I85PREP
⌘ K
OSCE3 study materials
OSCE3 study resources

OSCE3 practice questions

One question at a time. Build your OSCE3 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Application Testing

During an authorized web assessment you find a reflected cross-site scripting flaw in a search parameter. Which payload encoding most reliably bypasses a filter that blocks the literal characters < and > while the response is written inside an HTML attribute value?

  1. Use a javascript: URI inside a new href attribute created by breaking out of the attribute Correct answer.
  2. Percent-encode the angle brackets as %3C and %3E in the request parameter
  3. Double-encode the angle brackets so the filter decodes them after the browser parses
  4. Submit the payload as UTF-7 so the server transcodes it before filtering

Explanation

When the injection point sits inside an attribute value, breaking out of the attribute and adding an event handler or a javascript: URI avoids the need for literal angle brackets entirely. The browser parses the resulting markup, so the handler fires without any < or > characters. Encoding tricks only help if the filter and the browser disagree on decoding order, which is not guaranteed here.

Question 2Web Application Testing

A login form returns the same generic error message and the same HTTP status for unknown usernames and wrong passwords, but the response time for unknown usernames is consistently about 200 ms lower. What is the most accurate characterization?

  1. The timing difference enables username enumeration and should be reported with measured evidence Correct answer.
  2. The timing difference is irrelevant because timing attacks cannot be automated reliably
  3. The form is not vulnerable to username enumeration because messages and status codes are identical
  4. The form is vulnerable to SQL injection because the timing gap proves a database query differs

Explanation

Uniform messages and status codes address content-based enumeration, but a statistically consistent timing gap still leaks whether the account exists. The finding should be reported with repeated measurements, sample sizes, and variance so the client can reproduce it. Timing attacks are automatable given enough samples, and a timing gap alone does not prove SQL injection.

Question 3Web Application Testing

An application stores a JWT in a cookie and validates the signature server-side. Which additional control most directly limits the impact of a stolen token?

  1. Adding the user's username to the token payload as a custom claim
  2. Increasing the HMAC key length to 512 bits for the signing algorithm
  3. Short token lifetime combined with server-side revocation of the session identifier Correct answer.
  4. Switching the token format from JWT to a signed opaque reference token only

Explanation

A stolen bearer token remains valid until it expires or is revoked, so short lifetimes plus a revocation mechanism bound to a server-side session record bound the exposure window. Key length and payload claims do not help once the token is stolen, because the attacker presents a validly signed token. Opaque tokens help only if they are also revocable and short-lived.

Question 4Web Application Testing

You are testing an endpoint that accepts a JSON body and returns detailed database errors. Which technique best confirms a SQL injection in a numeric JSON field without damaging data?

  1. Insert a semicolon followed by a shell command to test for command injection
  2. Submit a payload that drops the users table to observe the error message
  3. Send a very large integer to trigger an overflow and read the stack trace
  4. Append a boolean expression such as AND 1=1 versus AND 1=2 and compare response content Correct answer.

Explanation

Boolean-based differential testing compares true and false conditions to confirm injection while remaining read-only. Error messages may corroborate the finding but destroying a table is destructive and out of scope. Shell metacharacters and integer overflow test different vulnerability classes.

Question 5Web Application Testing

Which HTTP response header, when correctly configured, instructs modern browsers to block a page from loading scripts from origins not explicitly allowed?

  1. Strict-Transport-Security with a long max-age
  2. Content-Security-Policy with a script-src directive Correct answer.
  3. X-Content-Type-Options: nosniff
  4. Referrer-Policy: no-referrer

Explanation

Content-Security-Policy with script-src restricts which origins may supply executable script, giving a strong mitigation against script injection. nosniff addresses MIME sniffing, HSTS forces HTTPS, and Referrer-Policy controls referrer leakage, none of which restrict script origins.

Question 6Web Application Testing

A web app lets users upload profile images and serves them from a path under the same origin. Which combination most effectively prevents stored script execution via uploaded files?

  1. Requiring users to accept a terms-of-service checkbox before upload
  2. Compressing uploaded images to reduce size before storage
  3. Storing uploads in a database blob column instead of the filesystem
  4. Renaming files with random UUIDs and serving them with a strict Content-Type and nosniff Correct answer.

