CCP Application Security & Secure Coding

Question 1

Which OWASP Top 10 vulnerability occurs when an attacker inserts malicious SQL code into an input field that is directly passed to a database query?

Accepted Answer

SQL Injection

Answer

SQL Injection occurs when untrusted data is sent to an interpreter as part of a command or query, allowing attackers to manipulate database queries.

Question 2

What is the primary purpose of input validation in secure application development?

Accepted Answer

To ensure data conforms to expected format before processing

Answer

Input validation ensures that only properly formed data enters a system, preventing malformed data from causing unexpected behavior or enabling attacks.

Question 3

A developer stores session tokens in a URL query string. Which security risk does this practice introduce?

Accepted Answer

Session token exposure via browser history and server logs

Answer

Session tokens in URLs can be logged in browser history, server access logs, and referrer headers, exposing them to unauthorized parties.

Question 4

Which type of Cross-Site Scripting (XSS) attack stores malicious script on the server to be served to all subsequent visitors?

Accepted Answer

Stored XSS

Answer

Stored (Persistent) XSS saves malicious scripts in the server's database, which are then delivered to every user who views the affected page.

Question 5

In the Secure Software Development Lifecycle (SSDLC), during which phase should threat modeling primarily be performed?

Accepted Answer

Design

Answer

Threat modeling is most effective during the Design phase, enabling architects to identify and mitigate security risks before code is written.

(CCP) Certified Cybersecurity Professional Practice Test

(CCP) Certified Cybersecurity Professional Practice Test

CCP Application Security & Secure Coding