SE Secure Software Development and Application Security

Question 1

Which OWASP Top 10 category covers weaknesses in authentication mechanisms that allow attackers to compromise passwords, keys, or session tokens?

Accepted Answer

Identification and Authentication Failures

Answer

OWASP A07:2021 - Identification and Authentication Failures covers weaknesses that allow attackers to compromise user identity through flawed login, session, or credential management.

Question 2

What is the most effective defense against SQL injection attacks in application code?

Accepted Answer

Parameterized queries (prepared statements)

Answer

Parameterized queries separate SQL code from user-supplied data, preventing input from being interpreted as SQL syntax regardless of its content.

Question 3

Which type of Cross-Site Scripting (XSS) attack permanently stores the malicious script on the target server?

Accepted Answer

Stored XSS

Answer

Stored XSS (Persistent XSS) saves the malicious script in the server's database or file system, causing it to execute for every user who views the affected page.

Question 4

What security principle requires each application component to operate with only the minimum permissions necessary to perform its function?

Accepted Answer

Principle of Least Privilege

Answer

The Principle of Least Privilege limits access rights and permissions of software components to the absolute minimum required, reducing the attack surface if a component is compromised.

Question 5

Which vulnerability occurs when an application passes user-controlled input to a system command interpreter without proper sanitization?

Accepted Answer

Command Injection

Answer

Command injection allows attackers to execute arbitrary OS commands by embedding them in user input that the application passes to a system shell.

SE - Security Engineer Practice Test

SE - Security Engineer Practice Test

SE Secure Software Development and Application Security