Free 312-50V12 Web TestEngine Demo

Q73 Single choice

A penetration tester is conducting an assessment of a web application for a financial institution. The application uses form-based authentication and does not implement account lockout policies after multiple failed login attempts. Interestingly, the application displays detailed error messages that disclose whether the username or password entered is incorrect. The tester also notices that the application uses HTTP headers to prevent clickjacking attacks but does not implement Content Security Policy (CSP).
With these observations, which of the following attack methods would likely be the most effective for the penetration tester to exploit these vulnerabilities and attempt unauthorized access?

A
The tester could execute a Brute Force attack, leveraging the lack of account lockout policy and the verbose error messages to guess the correct credentials
B
The tester could exploit a potential SQL Injection vulnerability to manipulate the application's database
C
The tester could launch a Cross-Site Scripting (XSS) attack to steal authenticated session cookies,
potentially bypassing the clickjacking protection
D
The tester could execute a Man-in-the-Middle (MitM) attack to intercept and modify the HTTP headers for a Clickjacking attack

312-50V12 Web TestEngine demo