Explanation

Serving user files from the application origin is dangerous if the browser interprets them as HTML or script. Forcing a safe Content-Type plus nosniff, and avoiding attacker-controlled extensions, prevents the browser from executing the content. Compression, storage location, and policy checkboxes do not change how the browser interprets the response.

Question 7Web Application Testing

Which condition makes an application vulnerable to server-side request forgery through an image-fetch feature?

  1. The server caches fetched images in a shared CDN edge location
  2. The client browser fetches the image directly from the user-supplied URL
  3. The image URL is stored in a database and rendered in an img tag
  4. The server fetches a user-supplied URL without validating the resolved destination address Correct answer.

Explanation

SSRF occurs when the server itself requests a user-controlled URL and can be steered to internal services or metadata endpoints. Validation must occur on the resolved address, not just the hostname string, to defeat DNS rebinding and redirects. Client-side fetching and caching do not by themselves create server-side request capability.

Question 8Web Application Testing

An API uses numeric object identifiers in paths such as /api/invoices/1042. Requests for another tenant's invoice return 200 with data. Which class of flaw is this?

  1. Insecure direct object reference in a static file path
  2. Broken object-level authorization Correct answer.
  3. Server-side template injection
  4. Cross-site request forgery

Explanation

The server fails to check that the authenticated principal owns the requested object, which is broken object-level authorization, often called IDOR. CSRF concerns forged state-changing requests, and template injection concerns server-side template evaluation. Static file path traversal is a different issue from API object ownership.

Question 9Web Application Testing

A site reflects user input into an HTML page but escapes <, >, &, ", and '. Which residual risk most commonly remains?

  1. Injection into an existing script block or event handler where HTML escaping is irrelevant Correct answer.
  2. Clickjacking through missing frame-ancestors
  3. Reflected content being cached by a shared proxy
  4. Cookie theft through the HttpOnly flag being absent

Explanation

HTML entity encoding protects text and attribute contexts, but it does not make data safe inside JavaScript, CSS, or URL contexts. If input lands in a script block or event handler, an attacker can still break out using syntax that entity encoding does not neutralize. Caching, cookie flags, and framing are separate concerns.

Question 10Web Application Testing

Which testing approach best detects blind SQL injection in a parameter whose output is never shown to the tester?

  1. Union-based payloads that append a second result set to the original query
  2. Time-based payloads that introduce a measurable delay conditional on a true expression Correct answer.
  3. Reflected payloads that rely on the response echoing the input
  4. Error-based payloads that rely on verbose database error messages

Explanation

When no output or error text is returned, a conditional time delay provides an observable signal that the injected expression executed. Reflected, error-based, and union techniques all depend on some form of visible output channel. Time-based inference is slower but works without any reflected data.

Question 11Web Application Testing

A web server returns directory listings for folders lacking an index file. Why is this a security concern beyond information disclosure?

  1. It bypasses authentication on all sibling applications
  2. It automatically enables remote code execution through directory traversal
  3. It disables TLS for the affected virtual host
  4. It can reveal backup files and source archives that are then directly downloadable Correct answer.

Explanation

Directory listing exposes file names that are not linked anywhere, including backups, editor swap files, and archives containing source or credentials. Those files can then be fetched directly, turning a listing into a source-code or secret disclosure. Listing does not itself cause code execution, disable TLS, or bypass authentication.

Question 12Web Application Testing

During a test you observe that the Set-Cookie header for a session cookie lacks the Secure attribute while the site is served over HTTPS. What is the most precise impact?

  1. The cookie is stored in the browser indefinitely without expiry
  2. The cookie is shared across all subdomains of the parent domain
  3. The cookie may be transmitted over a plaintext HTTP request if one is made to the same host Correct answer.
  4. The cookie value is readable by JavaScript running on the page

Explanation

Without Secure, the browser may attach the cookie to an HTTP request to the same host, exposing it to network interception. JavaScript readability is controlled by HttpOnly, subdomain scope by the Domain attribute, and persistence by Max-Age or Expires. Those are distinct attributes from Secure.

Question 13Web Application Testing

Which request pattern most directly tests for cross-site request forgery in a state-changing endpoint that uses cookie authentication?

  1. Submitting the request with an oversized body
  2. Submitting the request with an expired session cookie
  3. Submitting the request with a modified JSON content type
  4. Submitting the state-changing request from a different origin without the anti-CSRF token Correct answer.

