Web Security.

Web application vulnerabilities and defenses. Covers 13 sub-skills.

• Web Security · 1 of 3

  Input Validation & Sanitization

  Which HTML5 attribute, paired with the 'required' attribute, blocks form submission unless the value matches a given regex?

  AmatchBpatternCregexDvalidate

• Web Security · 2 of 3

  Server-Side Request Forgery

  Which destination ranges should an SSRF egress filter commonly refuse?

  AInternal, loopback, and metadata service addressesBRanges owned by the company's own external SaaS partnersCPublic ranges that resolve through anycast CDN endpointsDAddresses returned by recursive resolvers via DNSSEC chains

• Web Security · 3 of 3

  Supply Chain Security

  A consumer pulls a released tarball and wants proof of which repository and automated workflow produced it. What does a provenance attestation directly establish?

  AProve the artifact will pass downstream consumers' policy gatesBVerify how artifacts were built and by which trusted pipelineCConfirm the maintainer reviewed every patch since the last releaseDGuarantee the artifact contains no transitively vulnerable code