CCT CCT Application Security & Secure Coding 2 — Questions and Answers
Question 1: Which phase of the Software Development Lifecycle (SDLC) is the most cost-effective time to identify and fix security vulnerabilities?
- Production deployment
- Testing phase
- Requirements and design phase (Correct answer)
- Maintenance phase
Correct answer: Requirements and design phase
Fixing security flaws during the requirements and design phase is exponentially cheaper than addressing them after deployment, following the 'shift-left' security principle.
Question 2: What is the purpose of Static Application Security Testing (SAST)?
- Testing a running application for vulnerabilities
- Analyzing source code for security flaws without executing it (Correct answer)
- Monitoring network traffic for attacks
- Performing penetration tests on live systems
Correct answer: Analyzing source code for security flaws without executing it
SAST tools analyze source code, bytecode, or binaries for security vulnerabilities without executing the program, enabling early detection during development.
Question 3: What type of vulnerability does a race condition in application code typically lead to?
- SQL injection
- Time-of-check to time-of-use (TOCTOU) attack (Correct answer)
- Cross-Site Scripting
- Path traversal
Correct answer: Time-of-check to time-of-use (TOCTOU) attack
Race conditions can lead to TOCTOU vulnerabilities, where an attacker manipulates a resource between the time it is checked and the time it is used.
Question 4: What is the recommended way to store user passwords in an application database?
- Encrypted with AES-256
- Stored in plaintext with access controls
- Hashed using a strong adaptive algorithm like bcrypt or Argon2 (Correct answer)
- Encoded in Base64
Correct answer: Hashed using a strong adaptive algorithm like bcrypt or Argon2
Adaptive hashing algorithms like bcrypt or Argon2 incorporate salting and are computationally expensive, making brute-force and rainbow table attacks impractical.
Question 5: What is insecure direct object reference (IDOR)?
- Using HTTP instead of HTTPS for API calls
- Exposing internal implementation objects to users without proper authorization checks (Correct answer)
- Storing session tokens in browser localStorage
- Failing to validate SSL certificates
Correct answer: Exposing internal implementation objects to users without proper authorization checks
IDOR occurs when an application uses user-controllable input to access objects directly without verifying the user has authorization for that specific object.
Question 6: Which HTTP security header prevents the browser from interpreting files as a different MIME type than declared?
- Strict-Transport-Security
- X-Frame-Options
- X-Content-Type-Options (Correct answer)
- Referrer-Policy
Correct answer: X-Content-Type-Options
The `X-Content-Type-Options: nosniff` header instructs browsers not to perform MIME type sniffing, preventing attacks that rely on uploading files disguised with incorrect MIME types.
CCT CCT Application Security & Secure Coding 2
Which phase of the Software Development Lifecycle (SDLC) is the most cost-effective time to identify and fix security vulnerabilities?