Technology Certifications Application Security & Development 5

Question 1

An application deserializes untrusted data from a cookie into native objects. What is the MOST serious potential impact?

Accepted Answer

Remote code execution through gadget chains

Answer

Insecure deserialization can trigger gadget chains that run arbitrary code on the server.

Question 2

Comparing an HMAC with a standard string equality check that exits on the first mismatched byte creates which risk?

Accepted Answer

Timing side-channel attack

Answer

Early-exit comparisons leak timing information, so attackers should be countered with constant-time comparison functions.

Question 3

Which SameSite cookie value gives the strongest built-in CSRF protection by never sending the cookie on cross-site requests?

Accepted Answer

Strict

Answer

SameSite=Strict withholds the cookie from all cross-site requests, including top-level navigations.

Question 4

A user submits a JSON payload with "isAdmin": true to a profile update endpoint, and the framework binds it straight to the user model. What vulnerability is this?

Accepted Answer

Mass assignment

Answer

Mass assignment happens when frameworks automatically bind request fields to model properties without an allow-list.

Question 5

Two concurrent requests both check a balance of $100 before either one deducts $100, so both withdrawals succeed. What flaw is this?

Accepted Answer

Race condition (TOCTOU)

Answer

A time-of-check to time-of-use race lets state change between the validation and the action.

Technology Certifications Practice Test

Technology Certifications Practice Test

Technology Certifications Application Security & Development 5