Explanation

CSRF testing checks whether the server accepts a state-changing request that lacks a valid anti-CSRF token when it originates from another site. If the request succeeds without the token, the endpoint is vulnerable. Expired cookies, content-type changes, and oversized bodies test other behaviors such as session handling and input limits.

Question 14Web Application Testing

A single-page application loads user-controlled HTML into a container using innerHTML. Which mitigation most directly addresses the resulting DOM cross-site scripting risk?

  1. Set the X-Frame-Options header to DENY
  2. Enable HSTS with a one-year max-age
  3. Add the HttpOnly flag to the session cookie
  4. Assign text through textContent or use a sanitizer that produces safe DOM nodes Correct answer.

Explanation

innerHTML parses markup and can create script-bearing nodes from attacker input. Using textContent keeps data as text, and a context-aware sanitizer removes dangerous markup while preserving safe formatting. Cookie flags, HSTS, and framing headers do not stop DOM-based script execution.

Question 15Web Application Testing

Which finding is the strongest indicator that an application is vulnerable to HTTP request smuggling?

  1. The server sets a long Cache-Control max-age on static assets
  2. The server responds with gzip-compressed HTML
  3. The server returns a 404 for paths that do not exist
  4. The front-end and back-end disagree on message length because both Content-Length and Transfer-Encoding are accepted Correct answer.

Explanation

Request smuggling arises when intermediaries parse message boundaries differently, typically when Content-Length and Transfer-Encoding are both present or conflicting. That desynchronization lets an attacker prefix the next request in the queue. Missing paths, caching directives, and compression are unrelated to message framing.

Question 16Web Application Testing

Which technique is appropriate for testing whether a parameter is vulnerable to local file inclusion without reading sensitive system files?

  1. Request a directory listing of the web root
  2. Request /etc/shadow and inspect the returned hashes
  3. Request a remote URL to test for SSRF instead
  4. Request a known harmless file such as a bundled readme and check for its contents Correct answer.

Explanation

Proof of file inclusion requires showing that an arbitrary path is read, and a harmless bundled file demonstrates this without touching sensitive data. Reading password hashes crosses into unnecessary exposure. SSRF and directory listing are different vulnerability classes.

Question 17Web Application Testing

An application uses a templating engine and reflects the string {{7*7}} as 49 in the response. What does this most directly indicate?

  1. Client-side cross-site scripting in an HTML attribute
  2. XML external entity injection
  3. SQL injection in a numeric parameter
  4. Server-side template injection in the evaluated context Correct answer.

Explanation

When a template expression is evaluated server-side and the arithmetic result appears in the response, the input reached a template evaluation context. That is the classic confirmation of server-side template injection. XSS would execute in the browser, and SQL or XXE would produce different observable behavior.

Question 18Web Application Testing

Which control most effectively mitigates clickjacking for a legacy application that must remain frameable by one trusted partner origin?

  1. X-Frame-Options: DENY on all responses
  2. Removing all cookies from the application
  3. Content-Security-Policy frame-ancestors naming only the trusted partner origin Correct answer.
  4. A JavaScript framebusting script that sets top.location

Explanation

frame-ancestors lets you allow framing only by specified origins, which fits the requirement to remain frameable by one partner. DENY would break that requirement, and framebusting scripts are bypassable and unreliable. Cookie removal does not address framing.

Question 19Web Application Testing

Which of the following best describes a second-order SQL injection?

  1. The database returns two result sets that must be merged
  2. Malicious input is stored and later concatenated into a query in a different code path Correct answer.
  3. The injection only works when the query is executed twice in the same request
  4. The payload must be URL-encoded twice to reach the database

Explanation

Second-order injection occurs when stored data is trusted later and concatenated into a query without parameterization. The original submission may be safely stored, so testing only the input endpoint misses the flaw. Re-execution, double encoding, and multiple result sets describe unrelated mechanics.

Question 20Web Application Testing

A password reset flow emails a link containing a token. Which design weakness most directly enables account takeover?

  1. The link is delivered over HTTPS
  2. The token expires after 30 minutes
  3. The reset form requires the user to confirm the new password twice
  4. The token is a predictable value derived from the user's email address Correct answer.

