CCT CCT Application Security & Secure Coding 2

Question 1

Which phase of the Software Development Lifecycle (SDLC) is the most cost-effective time to identify and fix security vulnerabilities?

Accepted Answer

Requirements and design phase

Answer

Fixing security flaws during the requirements and design phase is exponentially cheaper than addressing them after deployment, following the 'shift-left' security principle.

Question 2

What is the purpose of Static Application Security Testing (SAST)?

Accepted Answer

Analyzing source code for security flaws without executing it

Answer

SAST tools analyze source code, bytecode, or binaries for security vulnerabilities without executing the program, enabling early detection during development.

Question 3

What type of vulnerability does a race condition in application code typically lead to?

Accepted Answer

Time-of-check to time-of-use (TOCTOU) attack

Answer

Race conditions can lead to TOCTOU vulnerabilities, where an attacker manipulates a resource between the time it is checked and the time it is used.

Question 4

What is the recommended way to store user passwords in an application database?

Accepted Answer

Hashed using a strong adaptive algorithm like bcrypt or Argon2

Answer

Adaptive hashing algorithms like bcrypt or Argon2 incorporate salting and are computationally expensive, making brute-force and rainbow table attacks impractical.

Question 5

What is insecure direct object reference (IDOR)?

Accepted Answer

Exposing internal implementation objects to users without proper authorization checks

Answer

IDOR occurs when an application uses user-controllable input to access objects directly without verifying the user has authorization for that specific object.

CCT - Certified Cybersecurity Technician Practice Test

CCT - Certified Cybersecurity Technician Practice Test

CCT CCT Application Security & Secure Coding 2