Topic A01 Fundamentals of Secure Coding

User input is directly inserted into SQL queries. How can this be prevented?

• Hide SQL errors from the user only

• Require all input to be uppercase

• Replace spaces with underscores in input

• Use parameterized queries or prepared statements

Messaging app built without threat modeling; some endpoints lack authorization checks. Why is this insecure design?

• It's caused by outdated frameworks

• Only junior developers worked on it

• Security wasn't considered during architecture

• The app doesn’t use a dark mode

Libraries are outdated, one has an RCE vulnerability. What is the best approach?

• Ignore until next major project upgrade

• Update vulnerable components, test, and deploy

• Add more antivirus software to the server

• Remove all third-party libraries

Unlimited login attempts; tokens never expire. Which fix is most secure?

• Implement rate limiting, lockout policies, and short-lived tokens

• Force all users to log in daily

• Use the same password for all accounts

• Keep current design for convenience

Logs are overwritten daily, no alerts for suspicious patterns. What’s the best security improvement?

• Save logs in a spreadsheet once a week

• Only log successful logins

• Store logs long-term, enable real-time alerts, and review regularly

• Remove logging entirely to save space

In security terms, what is a 'threat'?

• A known software bug

• A coding style violation

• A harmless system alert

• A potential event that can exploit a vulnerability

What does integrating security into every SDLC phase achieve?

• Reduces the need for testing

• Ensures no design changes are made

• Detects and prevents security issues early

• Removes all bugs

What is the primary purpose of secure coding?

• To make applications run faster

• To reduce the size of application files

• To enhance user interface design

• To prevent vulnerabilities from being exploited

A mobile banking app is released without assessing potential attack vectors, leading to multiple security gaps. Which secure coding phase was skipped?

• Deployment

• Maintenance

• Testing

• Architectural design with threat modeling

Which of the following is an implication of a compromised web application?

• Increased coding efficiency

• Threat, vulnerability and risk

• Faster application deployment

• Reputation damage