NEW
Font size
WorksheetsModule 9 CSEC
Total questions: 70
Worksheet time: 35mins
What are the three key elements that define a secure application?
Confidentiality, integrity, and availability
Speed, efficiency, and reliability
Usability, design, and functionality
Cost, scalability, and performance
What is a restricted resource in the context of a secure application?
Any object, data, feature, or function designed to be accessed by only authorized users
Any publicly available data
Any resource that is free to use
Any outdated software component
Why are perimeter security controls like firewalls and IDS systems not sufficient to secure applications?
They are too expensive to maintain.
They cannot defend against application layer attacks.
They are outdated technologies.
They require constant manual monitoring.
Which ports are generally open on perimeter devices for legitimate web traffic?
21 and 22
25 and 110
80 and 443
8080 and 8443
What is one of the responsibilities of application security administration?
Installing new applications
Preventing applications from creating and modifying executable files
Developing new software
Designing user interfaces
Which of the following is a practice involved in application security administration?
Application design
Application whitelisting/blacklisting
Application marketing
Application testing
What does application security administration aim to protect against?
Software development errors
Security risks from security misconfigurations
Network speed issues
User interface bugs
What is one of the key components of the Application Security Frame?
Input Validation
Data Encryption
Network Segmentation
User Interface Design
Which of the following is a method used for securing the network in the Application Security Frame?
Router
Data Masking
Load Balancing
User Training
What is a component of securing the host according to the Application Security Frame?
Patches and Updates
Data Compression
User Interface Testing
Network Redundancy
Why should we care about application security?
Applications are becoming popular targets for attackers.
Applications are easy to develop.
Applications are rarely used.
Applications are always secure.
What do we need for application security?
Occasional security checks.
Constant security vigilance.
Security only during deployment.
No security measures.
Who is responsible for application security?
Only developers.
Only managers.
Managers, architects, developers, testers, and administrators.
Only testers.
What can result from security negligence at the design and architecture phase?
Increased efficiency in production
Easier detection of vulnerabilities
Vulnerabilities that are difficult to detect and expensive to fix
Improved software performance
What is the benefit of security vigilance at the design phase?
Delays in the software development lifecycle
Detecting potential security flaws early
Increased cost of development
Reduced software functionality
On what is the secure design of an application based?
Aesthetic requirements
Security requirements identified in the previous phase of the SDLC
User interface design
Marketing strategies
Why is secure design considered a challenging process?
It is easy to implement
It requires no security controls
Designing required security controls may obstruct business functionality requirements
It always reduces costs
What is the first step in the secure design process?
Designing
Enforcing
Identifying
Implementing
What does the designing phase focus on in the secure design process?
Identifying threats
Enforcing security principles
Designing an architecture to mitigate threats
Testing the code
What is the goal of the enforcing phase in the secure design process?
To identify potential threats
To design a user-friendly interface
To enforce secure design principles
To deploy the application
What is the purpose of security requirement specifications in secure design actions?
To perform threat modeling
To design secure application architecture
To define secure coding standards
To design the application according to security specifications gathered at requirement phase
Which action involves defining secure coding standards in secure design?
Security Requirement Specifications
Secure Design Principles
Threat Modeling
Secure Application Architecture
What is the main focus of threat modeling in secure design actions?
To design secure application architecture
To perform threat modeling to know your threats
To define secure coding standards
To gather security specifications
In secure design actions, what is the goal of secure application architecture?
To perform threat modeling
To design secure application architecture
To define secure coding standards
To gather security specifications
What are software security requirements classified as?
Functional requirements
Non-functional requirements
User interface requirements
Database requirements
When are security requirements often overlooked?
During the testing phase
During the inception phase
During the deployment phase
During the maintenance phase
What can negligence in gathering security requirements lead to?
Improved application performance
Increased user satisfaction
Vulnerability to attacks
Faster development time
What should be part of the strategic application development process?
Gathering user feedback
Gathering security requirements
Gathering design specifications
Gathering marketing strategies
What are secure design principles?
Guidelines for developers to follow during the development phase
A set of coding standards
A type of software testing
A method for user interface design
How do secure design principles help in software development?
They improve user experience
They help in deriving secure architectural decisions
They increase the speed of development
They reduce the cost of development
What is one of the benefits of applying secure design principles?
They enhance the visual design of applications
They help to eliminate design and architecture flaws
They increase the number of features in an application
They simplify the user interface
Which principle focuses on minimizing the permissions granted to users and systems?
Security through obscurity
Use least privilege principle
Secure by default
Apply defense in depth
What is the principle of designing systems to continue operating even when they fail?
Fail securely
Fault detection
Secure memory management
Reduce attack surface
Which principle involves ensuring that security is considered during the initial stages of system design?
Exception handling
Apply security in design phase
Fault removal
Enable auditing and logging
What principle is aimed at reducing the number of potential entry points for attackers?
Reduce attack surface
Separation of duties
Fault tolerance
Avoid dead code
Which principle involves dividing responsibilities among multiple people to prevent fraud or error?
Secure by default
Separation of duties
Protect memory or storage secrets
Fault avoidance
What is the primary purpose of threat modeling?
