CCP Application Security & Secure Coding 2

Question 1

Which application security testing technique analyzes source code for vulnerabilities without executing the program?

Accepted Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Fuzz Testing

Answer

Penetration Testing

Question 2

Cross-Site Request Forgery (CSRF) attacks are best defended against using which mechanism?

Accepted Answer

Anti-CSRF tokens synchronized between client and server

Answer

Input length restrictions

Answer

Encrypting all cookies

Answer

Rate limiting login attempts

Question 3

Which of the following best describes the principle of least privilege as applied to application design?

Accepted Answer

Allowing applications to request only the permissions they need to function

Answer

Granting users admin access for convenience

Answer

Encrypting all database fields by default

Answer

Logging every user action

Question 4

Which API security best practice prevents attackers from enumerating all resources by exploiting predictable identifiers?

Accepted Answer

Implementing rate limiting and randomized resource identifiers

Answer

Using HTTP instead of HTTPS

Answer

Allowing anonymous API access

Answer

Disabling authentication for internal APIs

Question 5

A developer logs full exception stack traces to the end user when an error occurs. What security risk does this create?

Accepted Answer

Information disclosure that aids attacker reconnaissance

Answer

Denial of service

Answer

Privilege escalation

Answer

Session fixation

Question 6

Which secure coding practice best reduces the risk from third-party library vulnerabilities in application dependencies?

Accepted Answer

Regularly auditing and updating dependencies using a software composition analysis tool

Answer

Avoiding all third-party libraries

Answer

Storing libraries locally and never updating

Answer

Using only closed-source components

Question 7

In secure session management, what is the recommended action immediately after a user successfully authenticates?

Accepted Answer

Issue a new session ID to prevent session fixation attacks

Answer

Reuse the existing session ID for convenience

Answer

Extend the session timeout to 24 hours

Answer

Store credentials in the session object