Flashcards

Web Security

Protecting web applications and servers

Focuses on securing web applications and servers against various cyber threats by implementing proper security controls, secure coding techniques, and understanding how to detect and prevent common web vulnerabilities.

5 minutes 5 Questions

Web Security involves protecting websites, web applications, and associated services from threats targeting web-based systems. For CompTIA Security+ purposes, key components include: 1. HTTPS/TLS: Encrypting connections between clients and servers using certificates to prevent eavesdropping and man-in-the-middle attacks. 2. Content Security Policy (CSP): Controls which resources a browser can load, helping prevent XSS attacks. 3. Cross-Site Scripting (XSS) Prevention: Implementing input validation, output encoding and sanitization to block malicious scripts. 4. Cross-Site Request Forgery (CSRF) Protection: Using anti-CSRF tokens to verify legitimate requests. 5. SQL Injection Defense: Parameterized queries and input validation to prevent database compromise. 6. Cookie Security: Implementing HTTPOnly, Secure flags, and SameSite attributes. 7. Web Application Firewalls (WAF): Filtering malicious traffic before it reaches applications. 8. Authentication Controls: Strong password policies, MFA, and session management. 9. API Security: Properly authenticating, authorizing and validating API requests. 10. Same-Origin Policy: Browser security mechanism restricting how documents from one origin interact with resources from another origin. 11. Subresource Integrity (SRI): Verifying external resources haven't been tampered with. 12. OWASP Top 10 Awareness: Understanding common vulnerabilities like broken access control, security misconfigurations, and injection flaws. 13. Security Headers: X-XSS-Protection, X-Content-Type-Options, and X-Frame-Options to enhance browser security. 14. Input Validation: Checking all user inputs for expected format and content. 15. Regular Security Testing: Vulnerability scanning, penetration testing, and code reviews. Effective web security requires a defense-in-depth approach combining these technical controls with security-focused development practices and regular monitoring for emerging threats.

Concepts covered: Transport Layer Security (TLS) / Secure Sockets Layer (SSL), HTTP Strict Transport Security, Content Security Policy Header, Cross-Site Scripting (XSS), Secure Cookie Handling, Clickjacking Defense, Content Security Policy (CSP), Structured Query Language (SQL) Injection, Same Origin Policy, Cross-Site Request Forgery (CSRF)

Test mode:

Exam (Timed)

Practice (With explanations)

Start practice test

CompTIA Security+ - Web Security Example Questions

Test your knowledge of Amazon Simple Storage Service (S3)

Question 1

A penetration tester has identified a CSRF vulnerability within your web application. Which cookie attribute should you set to prevent attackers from using a user's browser to send unauthorized requests?

Domain HttpOnly Secure SameSite

Correct Answer: SameSite

The SameSite attribute helps in protecting against CSRF attacks by not sending the cookie when a browser executes a cross-origin request. The other options do not offer direct protection against CSRF.

Question 2

You're updating your website's security and notice numerous CSRF tokens missing. What method would be best to secure against clickjacking attacks?

Enable the Content Security Policy (CSP) header Baselining website performance Changing the user-agent header Deploying a CAPTCHA system

Correct Answer: Enable the Content Security Policy (CSP) header

By enabling the Content Security Policy (CSP) header, you restrict resources to load from specific domains, helping prevent clickjacking attacks. Other options are not as effective or do not specifically address clickjacking defense.

Question 3

An attacker has found a way to place content over your website that makes it appear as if it's part of your site. How do you defend against this?

Maintain a site-wide SSL/TLS policy Restrict iframes loading from external sources Use client-side JavaScript to disable right-click features Hide sensitive content with CSS properties

Correct Answer: Restrict iframes loading from external sources

Restricting iframes loading from external sources prevents attackers from placing content over your site using iframes. Other options do not specifically focus on clickjacking attacks and can be bypassed or provide incomplete protection.

Go Premium

CompTIA Security+ Preparation Package (2025)

1087 Superior-grade CompTIA Security+ practice questions.
Accelerated Mastery: Deep dive into critical topics to fast-track your mastery.
Unlock Effortless CompTIA Security+ preparation: 5 full exams.
100% Satisfaction Guaranteed: Full refund with no questions if unsatisfied.
Bonus: If you upgrade now you get upgraded access to all courses
Risk-Free Decision: Start with a 7-day free trial - get premium features at no cost!

Start Your Free 7-Day Trial