Explanation

If the reset token can be predicted from public information such as the email address, an attacker can forge a valid link for any account. Expiry, transport security, and confirmation fields are good practices that do not create takeover risk. Tokens must be generated with a cryptographically secure random source.

Question 21Web Application Testing

Which testing step best verifies that an access control check is enforced server-side rather than only in the user interface?

  1. Inspect the page source for hidden admin menu items
  2. Disable JavaScript in the browser and reload the page
  3. Check whether the admin link uses a different CSS class
  4. Replay the privileged request directly with a lower-privileged session and observe the response Correct answer.

Explanation

Server-side authorization must be verified by sending the request with a principal that should be denied and confirming the server rejects it. Hiding UI elements or disabling JavaScript only tests client-side presentation. The server response is the authoritative signal.

Question 22Web Application Testing

An application accepts XML input and resolves external entities. Which impact is most characteristic of this configuration?

  1. Disclosure of local files and interaction with internal network services Correct answer.
  2. Execution of arbitrary JavaScript in the victim's browser
  3. Bypass of TLS certificate validation
  4. Persistence of session cookies across subdomains

Explanation

XML external entity processing lets an attacker define entities that read local files or make server-side requests, leading to file disclosure and SSRF-like access to internal services. Browser script execution, TLS validation, and cookie scope are unrelated to XML entity resolution.

Question 23Web Application Testing

You want to determine whether an application is vulnerable to open redirection after login. Which observation confirms it?

  1. The redirect parameter accepts a relative path within the application
  2. The redirect parameter is ignored when it is empty
  3. The login page sets a new session cookie after authentication
  4. The redirect parameter accepts an absolute URL to an external host and the response issues a 302 to that host Correct answer.

Explanation

Open redirection is confirmed when the server honors an attacker-supplied absolute URL and sends the browser to that external destination. Relative paths staying on the same host are the intended safe behavior. Session cookies and empty-parameter handling do not demonstrate redirection control.

Question 24Web Application Testing

Which condition makes a deserialization endpoint a realistic remote code execution risk during a web assessment?

  1. The application compresses serialized data with gzip before transmission
  2. The application deserializes attacker-controlled data with a library that has usable gadget chains on the classpath Correct answer.
  3. The application serializes its own session data before storing it in a database
  4. The application signs serialized data with HMAC-SHA256 and verifies it

Explanation

Unsafe deserialization becomes exploitable when untrusted input reaches a deserializer and the classpath contains gadget chains that trigger side effects during object reconstruction. Serializing trusted server-side state, compressing data, and verifying an HMAC are not by themselves exploitable. Signature verification actually prevents tampering.

Question 25Web Application Testing

Which practice most reduces the risk of testing activity disrupting a production web application during an authorized assessment?

  1. Using the production database backup as the test target without approval
  2. Testing only after business hours without notifying the client
  3. Running all payloads at maximum concurrency to finish quickly
  4. Agreeing on scope, test windows, and destructive-test exclusions with the client in writing beforehand Correct answer.

Explanation

Documented scope, timing, and explicit exclusions for destructive tests let the tester avoid actions that could harm availability or data. High concurrency increases disruption risk, unannounced testing may violate the rules of engagement, and using backups without approval is out of scope.

Question 26Web Application Testing

During a web assessment you find that the application sets a session cookie with the SameSite attribute omitted while state-changing requests rely solely on that cookie. Which attack does this configuration most directly enable?

  1. Cross-site request forgery against authenticated users Correct answer.
  2. Server-side request forgery through the cookie value
  3. SQL injection in the authentication query
  4. Reflected cross-site scripting in the login form

Explanation

When a browser attaches a cookie to cross-site requests because SameSite is absent, an attacker page can trigger state-changing actions as the victim. The cookie value itself does not create script execution, server-side fetches, or SQL injection, so the realistic impact is CSRF.

Question 27Web Application Testing

A REST endpoint accepts a JSON body and echoes the value of a 'name' field into an HTML response header. Which payload class is most appropriate to test whether header injection is possible?

  1. Carriage return and line feed sequences embedded in the field value Correct answer.
  2. A base64-encoded blob longer than the header buffer
  3. A Unicode homoglyph replacing each ASCII letter
  4. A JSON object nested ten levels deep in the field

Explanation

CRLF sequences are the canonical probe for header injection because many servers concatenate user input into header values. If the sequence is not stripped, the attacker can terminate the header and add new ones or split the response.

