CIS484 Exam 1 Questions with
complete solution 2026/2027
What are the main differences between the GET and POST requests - correct answer ✔The main
difference is in how they send data to the server. Also a GET will retrieve data and a Post sends data
What are the main purposes of HTTP cookies - correct answer ✔used to save information on the client
side, Browser save cookies, attach cookies in every request
Please explain how cookies can be used to track users. - correct answer ✔either the website itself or a
third part can set a cookie via the web browser. The browser or whoever set the cookie can track the
clicks and sites the user visits and can target particular advertisements based on the browsing history.
Please explain why disabling third-part cookies can help prevent tracking. - correct answer ✔Third
party cookies are not essential for browsing, they are used mainly for advertisements and information
collection such as in the above process by taking a user's browsing history
Can JavaScript code access the user's files? If not, how can we upload files to web servers? - correct
answer ✔yes
Why Ajax and normal HTTP have different policy? - correct answer ✔Ajax is asynchronous javascript
and XML which is similar to normal HTTP with the exceptions of some headers. The main difference lies
client side as a user is able to use javascript to change a site without needing to reload
Why is the same-origin policy required for Ajax request? - correct answer ✔It narrows down the
weaknesses which eliminates different attack strategies
If web server A wants to allow a page from web server B to get its data via the Ajax request, who should
set up the corresponding policy and what policy? - correct answer ✔web server A
, Please describe the cable haunt attack? If the server is not a WebSocket server, is the attack still
possible? - correct answer ✔•Discovered: January 2020
•Affected many Broadcom-based cable modems
•These modems run a WebSocket-based server program
-JavaScript code can interact with the server: a door is open
-Attacker exploits a buffer overflow vulnerability on the server
I would say not possible because the whole point is to send buffer overflow attacks to hijack
cablemodems via websockets
Explain why the same-site cookie can help prevent CSRF attacks. - correct answer ✔The same-site
cookie has a special attribute, SameSite, that is set by the servers. If this attribute is present, and it's
value is Strict, the browser will not be sent along with cross-site requests.
Explain how a website can use secret token to prevent CSRF attacks, and why does it work? - correct
answer ✔a secret value that is included in a request and is originally embedded in a web page by the
server, if the value is missing then request is cross sight, token is random and varies by the user
These days, most of the websites use HTTPS, instead of HTTP. Do we still need to worry about CSRF
attacks? - correct answer ✔HTTPS just encrypts the traffic between the client and the server, but does
little to detect where the information came from, so CSRF attacks are possible even in an HTTPS site.
Using LiveHTTPHeader, we find out that the following GET request is used to send an HTTP request to
www.example.com to delete a page owned by a user (only the owner of a page can delete the page).
http://www.example.com/delete.php?pageid=5
GET /delete.php?pageid=5
Host: www.example.com
...
Please construct a simple malicious web page, so when a victim visits this web page, a forged request
will be launched against www.example.com to delete a page belonging to the user. - correct answer
✔<html>
complete solution 2026/2027
What are the main differences between the GET and POST requests - correct answer ✔The main
difference is in how they send data to the server. Also a GET will retrieve data and a Post sends data
What are the main purposes of HTTP cookies - correct answer ✔used to save information on the client
side, Browser save cookies, attach cookies in every request
Please explain how cookies can be used to track users. - correct answer ✔either the website itself or a
third part can set a cookie via the web browser. The browser or whoever set the cookie can track the
clicks and sites the user visits and can target particular advertisements based on the browsing history.
Please explain why disabling third-part cookies can help prevent tracking. - correct answer ✔Third
party cookies are not essential for browsing, they are used mainly for advertisements and information
collection such as in the above process by taking a user's browsing history
Can JavaScript code access the user's files? If not, how can we upload files to web servers? - correct
answer ✔yes
Why Ajax and normal HTTP have different policy? - correct answer ✔Ajax is asynchronous javascript
and XML which is similar to normal HTTP with the exceptions of some headers. The main difference lies
client side as a user is able to use javascript to change a site without needing to reload
Why is the same-origin policy required for Ajax request? - correct answer ✔It narrows down the
weaknesses which eliminates different attack strategies
If web server A wants to allow a page from web server B to get its data via the Ajax request, who should
set up the corresponding policy and what policy? - correct answer ✔web server A
, Please describe the cable haunt attack? If the server is not a WebSocket server, is the attack still
possible? - correct answer ✔•Discovered: January 2020
•Affected many Broadcom-based cable modems
•These modems run a WebSocket-based server program
-JavaScript code can interact with the server: a door is open
-Attacker exploits a buffer overflow vulnerability on the server
I would say not possible because the whole point is to send buffer overflow attacks to hijack
cablemodems via websockets
Explain why the same-site cookie can help prevent CSRF attacks. - correct answer ✔The same-site
cookie has a special attribute, SameSite, that is set by the servers. If this attribute is present, and it's
value is Strict, the browser will not be sent along with cross-site requests.
Explain how a website can use secret token to prevent CSRF attacks, and why does it work? - correct
answer ✔a secret value that is included in a request and is originally embedded in a web page by the
server, if the value is missing then request is cross sight, token is random and varies by the user
These days, most of the websites use HTTPS, instead of HTTP. Do we still need to worry about CSRF
attacks? - correct answer ✔HTTPS just encrypts the traffic between the client and the server, but does
little to detect where the information came from, so CSRF attacks are possible even in an HTTPS site.
Using LiveHTTPHeader, we find out that the following GET request is used to send an HTTP request to
www.example.com to delete a page owned by a user (only the owner of a page can delete the page).
http://www.example.com/delete.php?pageid=5
GET /delete.php?pageid=5
Host: www.example.com
...
Please construct a simple malicious web page, so when a victim visits this web page, a forged request
will be launched against www.example.com to delete a page belonging to the user. - correct answer
✔<html>
