CREST Secure Coding & Application Security

Question 1

What is SQL injection and how is it primarily prevented?

Accepted Answer

It inserts malicious SQL into queries; prevented by using parameterized queries or prepared statements

Answer

SQL injection manipulates database queries by inserting malicious SQL via unsanitized input; parameterized queries separate code from data, preventing the injection.

Question 2

Which OWASP Top 10 category covers security misconfigurations such as default credentials and open cloud storage buckets?

Accepted Answer

A05: Security Misconfiguration

Answer

OWASP A05 Security Misconfiguration encompasses improperly configured security settings, default credentials, unnecessary features, and misconfigured cloud services.

Question 3

What is Cross-Site Scripting (XSS) and which type allows attackers to store malicious scripts on the server?

Accepted Answer

XSS injects malicious scripts into web pages; stored XSS persists scripts on the server

Answer

XSS injects client-side scripts into pages viewed by other users; stored (persistent) XSS saves the malicious script on the server so it executes for every visitor.

Question 4

What does CSRF (Cross-Site Request Forgery) exploit?

Accepted Answer

A victim's authenticated session to make unauthorized requests on their behalf

Answer

CSRF tricks an authenticated user's browser into sending forged requests to a web application, leveraging the user's existing session cookies without their knowledge.

Question 5

Which HTTP security header helps mitigate XSS attacks by restricting which sources of scripts are trusted?

Accepted Answer

Content-Security-Policy (CSP)

Answer

The Content-Security-Policy header defines which origins are permitted to load scripts, styles, and other resources, blocking execution of injected inline scripts.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Secure Coding & Application Security