CCT CCT Application Security & Secure Coding 1 — Questions and Answers
Question 1: Which OWASP Top 10 vulnerability occurs when untrusted data is sent to an interpreter as part of a command or query?
- Injection (Correct answer)
- Broken Authentication
- Security Misconfiguration
- Insecure Deserialization
Correct answer: Injection
Injection flaws, such as SQL injection, occur when untrusted data is sent to an interpreter as part of a command or query, allowing attackers to execute unintended commands.
Question 2: What is the primary purpose of input validation in secure application development?
- Improve application performance
- Prevent malicious data from being processed (Correct answer)
- Encrypt user data at rest
- Log all user activities
Correct answer: Prevent malicious data from being processed
Input validation ensures that only properly formed data enters a system, preventing malicious input from causing vulnerabilities like injection attacks or buffer overflows.
Question 3: Which secure coding practice prevents Cross-Site Scripting (XSS) attacks?
- Using HTTPS for all connections
- Output encoding and input sanitization (Correct answer)
- Implementing multi-factor authentication
- Encrypting session tokens
Correct answer: Output encoding and input sanitization
Output encoding ensures that user-supplied data is treated as data rather than executable code, while input sanitization removes or neutralizes potentially malicious characters.
Question 4: What does a Content Security Policy (CSP) header primarily protect against?
- SQL injection attacks
- Cross-Site Request Forgery (CSRF)
- Cross-Site Scripting (XSS) (Correct answer)
- Man-in-the-Middle attacks
Correct answer: Cross-Site Scripting (XSS)
CSP is a browser security mechanism that restricts which resources can be loaded, significantly reducing the risk and impact of XSS attacks by whitelisting trusted content sources.
Question 5: In secure software development, what is the principle of 'least privilege' as applied to application accounts?
- Applications should run as root for full access
- Applications should have only the minimum permissions needed to function (Correct answer)
- All users should share the same application credentials
- Privilege escalation should be enabled for all services
Correct answer: Applications should have only the minimum permissions needed to function
Least privilege limits an application's access rights to only what is necessary, reducing the potential damage if the application is compromised.
Question 6: What is a parameterized query (prepared statement) used to prevent?
- Buffer overflow attacks
- SQL injection attacks (Correct answer)
- Denial-of-service attacks
- Privilege escalation
Correct answer: SQL injection attacks
Parameterized queries separate SQL code from data, ensuring user input is always treated as a literal value and never interpreted as SQL syntax.
CCT CCT Application Security & Secure Coding 1
Which OWASP Top 10 vulnerability occurs when untrusted data is sent to an interpreter as part of a command or query?