CCP Application Security & Secure Coding 1 — Questions and Answers
Question 1: Which OWASP Top 10 vulnerability occurs when an attacker inserts malicious SQL code into an input field that is directly passed to a database query?
- Cross-Site Scripting (XSS)
- SQL Injection (Correct answer)
- Insecure Direct Object Reference
- Security Misconfiguration
Correct answer: SQL Injection
SQL Injection occurs when untrusted data is sent to an interpreter as part of a command or query, allowing attackers to manipulate database queries.
Question 2: What is the primary purpose of input validation in secure application development?
- To improve application performance
- To ensure data conforms to expected format before processing (Correct answer)
- To encrypt data at rest
- To log all user activity
Correct answer: To ensure data conforms to expected format before processing
Input validation ensures that only properly formed data enters a system, preventing malformed data from causing unexpected behavior or enabling attacks.
Question 3: A developer stores session tokens in a URL query string. Which security risk does this practice introduce?
- Privilege escalation
- Session token exposure via browser history and server logs (Correct answer)
- Buffer overflow
- XML injection
Correct answer: Session token exposure via browser history and server logs
Session tokens in URLs can be logged in browser history, server access logs, and referrer headers, exposing them to unauthorized parties.
Question 4: Which type of Cross-Site Scripting (XSS) attack stores malicious script on the server to be served to all subsequent visitors?
- Reflected XSS
- DOM-based XSS
- Stored XSS (Correct answer)
- Blind XSS
Correct answer: Stored XSS
Stored (Persistent) XSS saves malicious scripts in the server's database, which are then delivered to every user who views the affected page.
Question 5: In the Secure Software Development Lifecycle (SSDLC), during which phase should threat modeling primarily be performed?
- Testing
- Deployment
- Design (Correct answer)
- Maintenance
Correct answer: Design
Threat modeling is most effective during the Design phase, enabling architects to identify and mitigate security risks before code is written.
Question 6: A buffer overflow vulnerability is best mitigated through which secure coding technique?
- Using dynamic SQL queries
- Applying bounds checking and safe string functions (Correct answer)
- Disabling ASLR
- Storing passwords in plaintext
Correct answer: Applying bounds checking and safe string functions
Bounds checking and the use of safe string-handling functions (e.g., strncpy instead of strcpy) prevent data from overflowing allocated memory buffers.
Question 7: Which HTTP security header helps prevent Cross-Site Scripting attacks by specifying which dynamic resources are allowed to load?
- X-Frame-Options
- Strict-Transport-Security
- Content-Security-Policy (Correct answer)
- X-Content-Type-Options
Correct answer: Content-Security-Policy
Content-Security-Policy (CSP) instructs browsers to only execute or render resources from trusted sources, significantly reducing XSS attack surface.
CCP Application Security & Secure Coding 1
Which OWASP Top 10 vulnerability occurs when an attacker inserts malicious SQL code into an input field that is directly passed to a database query?