Question

Question 2: Which of the following represents the risk level of most of the vulnerabilities found as a result of probing the www.google.com server using ZAP?

1. Moderate
2. High
3. Severe
4. Critical
5. None of the above

Question 3: When creating a website’s web pages, the X-Frame-Options HTTP header can be used to indicate whether or not a browser used to access a website should be allowed to render a web page in a <frame>, <iframe>, <embed> or <object> tag. Sites can use the X-Frame-Options to avoid clickjacking attacks by ensuring that their content is not embedded into other sites. Sites do that by setting the value of the X-Frame-Options to “deny”, “sameorigin” or “allow-from”. Sone sites, simply, don’t set the value. Which of the following is true about the X-Frame-Options Header setting on the webscantest.com server?

1. It was set to “deny”
2. The risk level associated with its setting is Critical
3. It was not set
4. None of the above

Answer 1

Question 2: "High" represents the risk level of most of the vulnerability found as a result of probing in www.google.com server using Zap?

Zap will use the supplied URL as a starting point to explore the website in such a way that for determining all hyperlinks which are available in it, whenever there is risk level occurs in the resulting in probing with google will refer as high risk.

Question 3: "it was set to deny" statement is true about the X-Frame-Options header setting on the webscantes.com server.

for X-Frame-Options only two possible derivates which is Deny & Samerigin, according to the situation some sites don't set the value because X-Frame-Option is used as Deny that means the page cannot be displayed in a frame, something the site attempting to do so.