WhiteBelt Session - Secure Coding - OWASP Top 10

Choose the right options to remediate SQL Injection vulnerability

[Multiple Choice]

• 
  Prepared Statements

• 
  Stored Procedures

• Escape all user supplied input

• Add HSTS in response headers

Identify the two insecure algorithms from the below [Multiple choice]

• 
  MD5

• PBKDF2

• 
  Bcrypt

• 
  SHA-1

Choose HTTPS protocol version known to be secure as of date [Single choice]

• SSL 3.0

• SSL 2.0

• TLS 1.0

• TLS 1.2

Choose the vulnerabilities associated with Broken Access Control:

[Multiple Choice]

• 
  Vertical Privilege Escalation

• Insecure Direct Object References

• Local File Inclusion

• 
  SQL Injection

An application implements access control check only on the front-end HTML by disabling a button for normal users [Single choice]

• 
  Front end access restriction is the best way to prevent access control issues

• 
  Malicious users can enable the button on front end allowing unauthorized access

• Front end HTML cannot be modified by malicious users making it a safe implementation

• 
  Front end restriction is the only way out, and we have to accept the risk associated

Which attack can execute scripts in the user’s browser and is capable of hijacking user sessions, defacing websites or redirecting the user to malicious sites? [Single choice]

• SQL Injection

• XML External Entities

• 
  Man in the middle

• Cross site scripting

Which of the following transactions / activities are to be logged in the applications [Single choice]

• 
  Authentication successes and failures

• Authorization (access control) failures

• 
  Session management failures

• All of the above

What does 'Using Components with Known Vulnerabilities' vulnerability talk about [Single choice]

• 
  Improper input validation at server side

• 
  Vulnerable, out of date components used in applications

• Cookie value set insecurely

• 
  None of the above

An attacker was able to brute force his way to login into the application by using different combination of passwords over a period of 3 months [Single choice]

• 
  Properly log all high value transactions and monitor them continuously for abnormal behaviour

• Ensure to use TLS v 1.2 in all communications to encrypt sensitive data

• 
  Use secure cookie attribute to prevent XSS attacks

• 
  All of the above

Identify the impact done by attacker using PUT http method

[Single Choice]

• 
  Cross Origin Resource Sharing

• 
  Cross Site Scripting

• Cross Site Request Forgery

• Upload malicious files