Question 28Web Application Testing

You are reviewing a JWT-based authentication scheme. The server validates the signature but accepts any value in the 'alg' header, including 'none'. What is the most direct consequence for an attacker?

  1. Brute-forcing the HMAC secret faster than offline
  2. Replaying tokens after their expiry timestamp
  3. Forging tokens with arbitrary claims and no valid signature Correct answer.
  4. Decrypting the contents of other users' tokens

Explanation

If the server honors the 'none' algorithm, an attacker can craft a token with any claims and omit the signature entirely. The server then treats the token as valid, granting whatever privileges the forged claims request.

Question 29Web Application Testing

A web application reflects the value of a query parameter inside a JavaScript block on the page, and the value is escaped only for HTML entities. Which payload style is most likely to achieve script execution?

  1. A CSS expression embedded in a style attribute
  2. An HTML tag with an onerror handler pointing to an external script
  3. A string that closes the existing JavaScript literal and appends a statement Correct answer.
  4. A meta refresh tag with a data URI target

Explanation

HTML-entity escaping does not stop a value placed inside a script context from terminating the surrounding string literal. The attacker supplies characters that close the quote and add executable JavaScript, bypassing the HTML-focused encoding.

Question 30Web Application Testing

An application's password reset endpoint accepts an email address and always returns the same message. Which additional observation most strongly indicates user enumeration is still possible?

  1. Response timing differs measurably between registered and unregistered addresses Correct answer.
  2. The endpoint sets a new session cookie on each request
  3. The endpoint rejects requests without a CSRF token
  4. The endpoint returns HTTP 200 for all requests

Explanation

Uniform response bodies do not prevent enumeration if processing time differs based on whether the account exists, for example due to database lookups or email dispatch. Measuring timing across many requests reveals the side channel.

Question 31Web Application Testing

During testing you notice the application returns detailed stack traces including framework versions when an invalid parameter is supplied. Which risk does this most directly represent?

  1. Cross-site scripting stored in the error log
  2. Information disclosure that aids targeted exploitation Correct answer.
  3. Remote code execution through the error page
  4. Authentication bypass via the error handler

Explanation

Verbose error output exposes internal paths, library versions, and query fragments that help an attacker select exploits. It is an information disclosure finding, even though it does not by itself execute code or bypass authentication.

Question 32Web Application Testing

A web application uses an ORM that parameterizes queries, but a search feature concatenates the sort column name into the SQL string. Which testing step best confirms the vulnerability?

  1. Sending a single quote inside the search term and checking for a generic error page
  2. Supplying a crafted column expression and observing a database error or altered sort order Correct answer.
  3. Adding a semicolon to the search term and looking for a redirect
  4. Appending a comment sequence to the search term and measuring response size

Explanation

The injectable position is the identifier, not a value, so a quote in the search term will be parameterized and harmless. Supplying a column expression tests whether the identifier is concatenated and interpreted by the database.

Question 33Web Application Testing

You are assessing an XML upload feature and want to confirm whether external entity expansion is possible. Which observation most directly confirms the vulnerability?

  1. The response includes contents of a local file referenced by a declared entity Correct answer.
  2. The response returns the same XML document that was submitted
  3. The upload endpoint enforces a 1 MB size limit
  4. The parser rejects the document because the DTD is missing

Explanation

External entity expansion is confirmed when an entity defined in the DTD resolves to local file contents or an out-of-band request. Seeing that data in the response proves the parser resolved the external reference.

Question 34Web Application Testing

A single-page application stores an access token in localStorage and sends it in an Authorization header. Which residual risk remains despite the absence of cookies?

  1. TLS interception becomes possible without a certificate
  2. The token cannot be validated by the server
  3. CSRF becomes trivially exploitable without SameSite
  4. Any successful XSS can read the token and impersonate the user Correct answer.

Explanation

Tokens in localStorage are readable by any script running in the origin, so a single XSS flaw escalates to full session theft. Cookie-based CSRF defenses do not apply because the token is not sent automatically.

Question 35Web Application Testing

Which HTTP response header most directly instructs browsers to restrict a page from being embedded in a frame on another origin?

