Skip to content
Sharp

OWASP Vulnerabilities interview questions

Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), SQL Injection

64 questions with answers and explanations · 64 flashcards

Take a free OWASP Vulnerabilities testAll Java Interview Prep topics

Questions (page 1 of 2)

  1. Why is it risky to use string concatenation to build SQL queries?Multiple choiceEasy
  2. How would you explain a potential limitation of using only CSRF tokens for preventing CSRF attacks in an interview?Multiple choiceHard
  3. In a Spring Security filter chain, what is the purpose of filters?Multiple choiceEasy
  4. What role does the 'Signature' play in a JWT?Multiple choiceMedium
  5. Why does the 'signature' in a JWT matter in this design?Multiple choiceMedium
  6. How would you explain a key strategy Java web applications use to protect against Stored XSS attacks in an interview?Multiple choiceEasy
  7. Which of the following best describes a CSRF attack?Multiple choiceEasy
  8. How does Spring Security validate that a CSRF token is legitimate upon receiving a form submission?Multiple choiceMedium
  9. When using JWTs for stateless authentication, what is a common practice to ensure token security?Multiple choiceMedium
  10. How would you explain a common method for checking the validity of a CSRF token upon receiving a request in an interview?Multiple choiceMedium
  11. How does salting passwords improve security?Multiple choiceMedium
  12. Which scenario best demonstrates a weakness in CSRF token implementation?Multiple choiceHard
  13. What should a developer do to ensure CSRF tokens are not vulnerable to predictable generation?Multiple choiceMedium
  14. In a scenario where a CSRF token is leaked via a referer header, which action should be taken to mitigate this vulnerability?Multiple choiceHard
  15. Why is it important to include CSRF tokens in forms submitted via JavaScript?Multiple choiceEasy
  16. How would you explain a potential risk of improperly validated JSON Web Tokens (JWT) in an interview?Multiple choiceHard
  17. How do stateless JWT tokens benefit an application compared to stateful session storage?Multiple choiceMedium
  18. What does salting a password achieve?Multiple choiceEasy
  19. What role does the 'SameSite' cookie attribute play in CSRF prevention?Multiple choiceMedium
  20. Which of the following best describes how CSRF protection is typically implemented in a Spring Boot application?Multiple choiceMedium
  21. In the context of XSS, why is it insufficient to rely solely on client-side JavaScript sanitization?Multiple choiceHard
  22. In a Java web application using Spring Security, what is the primary mechanism for ensuring that a form submission is from the same client who initially…Multiple choiceEasy
  23. Why can relying solely on CSRF tokens for protecting against CSRF attacks become a problem in production code?Multiple choiceHard
  24. How does the SameSite cookie attribute contribute to CSRF protection?Multiple choiceMedium
  25. Why does a CSRF token in a web application matter in practice?Multiple choiceEasy
  26. Why is it important to regenerate CSRF tokens after a user logs in or out?Multiple choiceEasy
  27. Which of the following is a primary defense mechanism against SQL Injection attacks in Java?Multiple choiceEasy
  28. Why does the Payload part in a JWT matter in this design?Multiple choiceEasy
  29. In a Spring web application, where should the CSRF token be included to ensure request validation?Multiple choiceMedium
  30. Why is it dangerous to store user input directly in a database without validation or encoding?Multiple choiceMedium
  31. Which of the following is a potential consequence of not implementing CSRF protection in a web application?Multiple choiceHard
  32. Why would you choose to use HTML encoding in Java web applications?Multiple choiceMedium
  33. In a Spring Security setup, where is the best place to implement XSS protection for user-generated content?Multiple choiceHard
  34. Which of the following is a key method to prevent Cross-Site Scripting (XSS) attacks in Java web applications?Multiple choiceEasy
  35. Why should CSRF tokens be regenerated after a user logs out and logs back in?Multiple choiceMedium
  36. When configuring CSRF protection in a Spring Boot application, where should the CSRF token be placed in a form submission?Multiple choiceMedium
  37. Why does a CSRF token in web application security matter in this design?Multiple choiceEasy
  38. How would you explain a common method to protect against CSRF attacks in web applications in an interview?Multiple choiceEasy
  39. Which Spring Security component is responsible for processing authentication requests?Multiple choiceHard
  40. How do prepared statements help mitigate SQL Injection attacks in Java?Multiple choiceMedium
  41. How can a web application ensure that a CSRF token is unique for each session?Multiple choiceEasy
  42. Why is it important to use prepared statements in SQL queries?Multiple choiceHard
  43. Why do teams use BCrypt for password hashing in production code?Multiple choiceMedium
  44. Why should password hashing include a 'salt' when storing user credentials?Multiple choiceMedium
  45. Why is it important to HTML encode dynamic content in Java web applications?Multiple choiceEasy
  46. How can SQL injection vulnerabilities be effectively tested in a Java application?Multiple choiceMedium
  47. How would you explain a potential consequence of not using prepared statements in SQL queries in an interview?Multiple choiceMedium
  48. In the context of JWTs, what is the risk of not validating the 'alg' field in the header?Multiple choiceHard
  49. Why is it important to validate the 'exp' claim in a JWT?Multiple choiceHard
  50. How does the Spring Security filter chain protect against SQL Injection?Multiple choiceMedium