseline of random nonexistent paths using body length, content hash, and page text. Correct answer.
  3. Trust the status code and treat every 200 as a valid discovered resource.
  4. Switch to a HEAD-only scan, since soft 404 pages are not returned for HEAD requests.

Explanation

A soft 404 returns success status for missing content, so validity must be judged by comparing candidate responses to a baseline captured from random, certainly nonexistent paths. Differences in response size, body similarity, and reflected text separate genuine resources from the catch-all page.

Question 29Web Application Reconnaissance and Enumeration

During enumeration an analyst notices the target responds to `OPTIONS /api/v2/users` with an `Allow` header listing `GET, POST, PUT, DELETE, PATCH`. What is the most defensible conclusion?

  1. The endpoint advertises multiple methods, each of which should be tested individually for authorization and input handling. Correct answer.
  2. The listed methods are the only routes that exist anywhere in the API.
  3. The endpoint accepts unauthenticated write operations from any client.
  4. The endpoint is vulnerable to HTTP verb tampering by default.

Explanation

The `Allow` header enumerates methods the endpoint claims to support, which is a recon lead indicating where to probe write operations and per-method access control. Advertising a method does not establish that it is reachable without authentication or that it is misconfigured, so each method must be requested and observed.

Question 30Web Application Reconnaissance and Enumeration

An analyst reviewing collected JavaScript finds a webpack chunk that builds request URLs from a constant such as `const BASE = "/api/internal/";` plus a resource name, and the chunk also contains a list of string literals like `invoices`, `exports`, `audit-log`. Which follow-up plan best converts this finding into validated endpoints?

  1. Discard the chunk, since minified bundle contents are not reliable reconnaissance material.
  2. Request each candidate path under the base and compare responses against a known-missing path to confirm which ones resolve to real handlers. Correct answer.
  3. Report the base path as a directory traversal vulnerability without sending any requests.
  4. Conclude the paths are live because they appear as string literals in the shipped bundle.

Explanation

String literals in client bundles are candidate route fragments, not confirmed endpoints, so each must be requested and compared with a baseline missing path to filter catch-all and error responses. This turns static extraction into validated findings and reveals authorization behavior along the way.

Question 31Authentication and Session Management Attacks

During a web assessment you capture a cookie whose value is a long Base64 string that decodes to readable text such as 'user=alice;role=admin'. Which session weakness does this most directly indicate?

  1. Session tokens are protected by TLS but lack the HttpOnly attribute
  2. Session tokens are stored client-side in a decodable format without integrity protection Correct answer.
  3. Session fixation allows an attacker to preset the victim's identifier
  4. Server-side session state is retained indefinitely after logout

Explanation

When a cookie decodes into plaintext attributes such as username and role, the token carries state client-side and is only encoded, not signed or encrypted. Without a MAC or encryption, a user can tamper with the value to escalate privileges. This is a client-side tampering weakness rather than fixation or transport protection.

Question 32Authentication and Session Management Attacks

Which HTTP response header instructs the browser to send a cookie only over encrypted connections?

  1. SameSite
  2. Content-Security-Policy
  3. Secure Correct answer.
  4. Strict-Transport-Security

Explanation

The Secure attribute on a Set-Cookie header restricts the cookie to HTTPS requests, preventing it from leaking over plaintext HTTP. HSTS enforces HTTPS for the whole origin but is not a cookie attribute. SameSite controls cross-site sending, not transport encryption.

Question 33Authentication and Session Management Attacks

An application sets the session identifier before the user logs in and keeps the same value after authentication. What attack does this enable?

  1. Session fixation Correct answer.
  2. HTTP response splitting
  3. Cross-site scripting through reflected parameters
  4. Password spraying against the login form

Explanation

Reusing a pre-authentication identifier after login means an attacker who plants a known session ID can ride the victim's authenticated session. The fix is to issue a fresh identifier at privilege change. This pattern is the definition of session fixation.

Question 34Authentication and Session Management Attacks

A JWT uses the HS256 algorithm and the server validates signatures with a hardcoded secret found in the public JavaScript bundle. What is the most direct consequence?

  1. Tokens cannot be replayed because HS256 includes a nonce
  2. The token payload becomes unreadable to the client
  3. An attacker can forge arbitrary tokens with valid signatures Correct answer.
  4. Signature verification becomes unnecessary and is skipped

Explanation

HS256 is a symmetric algorithm, so anyone holding the signing key can produce valid signatures. If the secret ships in client-side code, an attacker can mint tokens with any claims. The payload being Base64URL-encoded is unrelated to secrecy.

Question 35Authentication and Session Management Attacks

Which practice best mitigates the impact of a stolen session cookie being replayed by an attacker?

