Application Security & Development Flashcards
7 cards from real Technology Certifications practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Application Security & Development flashcards as text
An application deserializes untrusted data from a cookie into native objects. What is the MOST serious potential impact?
Answer: Remote code execution through gadget chains
Insecure deserialization can trigger gadget chains that run arbitrary code on the server.
Comparing an HMAC with a standard string equality check that exits on the first mismatched byte creates which risk?
Answer: Timing side-channel attack
Early-exit comparisons leak timing information, so attackers should be countered with constant-time comparison functions.
Which SameSite cookie value gives the strongest built-in CSRF protection by never sending the cookie on cross-site requests?
Answer: Strict
SameSite=Strict withholds the cookie from all cross-site requests, including top-level navigations.
A user submits a JSON payload with "isAdmin": true to a profile update endpoint, and the framework binds it straight to the user model. What vulnerability is this?
Answer: Mass assignment
Mass assignment happens when frameworks automatically bind request fields to model properties without an allow-list.
Two concurrent requests both check a balance of $100 before either one deducts $100, so both withdrawals succeed. What flaw is this?
Answer: Race condition (TOCTOU)
A time-of-check to time-of-use race lets state change between the validation and the action.
Which XSS variant runs entirely in the browser when client-side JavaScript writes attacker-controlled data from location.hash into the page?
Answer: DOM-based XSS
DOM-based XSS occurs when client-side scripts process untrusted sources into dangerous sinks without the server being involved.
What does a runtime application self-protection (RASP) solution do?
Answer: Detects and blocks attacks from inside the running application in real time
RASP is embedded in the application runtime and can block malicious behavior as it happens.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy