CASE App Security Engineer Secure Deployment 3

Question 1

A production Java web app returns full stack traces to users when an exception occurs. What is the most appropriate deployment fix?

Accepted Answer

Configure a generic custom error page and log details server-side

Answer

Generic error pages stop information leakage, and server-side logs keep the details available for troubleshooting.

Question 2

Which HTTP response header tells browsers to connect to a site only over HTTPS for a set period?

Accepted Answer

Strict-Transport-Security

Answer

HSTS (Strict-Transport-Security) makes browsers use HTTPS for the max-age period, which blocks SSL-stripping attacks.

Question 3

During deployment review, you find the web server lists directory contents when no index file exists. What risk does this create?

Accepted Answer

Information disclosure of files and application structure

Answer

Directory listing exposes file names, backups, and structure that attackers can use to find sensitive resources.

Question 4

What is the main security purpose of running an application server process under a dedicated low-privilege account?

Accepted Answer

It limits the damage if the application is compromised

Answer

Least privilege limits what an attacker can access or change after exploiting the app.

Question 5

An admin console for an application server is deployed with vendor default credentials. Which OWASP Top 10 category does this best represent?

Accepted Answer

Security Misconfiguration

Answer

Default accounts and passwords are a classic example of security misconfiguration.

(CASE) Certified Application Security Engineer Practice Test