  1. Encoding the cookie value with Base64
  2. Storing additional user data inside the cookie
  3. Increasing the cookie's expiration to reduce re-authentication
  4. Binding the session to a server-side record with idle and absolute timeouts Correct answer.

Explanation

Server-side session records allow revocation and enforce idle and absolute lifetimes, shrinking the window in which a stolen cookie works. Longer expiration widens that window. Encoding adds no protection, and stuffing data into the cookie increases exposure.

Question 36Authentication and Session Management Attacks

A login endpoint accepts a 'remember me' parameter that sets a cookie containing the username concatenated with a static server secret. Why is this design weak?

  1. The value is deterministic and can be replayed indefinitely by anyone who observes it Correct answer.
  2. The cookie cannot be sent over HTTPS
  3. The username is not a valid cookie character set
  4. The cookie exceeds typical browser size limits

Explanation

A static, predictable value derived from public data and a fixed secret acts as a bearer credential with no expiry or rotation. Once observed, it can be replayed forever. Secure remember-me tokens should be random, single-use for rotation, and revocable server-side.

Question 37Authentication and Session Management Attacks

What does the SameSite=Strict cookie attribute primarily prevent?

  1. The cookie from being read by JavaScript
  2. The cookie from being transmitted over unencrypted HTTP
  3. The cookie being sent on cross-site requests initiated by other origins Correct answer.
  4. The cookie from being stored on disk

Explanation

SameSite=Strict stops the browser from attaching the cookie to requests whose initiator is a different site, which blunts cross-site request forgery. It does not address script access, transport encryption, or persistence. Those concerns map to HttpOnly, Secure, and storage behavior.

Question 38Authentication and Session Management Attacks

You find a JWT whose header declares 'alg':'none' and the server accepts it without a signature. What class of vulnerability is this?

  1. Signature stripping through the none algorithm Correct answer.
  2. Token replay due to missing expiration
  3. Algorithm confusion via key type mismatch
  4. Weak HMAC secret brute forcing

Explanation

Accepting the 'none' algorithm means a token with no signature is treated as valid, so an attacker can alter claims freely. The fix is to whitelist expected algorithms server-side and reject 'none'. This is distinct from confusion attacks that swap RS256 for HS256.

Question 39Authentication and Session Management Attacks

An attacker submits a JWT signed with HS256 to a server that normally issues RS256 tokens and verifies using its RSA public key as the HMAC secret. What is this attack called?

  1. Algorithm confusion Correct answer.
  2. Credential stuffing
  3. Session fixation
  4. Cross-site request forgery

Explanation

Algorithm confusion exploits a verifier that trusts the token's alg header and uses the public key material as an HMAC secret. Because the public key is known, the attacker can compute a valid HS256 signature. The defense is to pin the expected algorithm and key type per token.

Question 40Authentication and Session Management Attacks

A penetration test shows that after a successful login the application does not rotate the session ID but does set HttpOnly and Secure. What is the most accurate assessment?

  1. The session ID is now protected from tampering by the flags
  2. The cookie flags fully mitigate the missing rotation
  3. The application is vulnerable to SQL injection via the cookie
  4. The session remains vulnerable to fixation despite the cookie flags Correct answer.

Explanation

HttpOnly and Secure protect against script theft and plaintext leakage but do nothing about an attacker who already knows the pre-login identifier. Without rotation at authentication, the planted ID becomes the authenticated session. Rotation is the specific control for fixation.

Question 41Authentication and Session Management Attacks

Which server-side control most directly limits the damage of an attacker replaying a stolen session cookie from a different network?

  1. Rotating the cookie value on every request without server-side state
  2. Adding a longer expiration to reduce login prompts
  3. Binding the session to attributes such as client IP or a device fingerprint with re-authentication on mismatch Correct answer.
  4. Encoding the cookie with URL-safe Base64

Explanation

Binding a session to stable client attributes raises the cost of replay from another location, and a mismatch should trigger re-authentication rather than silent failure. Stateless per-request rotation without server state breaks legitimate clients. Longer expiry and encoding do not address replay.

Question 42Authentication and Session Management Attacks

A web application authenticates users with a cookie whose value is the Base64 encoding of 'uid=42;role=user'. Which modification would an attacker most likely attempt to escalate privileges?

  1. Decode, alter the role to admin, re-encode, and resubmit Correct answer.
  2. Add the Secure attribute to the cookie
  3. Change the cookie name to a reserved prefix
  4. Shorten the cookie by removing the uid field

Explanation

Because the value is only encoded and presumably trusted as-is, editing the role field and re-encoding yields a forged privilege claim. The application must sign or encrypt the value and validate the role server-side. Renaming or trimming fields does not escalate privileges.