  1. X-Content-Type-Options set to nosniff
  2. Referrer-Policy set to no-referrer
  3. Strict-Transport-Security with a long max-age
  4. Content-Security-Policy with frame-ancestors Correct answer.

Explanation

The frame-ancestors directive in CSP specifies which origins may embed the page, addressing clickjacking. HSTS, nosniff, and referrer policies govern transport, MIME sniffing, and referrer leakage respectively.

Question 36Web Application Testing

An application exposes a debug endpoint that returns environment variables. Which finding does this most directly support during a web assessment?

  1. Exposure of secrets such as API keys and database credentials Correct answer.
  2. Cross-site scripting through the JSON response
  3. Open redirection via the endpoint path
  4. Server-side request forgery from the debug route

Explanation

Environment variables commonly contain credentials and API keys, so an exposed debug route is a high-impact information disclosure. The other issues would require separate evidence of reflection, outbound fetching, or redirect parameters.

Question 37Web Application Testing

You want to test whether an application's authorization check on an object can be bypassed by manipulating the HTTP method. Which approach is most appropriate?

  1. Send the request twice in rapid succession to detect race conditions
  2. Add a trailing slash to the resource path and compare status codes
  3. Change the Accept header to application/xml and inspect the body
  4. Replay the same request with GET, PUT, and PATCH and compare responses Correct answer.

Explanation

Method-based authorization bypass occurs when a control is applied to one verb but not others, so replaying the operation with alternative verbs reveals the gap. Race conditions, path normalization, and content negotiation address different classes of issues.

Question 38Web Application Testing

A web server returns a 302 redirect to a URL taken from a 'next' parameter without validating the host. Which impact is most characteristic of this flaw?

  1. Bypass of TLS certificate validation
  2. Execution of arbitrary code on the web server
  3. Phishing by redirecting users to an attacker-controlled site after login Correct answer.
  4. Disclosure of the server's private key material

Explanation

An unvalidated redirect target lets an attacker craft a link on the trusted domain that forwards victims to a malicious site, which is useful for credential phishing. It does not grant code execution, key disclosure, or certificate bypass.

Question 39Web Application Testing

During a test of a file upload feature you find that uploaded files are stored under a web-accessible directory and the original extension is preserved. Which follow-up test most directly determines whether the upload leads to code execution?

  1. Upload a file with a double extension and inspect the Content-Type response header
  2. Upload a large file and observe whether the server truncates it
  3. Upload a file containing HTML and check whether it is served with nosniff
  4. Upload a script with an executable extension and request it via the web server Correct answer.

Explanation

Code execution depends on whether the server executes files in the upload directory, so uploading an executable extension and requesting it directly is the decisive test. The response reveals whether the file was interpreted or merely served as static content.

Question 40Web Application Testing

Which testing technique is most suitable for detecting a blind server-side request forgery in a parameter that expects a URL?

  1. Send an oversized value and observe whether the server returns a 413 status
  2. Append a null byte to the parameter and compare response lengths
  3. Point the parameter at a collaborator host you control and watch for inbound requests Correct answer.
  4. Inject a single quote into the parameter and look for a database error

Explanation

Blind SSRF produces no visible response, so the reliable signal is an out-of-band interaction with a listener you control. A callback to your collaborator host confirms the server fetched the supplied URL.

Question 41Web Application Testing

An application uses client-side routing and enforces role checks only in the front-end router. Which test most directly demonstrates the missing server-side control?

  1. Intercept the login request and observe the token format
  2. Inspect the bundled JavaScript for hardcoded role names
  3. Disable JavaScript in the browser and reload the landing page
  4. Call the privileged API endpoint directly with a low-privilege session token Correct answer.

Explanation

Front-end checks are bypassed whenever the API is called directly, so invoking the privileged endpoint with a low-privilege token tests the real enforcement point. A successful response proves the server never verified the role.

Question 42Web Application Testing

Which condition is required for a stored cross-site scripting payload to affect other users of a web application?

  1. The payload is shorter than the database column limit
  2. The payload is submitted over an unencrypted connection
  3. The application uses HTTP/2 for delivery
  4. The stored value is later rendered in a context that does not encode it Correct answer.

Explanation

Stored XSS requires the persisted input to be output into a page without context-appropriate encoding so the browser interprets it as markup or script. Transport protocol and payload size do not determine execution.