To design new software features
To identify, analyze, and mitigate threats to an application
To improve user interface design
To increase application speed
At which phase of the secure development lifecycle is threat modeling performed?
Testing phase
Deployment phase
Design phase
Maintenance phase
What does the output of threat modeling provide?
A list of software bugs
A threats model exposing all possible threats and vulnerabilities
A new application feature
A user satisfaction report
How does threat modeling help developers in terms of application architecture?
It helps in designing user interfaces
It allows developers to rate threats based on architecture and implementation
It speeds up the application
It reduces the cost of development
What is the first step in the Threat Modeling Process?
Application Overview
Identify Security Objectives
Identify Threats
Risk and Impact Analysis
Which step involves analyzing the potential risks and impacts in the Threat Modeling Process?
Identify Vulnerabilities
Decompose the Application
Risk and Impact Analysis
Identify Security Objectives
In the Threat Modeling Process, what step comes after 'Decompose the Application'?
Identify Threats
Identify Vulnerabilities
Application Overview
Risk and Impact Analysis
What are the three tiers of a typical web application architecture?
Web, application, and database
User interface, server, and network
Frontend, backend, and middleware
Client, server, and storage
Why is security at one tier not sufficient in a web application architecture?
It increases the cost of development
Attackers can breach another tier to compromise the application
It makes the application slower
It complicates the user interface
What principle should be used to design a secure web application architecture?
Single-layer security
Defense-in-depth
Minimalist design
Open access
Which of the following is NOT included in a multi-tiered security approach?
Proper input validation
Database layer abstraction
User interface design
Data encryption
What is the primary benefit of applying multiple layer security in application architecture design?
Increases application speed
Makes application robust and secure
Reduces application cost
Simplifies application design
Which tier is responsible for input validation and user authorization?
Tier 1
Tier 2
Tier 3
Internet
What function is performed at Tier 2 in a secure application architecture?
Encrypting data
Input validation
Authenticating and authorizing upstream identities
Running a browser
Which tier can encrypt or hash the data stored in the database?
Tier 1
Tier 2
Tier 3
Firewall
What is input validation?
The process of verifying and testing user inputs from untrusted data sources
The process of encrypting data for secure transmission
The process of backing up data to prevent loss
The process of optimizing database queries
What is the simplest defensive technique used to secure web applications from injection attacks?
Input validation
Data encryption
Firewall installation
User authentication
Which of the following is NOT a factor to validate input against?
Data type
Allowed character set
Color of the input field
Minimum and maximum length
Why are proper input validation techniques used in web applications?
To enhance the visual design of the application
To eliminate vulnerabilities in web applications
To increase the speed of the application
To reduce the cost of development
What is a key benefit of using parameterized queries in SQL?
They allow embedding parameters directly in the query.
They help distinguish between code and data irrespective of user input.
They make the query run faster.
They allow attackers to change the intent of the query.
How do parameterized stored procedures differ from non-parameterized ones?
Parameterized stored procedures are stored with values supplied to them.
Non-parameterized stored procedures are stored with values supplied to them.
Parameterized stored procedures do not allow SQL code to be written first.
Non-parameterized stored procedures allow dynamic parameter supply.
What is the main purpose of parameterized queries?
To embed parameters directly in the SQL query.
To allow attackers to change the query intent.
To supply each parameter dynamically later.
To make the query more complex.
What is Unicode normalization?
The process of converting strings to binary
The process of normalizing strings and determining whether two given Unicode strings are equivalent based on the chosen normalization form
The process of encrypting Unicode strings
The process of compressing Unicode strings
Why is normalization mandatory in Unicode?
Because it increases the size of the data
Because it makes data encryption easier
Because a character string can have many alternative representations
Because it reduces the number of characters
What do web applications use to handle unknown input strings?
Data compression algorithms
Input filters and validation processes
Encryption keys
Data sorting algorithms
When is input validation applied to prevent vulnerabilities such as cross-site scripting (XSS)?
Before normalizing the strings
After normalizing the strings
During data encryption
During data compression
What is the purpose of output encoding in secure coding practices?
To convert special characters into a different format to prevent vulnerabilities
To enhance the speed of data processing
To compress data for storage efficiency
To encrypt data for secure transmission
How does output encoding help in web security?
It compresses data for faster loading
It converts input characters into their equivalent encoded values for web pages
It encrypts data for secure storage
It enhances the visual appearance of web pages
Which type of attack can output encoding help prevent?
Denial of Service (DoS)
Phishing
Cross-site scripting (XSS)
Man-in-the-middle
What are exceptions in the context of programming?
Regular operations in a program
Unusual errors during execution
User inputs
Successful program completions
What is the purpose of exception handling in programming?
To ignore errors
To anticipate, detect, and resolve errors
To slow down the program
To enhance graphics
What can improper error or exception handling lead to?
Faster program execution
System crashes or failures during operations
Improved user interface
Increased memory usage
How can error handling affect an application?
It can improve graphics
It can affect confidentiality, integrity, and availability of data
It can increase processing speed
It can reduce storage requirements
Why does the error handling mechanism need to be secure?
To enhance user experience
To prevent the application from entering an unknown state
To increase the application's speed
To reduce the application's size
