SE Secure Software Development and Application Security

Question 1

Which OWASP Top 10 category covers weaknesses in authentication mechanisms that allow attackers to compromise passwords, keys, or session tokens?

Accepted Answer

Identification and Authentication Failures

Answer

Injection

Answer

Broken Access Control

Answer

Cryptographic Failures

Question 2

What is the most effective defense against SQL injection attacks in application code?

Accepted Answer

Parameterized queries (prepared statements)

Answer

Input length validation

Answer

Encrypting database connections

Answer

Using stored procedures exclusively

Question 3

Which type of Cross-Site Scripting (XSS) attack permanently stores the malicious script on the target server?

Accepted Answer

Stored XSS

Answer

Reflected XSS

Answer

DOM-based XSS

Answer

Blind XSS

Question 4

What security principle requires each application component to operate with only the minimum permissions necessary to perform its function?

Accepted Answer

Principle of Least Privilege

Answer

Defense in Depth

Answer

Separation of Duties

Answer

Zero Trust Architecture

Question 5

Which vulnerability occurs when an application passes user-controlled input to a system command interpreter without proper sanitization?

Accepted Answer

Command Injection

Answer

Path Traversal

Answer

Remote File Inclusion

Answer

XML External Entity (XXE)

Question 6

What is Server-Side Request Forgery (SSRF)?

Accepted Answer

An attack that forces a server to make requests to unintended internal or external locations

Answer

An attack that forges server-side TLS certificates

Answer

A method to bypass server authentication using crafted HTTP requests

Answer

A technique to intercept encrypted server-to-server communications

Question 7

Which of the following best describes a 'cryptographic failure' as defined by OWASP?

Accepted Answer

Failing to encrypt sensitive data or using weak/broken cryptographic algorithms

Answer

Using an expired TLS certificate on a public-facing server

Answer

Implementing two-factor authentication with a weak second factor

Answer

Using self-signed certificates in a production environment