CCP Application Security & Secure Coding 3

Question 1

Which vulnerability class occurs when an application deserializes untrusted data, allowing attackers to execute arbitrary code?

Accepted Answer

Insecure Deserialization

Answer

XML External Entity (XXE) Injection

Answer

Server-Side Request Forgery (SSRF)

Answer

Path Traversal

Question 2

Which threat modeling framework uses the categories Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Accepted Answer

STRIDE

Answer

PASTA

Answer

DREAD

Answer

VAST

Question 3

A race condition vulnerability in a banking application allows two simultaneous withdrawals to each succeed against a single balance. What class of flaw is this?

Accepted Answer

Time-of-Check to Time-of-Use (TOCTOU)

Answer

SQL Injection

Answer

Cross-Site Scripting

Answer

Command Injection

Question 4

Which DevSecOps practice integrates automated security scanning directly into the CI/CD pipeline?

Accepted Answer

Shifting security left by embedding SAST/DAST scans in build and deploy stages

Answer

Annual penetration testing only

Answer

Performing security reviews only post-deployment

Answer

Relying solely on firewalls for application protection

Question 5

An attacker sends a crafted XML document containing an external entity reference that causes the server to read a local file. Which vulnerability is being exploited?

Accepted Answer

XXE (XML External Entity) Injection

Answer

SSRF

Answer

LDAP Injection

Answer

Template Injection

Question 6

Which secure coding principle dictates that security controls should fail in a safe manner, denying access when an error occurs?

Accepted Answer

Fail-Safe Defaults

Answer

Open Design

Answer

Economy of Mechanism

Answer

Complete Mediation

Question 7

Which approach to application security testing simulates real-world attackers by actively probing a running application for exploitable vulnerabilities?

Accepted Answer

Dynamic Application Security Testing (DAST)

Answer

Static Application Security Testing (SAST)

Answer

Code Review

Answer

Design Review