SE Secure Software Development and Application Security 2 — Questions and Answers
Question 1: What is the primary defense mechanism against Cross-Site Request Forgery (CSRF) attacks?
- Enforcing Content Security Policy (CSP) headers
- Requiring HTTPS for all form submissions
- Using anti-CSRF tokens (synchronizer token pattern) (Correct answer)
- Validating all form fields with server-side input validation
Correct answer: Using anti-CSRF tokens (synchronizer token pattern)
Anti-CSRF tokens are unique, secret values embedded in forms that verify each request originated from the legitimate application, preventing forged cross-origin requests.
Question 2: What is the recommended approach for secure session management after a user successfully authenticates?
- Store session tokens in URL parameters for compatibility
- Use long-lived sessions to minimize re-authentication friction
- Generate a new session ID and set appropriate expiration after login (Correct answer)
- Embed user credentials in session tokens for faster server-side validation
Correct answer: Generate a new session ID and set appropriate expiration after login
Regenerating the session ID after login prevents session fixation attacks, while setting a proper expiration limits the window of exposure if a session token is stolen.
Question 3: What does Static Application Security Testing (SAST) analyze to find vulnerabilities?
- Running application behavior in a staging environment
- Source code, bytecode, or binary code without executing the application (Correct answer)
- Network traffic generated by the application under load
- Database query execution plans and access patterns
Correct answer: Source code, bytecode, or binary code without executing the application
SAST (white-box testing) examines application source code, bytecode, or binaries for security vulnerabilities without running the program, enabling early detection in the development cycle.
Question 4: Which HTTP security header helps prevent clickjacking attacks by controlling whether a page can be rendered inside an iframe?
- Content-Security-Policy
- X-Frame-Options (Correct answer)
- X-Content-Type-Options
- Strict-Transport-Security
Correct answer: X-Frame-Options
The X-Frame-Options header (or the frame-ancestors CSP directive) instructs browsers not to render the page within a frame or iframe on other origins.
Question 5: Why is insecure deserialization considered a critical application security risk?
- It converts JSON to objects without validation, causing performance degradation
- Deserializing untrusted data can lead to remote code execution or privilege escalation (Correct answer)
- It exposes sensitive data by using unencrypted serialization formats
- It creates compatibility issues between different application versions
Correct answer: Deserializing untrusted data can lead to remote code execution or privilege escalation
Insecure deserialization can allow attackers to manipulate serialized objects so that when reconstructed the application executes attacker-controlled logic, potentially leading to RCE.
Question 6: Which HTTP security header instructs browsers to only access the site over HTTPS and prevents protocol downgrade attacks?
- X-Frame-Options
- Content-Security-Policy
- Strict-Transport-Security (HSTS) (Correct answer)
- X-XSS-Protection
Correct answer: Strict-Transport-Security (HSTS)
HSTS (HTTP Strict Transport Security) tells browsers to enforce HTTPS connections for a specified duration, preventing downgrade attacks and cookie hijacking over HTTP.
Question 7: In application security, what does 'defense in depth' mean?
- Deploying the most advanced firewall technology available at the perimeter
- Implementing multiple layered security controls so failure of one does not compromise the whole system (Correct answer)
- Focusing all security resources on the most critical application components
- Encrypting all data at multiple stages of processing
Correct answer: Implementing multiple layered security controls so failure of one does not compromise the whole system
Defense in depth applies multiple overlapping security controls at different layers so no single point of failure can lead to a complete system compromise.
SE Secure Software Development and Application Security 2
What is the primary defense mechanism against Cross-Site Request Forgery (CSRF) attacks?