Q1easy
You have an API that returns Access-Control-Allow-Origin: *. What are you allowing?
Back to Web Development
19 Questions Total
Web Security MCQs
Topic-wise practice questions for Web Development. Test your knowledge, check solutions on demand, and pace your preparation.
Zero-leak answer engine • Rate-limited explanations
Practice in Timed ModeQ2hard
What is Directory Traversal (or Path Traversal)?
Q3easy
The developer uses this line in an Express.js app. What security risk does it mitigate?
Q4easy
How do Client-Side Validation and Server-Side Validation differ?
Q5easy
An attacker performs "Credential Stuffing". How does it work?
Q6easy
What is the primary purpose of a Web Application Firewall (WAF)?
Q7easy
What is the Principle of Least Privilege in a web backend context?
Q8easy
What is the primary purpose of the Content Security Policy (CSP) header?
Q9easy
Why is "HTTPS-only" recommended for modern web apps?
Q10hard
A user is logged into their bank account. They visit a malicious site
that has a hidden form: <form action="bank.com/transfer"><input