CSLLP Secure Software Implementation 1 — Questions and Answers
Question 1: Which coding practice prevents cross-site scripting (XSS) attacks by transforming special HTML characters into their safe equivalents?
- Input sanitization
- Output encoding (Correct answer)
- Input validation
- Parameterized queries
Correct answer: Output encoding
Output encoding converts characters like '<', '>', and '&' into HTML entities before rendering them in the browser, preventing injected scripts from being executed.
Question 2: What is the purpose of a code review focused on security in the SDLC?
- To measure developer productivity
- To identify security vulnerabilities in source code before deployment (Correct answer)
- To verify that code meets performance benchmarks
- To ensure coding style guidelines are followed
Correct answer: To identify security vulnerabilities in source code before deployment
Security-focused code reviews examine source code for vulnerabilities such as injection flaws, insecure configurations, and improper error handling before the code reaches production.
Question 3: Which type of analysis tool automatically scans source code for security vulnerabilities without executing the program?
- Dynamic application security testing (DAST)
- Static application security testing (SAST) (Correct answer)
- Interactive application security testing (IAST)
- Runtime application self-protection (RASP)
Correct answer: Static application security testing (SAST)
SAST tools analyze source code, bytecode, or binaries at rest to find security flaws without running the application, enabling early detection in the development pipeline.
Question 4: What is the risk of using hard-coded credentials in source code?
- It slows down application startup
- Credentials can be extracted from code repositories or binaries, granting unauthorized access (Correct answer)
- It prevents the application from scaling horizontally
- It causes incompatibility with modern authentication protocols
Correct answer: Credentials can be extracted from code repositories or binaries, granting unauthorized access
Hard-coded credentials embedded in source code can be discovered through code repository access, reverse engineering, or accidental public exposure, leading to unauthorized system access.
Question 5: Which practice ensures that error messages shown to end users do not reveal sensitive system information?
- Input validation
- Secure error handling (Correct answer)
- Output encoding
- Session management
Correct answer: Secure error handling
Secure error handling ensures that detailed technical error information (stack traces, database errors, file paths) is logged internally but never displayed to end users.
Question 6: In secure coding, what does 'input validation' ensure?
- That output is formatted correctly for the user interface
- That all data received from untrusted sources conforms to expected format, type, and range before processing (Correct answer)
- That database queries use parameterized statements
- That the application encrypts data before storing it
Correct answer: That all data received from untrusted sources conforms to expected format, type, and range before processing
Input validation verifies that user-supplied or externally sourced data meets expectations for format, type, length, and range, rejecting or sanitizing any data that does not conform.
CSLLP Secure Software Implementation 1
Which coding practice prevents cross-site scripting (XSS) attacks by transforming special HTML characters into their safe equivalents?