CCT CCT Application Security & Secure Coding 3

Question 1

What is Dynamic Application Security Testing (DAST)?

Accepted Answer

Testing a running application from the outside to find vulnerabilities

Answer

Reviewing source code for security issues

Answer

Scanning network infrastructure for open ports

Answer

Analyzing binary code without source access

Question 2

What does a Cross-Site Request Forgery (CSRF) attack exploit?

Accepted Answer

The trust a website has in a user's browser session

Answer

Weak encryption algorithms in the application

Answer

Unsanitized output rendered in the browser

Answer

Misconfigured server-side access controls

Question 3

Which of the following is the best defense against CSRF attacks?

Accepted Answer

Implementing anti-CSRF tokens in forms

Answer

Using HTTPS for all form submissions

Answer

Enforcing strong password policies

Answer

Disabling JavaScript on the client side

Question 4

What is the purpose of a Web Application Firewall (WAF)?

Accepted Answer

Filter, monitor, and block malicious HTTP/HTTPS traffic targeting web applications

Answer

Encrypt all web traffic end-to-end

Answer

Manage DNS records for web servers

Answer

Load balance traffic across multiple web servers

Question 5

What is the role of threat modeling in secure application development?

Accepted Answer

Identifying potential threats and vulnerabilities in an application's design

Answer

Automating security tests in CI/CD pipelines

Answer

Encrypting sensitive data fields in the database

Answer

Monitoring live application logs for anomalies

Question 6

What does 'security by obscurity' mean and why is it considered insufficient?

Accepted Answer

Relying on secrecy of design or implementation as the main security mechanism, which fails once the secret is exposed

Answer

Using complex encryption keys that are hard to guess

Answer

Hiding servers behind multiple NAT layers

Answer

Obfuscating code to prevent reverse engineering