Quick Revision

GK One-Line Question & Answer

15541+ short questions with short answers, covering every category and sub-category on the site — no long articles to scroll through. Good for a fast recap before an exam, or a few minutes of daily practice.

Looking for exam process/strategy questions instead? Try the Exam Preparation FAQ →

Computer Fundamentals → Introduction to Computer 40

Which attack exploits the same origin policy weakness in browsers?
CSRF (Cross-Site Request Forgery)
click to copy
CSRF token prevents CSRF by?
Including unpredictable token in each form submission verified by server
click to copy
Same-Origin Policy (SOP) in browsers restricts?
Scripts from one origin accessing resources of another origin
click to copy
CORS (Cross-Origin Resource Sharing) allows?
Controlled cross-origin requests via HTTP headers
click to copy
Content Security Policy (CSP) prevents?
XSS by controlling which resources the browser may load
click to copy
Path traversal attack attempts to?
Access files outside web root using ../ sequences
click to copy
Command injection attack allows?
Executing arbitrary OS commands through vulnerable input fields
click to copy
Buffer overflow attack overwrites?
Adjacent memory including return address to redirect execution
click to copy
Stack canary protection prevents?
Stack buffer overflows by detecting overwrite before function return
click to copy
ASLR (Address Space Layout Randomization) randomizes?
Memory addresses of process components to hinder exploits
click to copy
DEP/NX (Data Execution Prevention) prevents?
Execution of code from non-executable memory regions (stack/heap)
click to copy
ROP (Return-Oriented Programming) attack bypasses?
DEP/NX by chaining existing code gadgets
click to copy
Which tool is used for network packet capture?
Wireshark
click to copy
Nmap is used for?
Network scanning and host discovery
click to copy
Metasploit is used for?
Penetration testing — developing and executing exploits
click to copy
Nessus is a?
Vulnerability scanner
click to copy
Burp Suite is used for?
Web application security testing (intercepting proxy)
click to copy
John the Ripper is used for?
Password cracking
click to copy
Hashcat is used for?
GPU-accelerated password hash cracking
click to copy
Which password attack tries all possible combinations?
Brute force
click to copy
Rainbow table attack uses?
Pre-computed hash-to-password mappings for fast lookup
click to copy
Salt prevents rainbow table attacks by?
Adding unique random data to each password before hashing
click to copy
Which is the most secure password hashing algorithm?
bcrypt/Argon2
click to copy
Argon2 won the Password Hashing Competition (PHC) in?
2015
click to copy
PBKDF2 applies the underlying hash function?
Thousands to hundreds of thousands of times (iterations)
click to copy
Certificate pinning in mobile apps?
Hardcodes expected certificate/public key to prevent MITM
click to copy
HSTS (HTTP Strict Transport Security) header?
Forces browsers to use HTTPS only for a domain
click to copy
HPKP (HTTP Public Key Pinning) is now?
Deprecated — replaced by Certificate Transparency and CAA records
click to copy
Certificate Transparency (CT) provides?
Publicly auditable logs of issued certificates for detecting misissued certs
click to copy
CAA DNS records specify?
Which Certificate Authorities are allowed to issue certs for a domain
click to copy
OAuth 2.0 is used for?
Authorization — delegated access to resources
click to copy
OpenID Connect is built on top of?
OAuth 2.0 — adds authentication layer
click to copy
SAML (Security Assertion Markup Language) is used for?
Enterprise SSO (Single Sign-On) using XML-based assertions
click to copy
JWT (JSON Web Token) consists of?
Header, Payload, and Signature (Base64URL encoded)
click to copy
Which part of JWT should NOT contain sensitive data without encryption?
Payload (it's encoded, not encrypted — readable by anyone)
click to copy
Which attack exploits XML parser vulnerabilities?
XXE (XML External Entity injection)
click to copy
SSRF (Server-Side Request Forgery) makes the server?
Make requests to internal resources on behalf of attacker
click to copy
Insecure Deserialization can lead to?
Remote Code Execution (RCE) when untrusted data is deserialized
click to copy
Broken Access Control (OWASP #1) means?
Users accessing resources/functions beyond their permissions
click to copy
Privilege escalation attack aims to?
Gain higher privileges than authorized (vertical or horizontal)
click to copy