CCT CCT Application Security & Secure Coding 3

Question 1

What is Dynamic Application Security Testing (DAST)?

Accepted Answer

Testing a running application from the outside to find vulnerabilities

Answer

DAST tools test a running application by simulating external attacks, finding vulnerabilities that only manifest during execution, such as authentication issues and runtime errors.

Question 2

What does a Cross-Site Request Forgery (CSRF) attack exploit?

Accepted Answer

The trust a website has in a user's browser session

Answer

CSRF tricks authenticated users into unknowingly submitting malicious requests by exploiting the trust a web application places in the user's authenticated browser session.

Question 3

Which of the following is the best defense against CSRF attacks?

Accepted Answer

Implementing anti-CSRF tokens in forms

Answer

Anti-CSRF tokens are unique, secret, and unpredictable values tied to a user's session that must be included in state-changing requests, making forged requests from other sites invalid.

Question 4

What is the purpose of a Web Application Firewall (WAF)?

Accepted Answer

Filter, monitor, and block malicious HTTP/HTTPS traffic targeting web applications

Answer

A WAF inspects HTTP/HTTPS requests and responses against rule sets to detect and block common web application attacks like SQLi, XSS, and CSRF before they reach the application.

Question 5

What is the role of threat modeling in secure application development?

Accepted Answer

Identifying potential threats and vulnerabilities in an application's design

Answer

Threat modeling is a structured process for identifying security threats, attack vectors, and countermeasures during the design phase before any code is written.

CCT - Certified Cybersecurity Technician Practice Test

CCT - Certified Cybersecurity Technician Practice Test

CCT CCT Application Security & Secure Coding 3