NEW
Font size
WorksheetsC6 - Application Security
Total questions: 80
Worksheet time: 3600secs
Which of the following attacks is characterized by inserting malicious code into user inputs that are executed by a database?
Directory traversal
Cross-site scripting
SQL injection
Replay attack
What is the main purpose of input validation in web applications?
Improve user interface speed
Prevent cross-site scripting and injection attacks
Speed up database queries
Optimize resource usage
What security mechanism ensures that code has not been altered since it was published by the developer?
Code obfuscation
Code signing
Code commenting
Code reuse
Which type of vulnerability occurs when a web server allows attackers to access files outside the intended directory structure?
Command injection
Directory traversal
Buffer overflow
Blind SQL injection
What software development practice integrates security throughout the entire software lifecycle, including development and operations?
Static code analysis
Continuous deployment
DevSecOps
Waterfall development
Which type of cross-site scripting attack involves malicious scripts stored on a server and executed whenever a user views the affected page?
Reflected XSS
Persistent XSS
DOM-based XSS
Blind XSS
What term refers to running applications in isolated environments to prevent interaction with critical system resources?
Containerization
Sandboxing
Virtualization
Encapsulation
Which of the following best describes a Cross-site Request Forgery (CSRF) attack?
An attack that injects malicious code into user input
An attack that exploits a user's trust in a website to execute unauthorized commands
An attack that steals data from the server by exploiting URL parameters
An attack that forces a server to visit malicious URLs
What type of testing method involves executing code with invalid or random data to discover vulnerabilities such as crashes or leaks?
Static analysis
Dynamic analysis
Fuzzing
Regression testing
Which of the following would be the best defense against a session replay attack in web applications?
Secure cookies with the SECURE attribute
Encrypting database communications
Using firewall ACLs
Code reuse practices
Which vulnerability is characterized by inserting malicious scripts into web pages viewed by other users?
SSRF
XSS
CSRF
TOC
What type of attack occurs when an attacker tricks an authenticated user into submitting a request they didn't intend?
SQL injection
Cross-Site Request Forgery (CSRF/XSRF)
Time-of-Check (TOC)
Static Application Security Testing (SAST)
Which vulnerability allows attackers to send malicious requests from the server to internal resources?
SSRF
XSS
API
TOU
What is a race condition vulnerability called that happens when a system checks a value before it is actually used?
TOU
CSRF
TOC
SSRF
The process that describes the stages involved in developing software from design to deployment is known as:
API development
Software Development Life Cycle (SDLC)
Web Application Firewall (WAF)
Server-side scripting
Which of the following refers to a security mechanism placed in front of web servers to monitor and filter traffic?
Static Application Security Testing (SAST)
Application Programming Interface (API)
Web Application Firewall (WAF)
Time-of-Use (TOU)
Which method involves analyzing source code for vulnerabilities before the application is deployed?
SSRF
SAST
XSS
CSRF
Which of the following best describes an Application Programming Interface (API)?
A security device used to detect web attacks
A race condition vulnerability
A set of protocols for building and interacting with software applications
A software development model
What vulnerability exists when data checked by a system becomes outdated by the time it is used?
XSS
TOU
SSRF
SDLC
The specific system or product being assessed for security vulnerabilities is known as the:
Application Programming Interface (API)
Web Application Firewall (WAF)
Software Development Life Cycle (SDLC)
Target of Evaluation (TOE)
At which phase of the Software Development Life Cycle (SDLC) should security requirements initially be defined?
Coding
Design
Requirements
Testing
Secure Software Development Life Cycle (Secure SDLC) emphasizes integrating security into:
Only the Testing phase
Every phase of software development
Only the Requirements gathering
Only the Deployment phase
Which of the following describes software assurance best practices?
Adding security controls only after deployment
Ensuring security from initial design through final disposal of software
Performing security tests exclusively during user acceptance testing
Using automated testing exclusively after coding
What is the primary benefit of selecting an appropriate SDLC model for a specific project?
It guarantees zero vulnerabilities in the final product
It reduces the need for testing
It fits the specific workflow and project needs effectively
It eliminates the need for ongoing maintenance
The phase in the SDLC focused on patching, updating, and supporting the software after deployment is known as:
Design
Requirements
Operations and Maintenance
Testing
Which SDLC phase involves formally verifying software functionality with stakeholders and end-users?
Requirements definition
User Acceptance Testing (UAT)
Operations and Maintenance
End of Life/Decommissioning
During which phase of the SDLC would secure coding practices and unit testing typically occur?
Planning
Coding
Requirements definition
Deployment
The process of systematically retiring software at the end of its useful life to ensure security and data protection is referred to as:
Software Assurance
End of Life (EOL)/Decommissioning
Static Application Security Testing
Continuous integration
Continuous integration (CI) within software assurance practices primarily ensures:
Security checks are performed only after production
Code is regularly merged and tested automatically
Development and operations teams remain separate
Manual testing replaces automated testing
A DevSecOps approach ensures:
Developers handle all security concerns independently
Security is treated as a separate team and added after deployment
Security responsibilities are shared throughout development and operations
Operations teams have exclusive control over security measures
Which secure coding practice effectively prevents injection vulnerabilities?
Parameterized queries
Frequent software updates
Encrypting data at rest
Sandboxing applications
Which organization provides widely-used proactive security controls and secure coding guidelines?
