SE Secure Software Development and Application Security 2

Question 1

What is the primary defense mechanism against Cross-Site Request Forgery (CSRF) attacks?

Accepted Answer

Using anti-CSRF tokens (synchronizer token pattern)

Answer

Anti-CSRF tokens are unique, secret values embedded in forms that verify each request originated from the legitimate application, preventing forged cross-origin requests.

Question 2

What is the recommended approach for secure session management after a user successfully authenticates?

Accepted Answer

Generate a new session ID and set appropriate expiration after login

Answer

Regenerating the session ID after login prevents session fixation attacks, while setting a proper expiration limits the window of exposure if a session token is stolen.

Question 3

What does Static Application Security Testing (SAST) analyze to find vulnerabilities?

Accepted Answer

Source code, bytecode, or binary code without executing the application

Answer

SAST (white-box testing) examines application source code, bytecode, or binaries for security vulnerabilities without running the program, enabling early detection in the development cycle.

Question 4

Which HTTP security header helps prevent clickjacking attacks by controlling whether a page can be rendered inside an iframe?

Accepted Answer

X-Frame-Options

Answer

The X-Frame-Options header (or the frame-ancestors CSP directive) instructs browsers not to render the page within a frame or iframe on other origins.

Question 5

Why is insecure deserialization considered a critical application security risk?

Accepted Answer

Deserializing untrusted data can lead to remote code execution or privilege escalation

Answer

Insecure deserialization can allow attackers to manipulate serialized objects so that when reconstructed the application executes attacker-controlled logic, potentially leading to RCE.

SE - Security Engineer Practice Test

SE - Security Engineer Practice Test

SE Secure Software Development and Application Security 2