CCP Application Security & Secure Coding 3

Question 1

Which vulnerability class occurs when an application deserializes untrusted data, allowing attackers to execute arbitrary code?

Accepted Answer

Insecure Deserialization

Answer

Insecure Deserialization allows attackers to manipulate serialized objects to alter application logic or achieve remote code execution during the deserialization process.

Question 2

Which threat modeling framework uses the categories Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege?

Accepted Answer

STRIDE

Answer

STRIDE is a Microsoft-developed threat classification model where each letter represents a category of security threat used to identify risks during design.

Question 3

A race condition vulnerability in a banking application allows two simultaneous withdrawals to each succeed against a single balance. What class of flaw is this?

Accepted Answer

Time-of-Check to Time-of-Use (TOCTOU)

Answer

TOCTOU (Time-of-Check to Time-of-Use) is a race condition where the state of a resource changes between validation and use, enabling double-spending or similar exploits.

Question 4

Which DevSecOps practice integrates automated security scanning directly into the CI/CD pipeline?

Accepted Answer

Shifting security left by embedding SAST/DAST scans in build and deploy stages

Answer

Shifting security left means integrating automated security tools (SAST, DAST, SCA) into CI/CD pipelines so vulnerabilities are detected and fixed during development, not after release.

Question 5

An attacker sends a crafted XML document containing an external entity reference that causes the server to read a local file. Which vulnerability is being exploited?

Accepted Answer

XXE (XML External Entity) Injection

Answer

XXE Injection exploits XML parsers that process external entity declarations, allowing attackers to read local files, perform SSRF, or execute denial-of-service attacks.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP Application Security & Secure Coding 3