Question 43Authentication and Session Management Attacks

An application stores session identifiers in a cookie but never sets an expiration, and the server keeps sessions valid for months. Which risk is most significant?

  1. Failure of the SameSite attribute
  2. Increased exposure window for stolen or leaked identifiers Correct answer.
  3. Loss of cookie confidentiality in transit
  4. Inability to use HTTPS

Explanation

Sessions without idle or absolute timeouts remain valid long after a token leaks through logs, shared devices, or malware. Limiting lifetime and enforcing re-authentication reduce that exposure. Transport confidentiality and SameSite behavior are separate controls.

Question 44Authentication and Session Management Attacks

Which OAuth 2.0 / OpenID Connect control binds an authorization response to the client that initiated the request and mitigates authorization code injection?

  1. The scope parameter
  2. The nonce claim in the ID token
  3. The state parameter alone
  4. PKCE with a code_verifier and code_challenge Correct answer.

Explanation

PKCE has the client generate a verifier and send its transformed challenge with the authorization request, then prove possession at the token endpoint. An injected code cannot be redeemed without the verifier. State mitigates CSRF but does not bind the code to the client.

Question 45Authentication and Session Management Attacks

During a test you observe that the login form accepts unlimited attempts and returns distinct messages for unknown users versus wrong passwords. Which combination of weaknesses does this represent?

  1. Username enumeration and missing brute-force throttling Correct answer.
  2. CSRF and clickjacking
  3. Session fixation and cookie tampering
  4. JWT algorithm confusion and replay

Explanation

Different responses for unknown accounts versus bad passwords let an attacker enumerate valid usernames. Unlimited attempts permit online guessing and credential stuffing. The fix is uniform error messaging plus rate limiting and lockout or CAPTCHA.

Question 46Authentication and Session Management Attacks

What is the primary purpose of the nonce parameter in an OpenID Connect authentication request?

  1. To authorize access to protected resources
  2. To bind the ID token to the client's original request and prevent replay Correct answer.
  3. To rotate the refresh token
  4. To encrypt the ID token payload

Explanation

The client sends a nonce and expects it echoed in the ID token, confirming the token resulted from its own request and was not replayed. It does not encrypt the token or authorize API access. Refresh token rotation is a separate mechanism.

Question 47Authentication and Session Management Attacks

A single sign-on system issues a SAML assertion to a service provider without validating the assertion's audience and recipient. Which attack does this most directly enable?

  1. Password spraying
  2. Assertion replay at a different service provider Correct answer.
  3. Reflected cross-site scripting
  4. Session fixation via URL parameters

Explanation

Without audience and recipient checks, an assertion minted for one service provider can be replayed to another that trusts the same identity provider. Validating Audience and Recipient restricts where the assertion is accepted. The other options are unrelated to assertion scoping.

Question 48Authentication and Session Management Attacks

An application uses a predictable session identifier generated by incrementing a counter stored in a cookie. Which two weaknesses are most directly present?

  1. Predictability and client-side state control Correct answer.
  2. Binding and revocation
  3. Encryption and integrity
  4. Rotation and expiration

Explanation

A counter-based identifier is guessable, allowing an attacker to enumerate valid sessions. Storing the counter client-side lets an attacker choose the value, which also enables fixation. The fix is to generate high-entropy identifiers server-side.

Question 49Authentication and Session Management Attacks

Which condition makes a cookie vulnerable to interception by a network attacker on a shared Wi-Fi network?

  1. The cookie has SameSite=Strict
  2. The cookie has HttpOnly set
  3. The cookie lacks the Secure attribute and the site allows plaintext HTTP Correct answer.
  4. The cookie has a short expiration

Explanation

Without Secure, the browser may send the cookie over HTTP, where it can be captured in transit. SameSite and HttpOnly do not encrypt traffic, and short expiration only limits the usable window. Enforcing HTTPS and the Secure attribute prevents plaintext exposure.

Question 50Authentication and Session Management Attacks

An attacker with a valid low-privilege account modifies their JWT payload to change 'sub' to another user's identifier while keeping the original signature. Why does this fail against a correctly implemented verifier?

  1. The payload is encrypted and cannot be edited
  2. The 'sub' claim is ignored by all verifiers
  3. JWTs cannot contain a 'sub' claim
  4. The signature covers the header and payload, so any change invalidates it Correct answer.

Explanation

A JWS signature is computed over the Base64URL-encoded header and payload, so altering claims changes the signing input and the signature no longer matches. The verifier rejects the token. Encryption is not implied by signing, and 'sub' is a standard claim.