CPP Security & Error Handling 1 — Questions and Answers
Question 1: What is input validation and why is it critical for secure software?
- Checking that user inputs match expected formats and ranges to prevent injection attacks and data corruption (Correct answer)
- Logging all user inputs to a database
- Encrypting user inputs before storage
- Limiting the length of variable names in code
Correct answer: Checking that user inputs match expected formats and ranges to prevent injection attacks and data corruption
Input validation rejects or sanitizes unexpected inputs at system boundaries, preventing SQL injection, XSS, and buffer overflow attacks.
Question 2: What is the principle of least privilege in security?
- Granting users all permissions by default
- Giving users and programs only the minimum access rights needed to perform their tasks (Correct answer)
- Requiring administrator approval for all operations
- Restricting access to production databases
Correct answer: Giving users and programs only the minimum access rights needed to perform their tasks
Least privilege minimizes the damage a compromised account or buggy code can do by limiting what resources it can access.
Question 3: What is SQL injection?
- Storing SQL queries in a database
- An attack where malicious SQL code is inserted into input fields to manipulate the database (Correct answer)
- A technique for optimizing SQL query performance
- An error caused by missing database indexes
Correct answer: An attack where malicious SQL code is inserted into input fields to manipulate the database
SQL injection exploits unsanitized user input concatenated directly into SQL queries, allowing attackers to read, modify, or delete data.
Question 4: What is a try-catch-finally block used for?
- Repeating a block of code until no exception occurs
- Handling exceptions gracefully: try runs the code, catch handles exceptions, finally always runs for cleanup (Correct answer)
- Catching compiler errors at runtime
- Creating conditional logic based on error codes
Correct answer: Handling exceptions gracefully: try runs the code, catch handles exceptions, finally always runs for cleanup
Try-catch-finally provides structured exception handling: catching errors to prevent crashes and using finally to ensure resources are always released.
Question 5: What is Cross-Site Scripting (XSS)?
- Sending HTTP requests from one domain to another
- An attack where malicious scripts are injected into web pages viewed by other users (Correct answer)
- A technique for optimizing JavaScript execution
- Cross-browser compatibility testing
Correct answer: An attack where malicious scripts are injected into web pages viewed by other users
XSS injects malicious client-side scripts into pages, allowing attackers to steal cookies, session tokens, or redirect users.
Question 6: What is defensive programming?
- Protecting code with software patents
- Writing code that anticipates and handles invalid inputs, unexpected states, and failures gracefully (Correct answer)
- Using defensive copies of all data structures
- Encrypting all code before deployment
Correct answer: Writing code that anticipates and handles invalid inputs, unexpected states, and failures gracefully
Defensive programming assumes that inputs may be invalid and external systems may fail, adding validation and error handling proactively.
CPP Security & Error Handling 1
What is input validation and why is it critical for secure software?