Question 43Web Application Testing

A web application includes a parameter that is passed to an operating system command without sanitization. Which payload characteristic is most useful for confirming command injection without causing harm?

  1. A SQL comment sequence appended to the value
  2. A long random string that forces a server error
  3. An XML entity declaration referencing a local file
  4. A metacharacter followed by a benign command whose effect is observable Correct answer.

Explanation

Appending a shell metacharacter with a harmless command such as a DNS lookup or sleep produces an observable effect that confirms injection without destructive action. The other payloads target different vulnerability classes.

Question 44Web Application Testing

During an assessment you observe that the application accepts a serialized object in a cookie and deserializes it server-side. Which factor most increases the likelihood of remote code execution?

  1. The cookie being transmitted without the HttpOnly attribute
  2. A gadget chain available in the loaded libraries that triggers during deserialization Correct answer.
  3. The serialized data being base64-encoded
  4. The application using a recent TLS version

Explanation

Deserialization becomes exploitable for code execution when classes on the classpath form a gadget chain that runs code during object reconstruction. Encoding and transport attributes do not provide the execution primitive.

Question 45Web Application Testing

Which request is most useful for testing whether an application is vulnerable to HTTP verb tampering on an administrative endpoint?

  1. Send the request with an uncommon method such as TRACE or a lowercase verb Correct answer.
  2. Send the request with a very large body to exhaust memory
  3. Send the request with a spoofed User-Agent header
  4. Send the request twice with the same CSRF token

Explanation

Verb tampering exploits access controls that match only specific methods, so unusual or differently cased verbs can slip past filters. Observing a successful privileged response confirms the bypass.

Question 46Web Application Testing

An application reflects a parameter into a JavaScript event handler attribute such as onclick. Which encoding is required to safely place the value there?

  1. HTML entity encoding of angle brackets only
  2. Base64 encoding of the parameter value
  3. JavaScript string and HTML attribute encoding appropriate to the context Correct answer.
  4. URL encoding of the entire parameter value

Explanation

Values inside event handler attributes require both JavaScript encoding to prevent breaking out of the string and HTML attribute encoding to keep the attribute intact. Single-layer encoding leaves a breakout path.

Question 47Web Application Testing

Which evidence most reliably confirms that a web application is vulnerable to local file inclusion rather than merely reflecting the parameter?

  1. The response sets a new cookie on each request
  2. The response contains content from a known system file requested via traversal sequences Correct answer.
  3. The response echoes the parameter value inside an HTML comment
  4. The response returns a 500 status when the parameter is empty

Explanation

LFI is confirmed when traversal sequences cause the server to read and return a file outside the intended directory. Echoing the parameter or changing status codes does not demonstrate file access.

Question 48Web Application Testing

A web application uses a Content Security Policy that allows 'unsafe-inline' in script-src. Which statement best describes the security implication?

  1. The policy enforces HTTPS for all subresources
  2. Inline scripts and event handlers can execute, weakening XSS defenses Correct answer.
  3. The policy blocks all inline styles from loading
  4. The policy prevents framing by other origins

Explanation

Allowing 'unsafe-inline' in script-src permits inline script blocks and event handler attributes, which removes much of CSP's protection against injected scripts. The directive does not govern transport, styling, or framing.

Question 49Web Application Testing

During a test you find that an API returns full records for other tenants when the tenant identifier in the path is changed. Which control is missing?

  1. Server-side object-level authorization tied to the authenticated identity Correct answer.
  2. Encryption of the response body in transit
  3. Rate limiting on the API endpoint
  4. Input validation of the tenant identifier format

Explanation

Changing an identifier to reach another tenant's data succeeds when the server trusts the supplied identifier without verifying ownership against the session. The fix is object-level authorization checks on every request.

Question 50Web Application Testing

Which action best verifies that an application's logout function invalidates the session server-side rather than only clearing the cookie?

  1. Check whether the logout page sets a new CSRF token
  2. Confirm the logout response returns a 302 redirect
  3. Replay the captured session cookie after logout and check whether it is still accepted Correct answer.
  4. Inspect the cookie's expiry attribute in the browser

Explanation

If the server invalidates the session, replaying the old cookie after logout must fail authentication. A cookie cleared only on the client leaves the server-side session valid and the replay succeeds.