CREST Secure Coding & Application Security 2

Question 1

What is the purpose of input validation in secure coding?

Accepted Answer

To ensure data conforms to expected formats before processing, preventing injection and logic flaws

Answer

Input validation checks that user-supplied data matches expected type, length, format, and range before the application processes it, blocking many injection and manipulation attacks.

Question 2

What is the difference between encoding and encryption in the context of secure coding?

Accepted Answer

Encoding transforms data for safe use without a key; encryption scrambles data and requires a key to reverse

Answer

Encoding (e.g., Base64, URL encoding) transforms data for safe transmission and can be reversed by anyone; encryption requires a secret key to decrypt and provides confidentiality.

Question 3

What is a race condition vulnerability in application code?

Accepted Answer

When the outcome depends on the sequence or timing of events, allowing attackers to exploit a window of opportunity

Answer

A race condition occurs when security checks and the use of a resource are not atomic, allowing an attacker to change state between the check and the use (TOCTOU — time-of-check to time-of-use).

Question 4

Which secure coding practice helps prevent sensitive data from appearing in application logs?

Accepted Answer

Sanitizing and filtering log output to exclude passwords, tokens, and PII

Answer

Secure logging practices ensure sensitive fields like passwords, API keys, and personal data are redacted or masked before being written to log files.

Question 5

What does the principle of 'security by default' mean in application development?

Accepted Answer

Applications ship with the most secure configuration enabled out of the box

Answer

Security by default means that the default configuration of an application is the most secure one, requiring deliberate action to reduce security rather than to increase it.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Secure Coding & Application Security 2