CCP Application Security & Secure Coding

Question 1

Which OWASP Top 10 vulnerability occurs when an attacker inserts malicious SQL code into an input field that is directly passed to a database query?

Accepted Answer

SQL Injection

Answer

Cross-Site Scripting (XSS)

Answer

Insecure Direct Object Reference

Answer

Security Misconfiguration

Question 2

What is the primary purpose of input validation in secure application development?

Accepted Answer

To ensure data conforms to expected format before processing

Answer

To improve application performance

Answer

To encrypt data at rest

Answer

To log all user activity

Question 3

A developer stores session tokens in a URL query string. Which security risk does this practice introduce?

Accepted Answer

Session token exposure via browser history and server logs

Answer

Privilege escalation

Answer

Buffer overflow

Answer

XML injection

Question 4

Which type of Cross-Site Scripting (XSS) attack stores malicious script on the server to be served to all subsequent visitors?

Accepted Answer

Stored XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Answer

Blind XSS

Question 5

In the Secure Software Development Lifecycle (SSDLC), during which phase should threat modeling primarily be performed?

Accepted Answer

Design

Answer

Testing

Answer

Deployment

Answer

Maintenance

Question 6

A buffer overflow vulnerability is best mitigated through which secure coding technique?

Accepted Answer

Applying bounds checking and safe string functions

Answer

Using dynamic SQL queries

Answer

Disabling ASLR

Answer

Storing passwords in plaintext

Question 7

Which HTTP security header helps prevent Cross-Site Scripting attacks by specifying which dynamic resources are allowed to load?

Accepted Answer

Content-Security-Policy

Answer

X-Frame-Options

Answer

Strict-Transport-Security

Answer

X-Content-Type-Options