CCP Application Security & Secure Coding 2

Question 1

Which application security testing technique analyzes source code for vulnerabilities without executing the program?

Accepted Answer

Static Application Security Testing (SAST)

Answer

SAST examines source code, bytecode, or binary code for security weaknesses at rest, without running the application.

Question 2

Cross-Site Request Forgery (CSRF) attacks are best defended against using which mechanism?

Accepted Answer

Anti-CSRF tokens synchronized between client and server

Answer

Anti-CSRF (synchronizer) tokens are unique, secret values embedded in forms that the server validates on submission, ensuring the request originated from the legitimate site.

Question 3

Which of the following best describes the principle of least privilege as applied to application design?

Accepted Answer

Allowing applications to request only the permissions they need to function

Answer

Least privilege in application design means components and users are granted only the minimum access rights required to perform their function, limiting damage from compromise.

Question 4

Which API security best practice prevents attackers from enumerating all resources by exploiting predictable identifiers?

Accepted Answer

Implementing rate limiting and randomized resource identifiers

Answer

Rate limiting prevents automated enumeration, and randomized (non-sequential) identifiers make it impractical to guess valid resource IDs.

Question 5

A developer logs full exception stack traces to the end user when an error occurs. What security risk does this create?

Accepted Answer

Information disclosure that aids attacker reconnaissance

Answer

Detailed stack traces expose internal file paths, library versions, and logic, giving attackers valuable intelligence to craft targeted exploits.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP Application Security & Secure Coding 2