Free · no sign-up · no time limit
Ready-made multiple-choice practice quizzes, hand-checked. Take any free quiz online — every answer comes with an explanation, and every quiz page has a full answer key to revise from.
Loading quizzes
Free · no sign-up · no time limit
Ready-made multiple-choice practice quizzes, hand-checked. Take any free quiz online — every answer comes with an explanation, and every quiz page has a full answer key to revise from.
IT
Test your expertise in modern application security, OWASP Top 10 vulnerabilities, secure session management, and cryptographic implementations. Answer each question to see whether you got it right, with an explanation every time.
A free 16-question multiple-choice practice test on IT. Each question has one correct answer and a short explanation, and the full answer key below the player doubles as a study sheet. No account, no time limit — take it as often as you like.
This is a free, 16-question multiple-choice quiz. Answer each question to see whether you got it right, with an explanation for every answer. There is no sign-up and no time limit — take it as many times as you like, and use the answer key above to revise before or after.
Correct answer: BIt tricks the victim's browser into sending unauthorized HTTP requests along with ambient credentials (like cookies) to a target site
CSRF exploits the trust a site places in a user's browser by having an untrusted site trick the user into executing unwanted actions where they are already authenticated.
Correct answer: BSetting the HttpOnly flag on the cookie
The HttpOnly flag prevents client-side scripts (such as those injected via XSS) from reading document.cookie, mitigating session-hijacking attacks.
Correct answer: BSymmetric uses the same secret key for encryption and decryption; asymmetric uses mathematically paired public and private keys
Symmetric cryptography (AES, ChaCha20) uses a shared secret key for encryption and decryption, while asymmetric cryptography (RSA, ECC) uses public/private key pairs.
Correct answer: CArgon2id
Argon2id (the winner of the Password Hashing Competition) requires configurable compute time and memory allocations, resisting parallel GPU and ASIC attacks.
Correct answer: BIt allows a server to declare which external web origins are permitted to read its HTTP responses via the browser
CORS is a browser security mechanism that relaxes the Same-Origin Policy, allowing servers to specify via headers which external origins can access their resources.
Correct answer: BIt abuses an application feature to force the vulnerable backend server to send crafted requests to internal, unexposed network resources
SSRF allows an attacker to manipulate server functionality to make outbound requests to unintended targets, often reaching internal services (like cloud metadata APIs at 169.254.169.254).
Correct answer: BThey separate SQL query code from user-supplied parameters, ensuring inputs are treated strictly as literal data rather than executable code
Prepared statements pre-compile the SQL template on the database server; parameter values are bound separately and treated strictly as literal data, preventing injection.
Correct answer: BThe token contains no cryptographic signature, allowing an attacker to modify claims (like user ID or roles) without detection
If a server improperly allows the 'none' algorithm, attackers can alter the payload (e.g., setting 'admin': true) and submit the token unsigned, bypassing authentication.
Correct answer: BTo instruct the browser to restrict the sources from which scripts, stylesheets, and images can be loaded and executed
A CSP restricts the domains and mechanisms from which scripts, styles, and other assets can load, mitigating Cross-Site Scripting (XSS) and data injection.
Correct answer: BRemote Code Execution (RCE) via arbitrary gadget chains executed during object reconstruction
Insecure deserialization of untrusted data can trigger gadget chains—sequences of existing classes that execute arbitrary commands or code during object instantiation.
Correct answer: BOAuth 2.0 is an authorization framework (access delegation); OpenID Connect is an identity layer built on top of OAuth 2.0 for user authentication
OAuth 2.0 delegates resource access authorization (via Access Tokens); OpenID Connect builds on OAuth 2.0 to add verified identity and authentication (via ID Tokens).
Correct answer: BA vulnerability where an application uses user-supplied input to access database objects directly without verifying access authorization
IDOR happens when an app exposes internal identifiers (like /orders/1234) without validating that the authenticated user owns or has permission to access that specific resource.
Correct answer: BIt instructs the browser never to send the cookie in cross-site requests, effectively neutralizing CSRF attacks from external links
SameSite=Strict prevents the browser from sending the cookie in any cross-site browsing context (even ordinary incoming links), neutralizing cross-site request forgery.
Correct answer: BTo check whether an issued X.509 digital certificate has been invalidated or compromised prior to its scheduled expiration
CRLs and Online Certificate Status Protocol (OCSP) allow clients to verify whether a certificate authority has revoked a certificate before its formal expiration date.
Correct answer: BIntercepting valid authentication data or network transmissions and fraudulently retransmitting them to repeat authorized actions
A replay attack captures valid network transmissions (like signed requests or tokens) and re-sends them to trick the receiver into executing duplicate unauthorized operations.
Correct answer: BAttacks where third-party hosted script dependencies (e.g., CDN-hosted libraries) are compromised and altered with malicious code
SRI checks the cryptographic hash of scripts loaded from third-party CDNs; if an attacker tampers with the CDN asset, the browser hash check fails and refuses execution.