CCP Application Security & Secure Coding 2 — Questions and Answers
Question 1: Which application security testing technique analyzes source code for vulnerabilities without executing the program?
- Dynamic Application Security Testing (DAST)
- Fuzz Testing
- Static Application Security Testing (SAST) (Correct answer)
- Penetration Testing
Correct answer: Static Application Security Testing (SAST)
SAST examines source code, bytecode, or binary code for security weaknesses at rest, without running the application.
Question 2: Cross-Site Request Forgery (CSRF) attacks are best defended against using which mechanism?
- Input length restrictions
- Anti-CSRF tokens synchronized between client and server (Correct answer)
- Encrypting all cookies
- Rate limiting login attempts
Correct answer: Anti-CSRF tokens synchronized between client and server
Anti-CSRF (synchronizer) tokens are unique, secret values embedded in forms that the server validates on submission, ensuring the request originated from the legitimate site.
Question 3: Which of the following best describes the principle of least privilege as applied to application design?
- Granting users admin access for convenience
- Allowing applications to request only the permissions they need to function (Correct answer)
- Encrypting all database fields by default
- Logging every user action
Correct answer: Allowing applications to request only the permissions they need to function
Least privilege in application design means components and users are granted only the minimum access rights required to perform their function, limiting damage from compromise.
Question 4: Which API security best practice prevents attackers from enumerating all resources by exploiting predictable identifiers?
- Using HTTP instead of HTTPS
- Implementing rate limiting and randomized resource identifiers (Correct answer)
- Allowing anonymous API access
- Disabling authentication for internal APIs
Correct answer: Implementing rate limiting and randomized resource identifiers
Rate limiting prevents automated enumeration, and randomized (non-sequential) identifiers make it impractical to guess valid resource IDs.
Question 5: A developer logs full exception stack traces to the end user when an error occurs. What security risk does this create?
- Denial of service
- Information disclosure that aids attacker reconnaissance (Correct answer)
- Privilege escalation
- Session fixation
Correct answer: Information disclosure that aids attacker reconnaissance
Detailed stack traces expose internal file paths, library versions, and logic, giving attackers valuable intelligence to craft targeted exploits.
Question 6: Which secure coding practice best reduces the risk from third-party library vulnerabilities in application dependencies?
- Avoiding all third-party libraries
- Regularly auditing and updating dependencies using a software composition analysis tool (Correct answer)
- Storing libraries locally and never updating
- Using only closed-source components
Correct answer: Regularly auditing and updating dependencies using a software composition analysis tool
Software Composition Analysis (SCA) tools continuously monitor dependencies for known CVEs and prompt timely patching when vulnerabilities are disclosed.
Question 7: In secure session management, what is the recommended action immediately after a user successfully authenticates?
- Reuse the existing session ID for convenience
- Issue a new session ID to prevent session fixation attacks (Correct answer)
- Extend the session timeout to 24 hours
- Store credentials in the session object
Correct answer: Issue a new session ID to prevent session fixation attacks
Generating a new session ID after authentication prevents session fixation, where an attacker pre-sets a known session ID to hijack the session after the user logs in.
CCP Application Security & Secure Coding 2
Which application security testing technique analyzes source code for vulnerabilities without executing the program?