CREST Secure Coding & Application Security 2 — Questions and Answers
Question 1: What is the purpose of input validation in secure coding?
- To ensure data conforms to expected formats before processing, preventing injection and logic flaws (Correct answer)
- To encrypt all user-submitted data at rest
- To log all user interactions for audit purposes
- To throttle requests and prevent denial of service
Correct answer: To ensure data conforms to expected formats before processing, preventing injection and logic flaws
Input validation checks that user-supplied data matches expected type, length, format, and range before the application processes it, blocking many injection and manipulation attacks.
Question 2: What is the difference between encoding and encryption in the context of secure coding?
- Encoding transforms data for safe use without a key; encryption scrambles data and requires a key to reverse (Correct answer)
- Encoding provides confidentiality; encryption only provides integrity
- They are identical processes with different names
- Encoding requires a secret key; encryption does not
Correct answer: Encoding transforms data for safe use without a key; encryption scrambles data and requires a key to reverse
Encoding (e.g., Base64, URL encoding) transforms data for safe transmission and can be reversed by anyone; encryption requires a secret key to decrypt and provides confidentiality.
Question 3: What is a race condition vulnerability in application code?
- When the outcome depends on the sequence or timing of events, allowing attackers to exploit a window of opportunity (Correct answer)
- When an application consumes excessive CPU under load
- When two threads access the same database record simultaneously causing data corruption
- When a loop runs without a proper exit condition
Correct answer: When the outcome depends on the sequence or timing of events, allowing attackers to exploit a window of opportunity
A race condition occurs when security checks and the use of a resource are not atomic, allowing an attacker to change state between the check and the use (TOCTOU — time-of-check to time-of-use).
Question 4: Which secure coding practice helps prevent sensitive data from appearing in application logs?
- Sanitizing and filtering log output to exclude passwords, tokens, and PII (Correct answer)
- Disabling all application logging
- Storing all logs in encrypted files
- Only logging events on production systems
Correct answer: Sanitizing and filtering log output to exclude passwords, tokens, and PII
Secure logging practices ensure sensitive fields like passwords, API keys, and personal data are redacted or masked before being written to log files.
Question 5: What does the principle of 'security by default' mean in application development?
- Applications ship with the most secure configuration enabled out of the box (Correct answer)
- Developers must manually enable security features before deployment
- All default passwords are set to 'admin'
- Security features are optional add-ons for enterprise customers
Correct answer: Applications ship with the most secure configuration enabled out of the box
Security by default means that the default configuration of an application is the most secure one, requiring deliberate action to reduce security rather than to increase it.
Question 6: What is a buffer overflow vulnerability?
- When more data is written to a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution (Correct answer)
- When a network buffer queue exceeds its maximum capacity
- When a log file grows too large and overwrites system disk space
- When a database query returns more rows than the application expects
Correct answer: When more data is written to a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution
Buffer overflows occur when input exceeds the allocated memory buffer, overwriting adjacent data or return addresses, which can redirect execution to attacker-controlled code.
CREST Secure Coding & Application Security 2
What is the purpose of input validation in secure coding?