SE Secure Software Development and Application Security 2

Question 1

What is the primary defense mechanism against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Using anti-CSRF tokens (synchronizer token pattern)

Answer

Enforcing Content Security Policy (CSP) headers

Answer

Requiring HTTPS for all form submissions

Answer

Validating all form fields with server-side input validation

Question 2

What is the recommended approach for secure session management after a user successfully authenticates?

Accepted Answer

Generate a new session ID and set appropriate expiration after login

Answer

Store session tokens in URL parameters for compatibility

Answer

Use long-lived sessions to minimize re-authentication friction

Answer

Embed user credentials in session tokens for faster server-side validation

Question 3

What does Static Application Security Testing (SAST) analyze to find vulnerabilities?

Accepted Answer

Source code, bytecode, or binary code without executing the application

Answer

Running application behavior in a staging environment

Answer

Network traffic generated by the application under load

Answer

Database query execution plans and access patterns

Question 4

Which HTTP security header helps prevent clickjacking attacks by controlling whether a page can be rendered inside an iframe?

Accepted Answer

X-Frame-Options

Answer

Content-Security-Policy

Answer

X-Content-Type-Options

Answer

Strict-Transport-Security

Question 5

Why is insecure deserialization considered a critical application security risk?

Accepted Answer

Deserializing untrusted data can lead to remote code execution or privilege escalation

Answer

It converts JSON to objects without validation, causing performance degradation

Answer

It exposes sensitive data by using unencrypted serialization formats

Answer

It creates compatibility issues between different application versions

Question 6

Which HTTP security header instructs browsers to only access the site over HTTPS and prevents protocol downgrade attacks?

Accepted Answer

Strict-Transport-Security (HSTS)

Answer

X-Frame-Options

Answer

Content-Security-Policy

Answer

X-XSS-Protection

Question 7

In application security, what does 'defense in depth' mean?

Accepted Answer

Implementing multiple layered security controls so failure of one does not compromise the whole system

Answer

Deploying the most advanced firewall technology available at the perimeter

Answer

Focusing all security resources on the most critical application components

Answer

Encrypting all data at multiple stages of processing