Secure Coding and Testing

What is SQL injection and how does it work?

• SQL injection is a technique that allows attackers to execute arbitrary SQL code on a database by injecting malicious input into SQL queries.

• SQL injection is a method to optimize database queries.

• SQL injection is a type of database backup process.

• SQL injection is a security feature that prevents unauthorized access.

Explain the concept of command injection.

• Command injection is a technique used to improve application performance by optimizing code execution.

• Command injection is a method to secure applications from unauthorized access.

• Command injection allows attackers to execute arbitrary commands on a server by exploiting vulnerabilities in an application that improperly handles user input.

• Command injection refers to the process of encrypting user data before sending it to the server.

What is cross-site scripting (XSS) and its impact?

• Cross-site scripting is a technique for enhancing user experience.

• XSS is a method for improving website performance.

• Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages, impacting user security and privacy.

• XSS is a type of encryption used for securing data.

What are the risks associated with weak passwords?

• Weak passwords are only a concern for online accounts.

• Risks associated with weak passwords include unauthorized access, data breaches, identity theft, and exploitation in phishing attacks.

• Weak passwords are always easy to remember.

• Weak passwords can improve system performance.

How can insecure session management lead to security flaws?

• Insecure session management improves user experience.

• Insecure session management can lead to unauthorized access and session hijacking.

• Insecure session management guarantees user privacy.

• Insecure session management prevents data encryption.

What is the importance of proper authorization in web applications?

• Authorization is irrelevant if the application is not public.

• Proper authorization is only necessary for e-commerce sites.

• Proper authorization is crucial for securing web applications and protecting user data.

• Users can access any data without authorization checks.

How can sensitive data be exposed during transmission?

• Data is always encrypted during transmission.

• Sensitive data is only exposed when stored on devices.

• Transmission over fiber optic cables is completely secure.

• Sensitive data can be exposed during transmission through unencrypted channels and interception.

What is cross-site request forgery (CSRF) and how can it be prevented?

• Cross-site request forgery (CSRF) is an attack that tricks users into executing unwanted actions on authenticated web applications. It can be prevented using anti-CSRF tokens, validating HTTP Referer headers, and requiring authentication for state-changing requests.

• CSRF is a method to enhance user authentication on websites.

• CSRF can be prevented by using strong passwords only.

• CSRF is a type of malware that infects user devices.

What are insecure direct object references and their implications?

• Insecure direct object references are always secure and prevent unauthorized access.

• Insecure direct object references are only a concern in mobile applications.

• They are a type of encryption method used to protect sensitive data.

• Insecure direct object references are vulnerabilities that allow unauthorized access to internal objects due to lack of proper authorization checks.

How can proper validation help mitigate security vulnerabilities?

• Proper validation helps mitigate security vulnerabilities by ensuring only valid data is processed, thus preventing attacks that exploit input handling.

• Proper validation allows for faster data processing.

• Proper validation increases the amount of data that can be stored.

• Proper validation eliminates the need for encryption.