1.
What threat are you vulnerable to if you do not validate authorization of user for direct references to restricted resources?
2.
Role-Based Access control helps prevent this OWASP Top 10 weakness
3.
What is the type of flaw that occurs when untrusted user entered data is sent to the interpreter as part of a query or command?
4.
For every link or form which invoke state-changing functions with an unpredictable token for each user what attack can be prevented?
5.
For a connection that changes from HTTP to HTTPS, what flaw arises if you do not change the session identifier?
6.
Attack that exploits the trust that a site has in a user's browser
7.
For an an indirect reference, what happens if there's no list of limited values authorized for a user in the direct reference?
8.
We can allow client side scripts to execute in the browsers for needed operations.
9.
Session related vulnerabilities
10.
What is phishing?