App Security Engineer Secure Deployment Flashcards

A production Java web app returns full stack traces to users when an exception occurs. What is the most appropriate deployment fix?

Answer: Configure a generic custom error page and log details server-side

Generic error pages stop information leakage, and server-side logs keep the details available for troubleshooting.

Which HTTP response header tells browsers to connect to a site only over HTTPS for a set period?

Answer: Strict-Transport-Security

HSTS (Strict-Transport-Security) makes browsers use HTTPS for the max-age period, which blocks SSL-stripping attacks.

During deployment review, you find the web server lists directory contents when no index file exists. What risk does this create?

Answer: Information disclosure of files and application structure

Directory listing exposes file names, backups, and structure that attackers can use to find sensitive resources.

What is the main security purpose of running an application server process under a dedicated low-privilege account?

Answer: It limits the damage if the application is compromised

Least privilege limits what an attacker can access or change after exploiting the app.

An admin console for an application server is deployed with vendor default credentials. Which OWASP Top 10 category does this best represent?

Answer: Security Misconfiguration

Default accounts and passwords are a classic example of security misconfiguration.

Which practice best prevents secrets such as database passwords from being exposed in a source code repository?

Answer: Storing them in a secrets manager and injecting them at runtime

Secrets managers keep credentials out of code and allow access control, auditing, and rotation.

Before an application goes to production, which configuration should be confirmed in a Java EE web.xml to protect session cookies?

Answer: Setting http-only and secure to true in cookie-config

HttpOnly blocks script access to cookies, and Secure makes sure they are sent only over HTTPS.