NIST
OWASP
IEEE
ISO
SQL Injection attacks typically exploit weaknesses related to:
Unpatched operating systems
Poor input validation
Unencrypted communication channels
Insufficient user authentication
Which type of injection vulnerability involves executing unexpected commands directly on the host system?
SQL injection
Command injection
Cross-site scripting (XSS)
LDAP injection
Cross-site scripting (XSS) primarily targets which aspect of a web application?
Database queries
Authentication credentials
User input fields
Server-side session tokens
What security principle involves validating user input against explicitly permitted values?
Deny listing
Allow listing
Encryption
Encoding
An attacker submits code to a web application that executes additional unintended queries. This is an example of:
Parameter pollution
Session hijacking
SQL injection
Cross-site request forgery
Which type of injection attack involves tricking a web application into requesting malicious resources from internal services?
Command injection
Server-side request forgery (SSRF)
Blind SQL injection
Stored XSS
Dynamic code analysis differs from static analysis in that dynamic analysis:
Reviews source code without execution
Analyzes code only after deployment
Requires code execution with various inputs
Detects logical errors by manual code review
Which secure coding practice reduces the risk of exposing sensitive application details during an error condition?
Detailed error logging
Generic error messaging and handling exceptions securely
Displaying error details in user interfaces
Using encryption during data transmission
Which attack involves stealing an authenticated user's session cookie to impersonate their session?
Cross-site scripting
SQL injection
Session hijacking
Buffer overflow
An attack exploiting URLs containing parameters to gain unauthorized access to data is known as:
Directory traversal
Command injection
Insecure direct object references
Blind SQL injection
What type of attack exploits a user's trust by embedding malicious code into a legitimate website to execute in another user's browser?
Cross-site scripting (XSS)
Directory traversal
Command injection
Denial of Service (DoS)
A vulnerability that allows users to access files or directories stored outside the web application's intended directory is called:
SQL injection
Directory traversal
Cross-site request forgery
Privilege escalation
Which of the following attacks tricks an authenticated user into executing unwanted commands against a web application they trust?
Server-side request forgery (SSRF)
Cross-site request forgery (CSRF)
Command injection
Buffer overflow
Which attack occurs when users are unknowingly redirected from a legitimate site to a malicious one due to improperly validated URL redirection?
Privilege escalation
Unvalidated redirects
Cross-site scripting
Session replay
Privilege escalation attacks are primarily designed to:
Execute malicious scripts in a user's browser
Increase the attacker’s permissions on the target system
Redirect legitimate web traffic to malicious sites
Cause denial of service in web servers
Stored (Persistent) XSS differs from Reflected XSS attacks because Stored XSS attacks:
Inject scripts that execute immediately and do not persist
Embed malicious code that remains on a server indefinitely
Depend on real-time user interaction to activate
Target server-side resources directly
Which type of vulnerability would allow an attacker to remotely execute files from a malicious external server?
Local file inclusion
Remote file inclusion
Command injection
Directory traversal
An attacker observes network traffic, captures session tokens, and later uses them to gain unauthorized access. This describes a:
Buffer overflow
SQL injection
Session replay attack
Cross-site request forgery (CSRF)
What security control validates user inputs against explicitly allowed characters or values?
Parameterization
Allow listing
Sandboxing
Deny listing
What coding practice involves isolating applications to limit their interactions with other system resources?
Parameterized queries
Input validation
Sandboxing
Secure cookies
Which coding practice involves cryptographically verifying that software updates originate from legitimate developers?
Code reuse
Code signing
Code obfuscation
Static analysis
Web Application Firewalls (WAFs) primarily protect web applications by:
Encrypting all web traffic
Monitoring and filtering malicious HTTP traffic
Automating code deployment
Performing code signing
Which automated practice involves frequently integrating and testing code changes to detect issues early in the development cycle?
Continuous Integration (CI)
Sandboxing
Code signing
Allow listing
Automated orchestration benefits application security primarily by:
Reducing reliance on manual processes and improving consistency
Eliminating the need for code signing
Replacing the role of security teams entirely
Removing the necessity for input validation
Which secure coding practice helps prevent SQL injection vulnerabilities by separating executable statements from user input?
Dynamic analysis
Parameterized queries
Sandboxing
Static analysis
One potential drawback of automation and orchestration in security operations is:
Reduced reaction time to incidents
Increased complexity and technical debt
Elimination of all security vulnerabilities
Decreased ability to scale securely
Which practice ensures developers regularly check code into a shared repository, triggering automatic tests?
Continuous Deployment (CD)
Parameter pollution
Continuous Integration (CI)
Static code analysis
Implementing digital identity, validating inputs, and enforcing access controls are examples of practices recommended by:
ISO 27001
NIST SP 800-53
OWASP Proactive Controls
ITIL Framework
Which component of AAA ensures users prove their identity before accessing system resources?
Authentication
Authorization
Accounting
Administration
A security administrator restricts user access based on job roles. This is an example of:
Authentication
Authorization
Accounting
Auditing
Tracking user activities and maintaining detailed logs to provide audit trails is primarily the role of:
Authentication
Authorization
Accounting
Access Control
Which protocol provides all three components—authentication, authorization, and accounting—within one integrated framework?
LDAP
RADIUS
Kerberos
SAML
Which of the following is the BEST example of authorization?
Using multi-factor authentication to verify user identity
Allowing only HR employees to access payroll data
Logging user activities for future audits
Encrypting sensitive data during transmission
Ensuring data is not altered in transit or at rest aligns with which aspect of the CIA triad?
Confidentiality
Integrity
Availability
Accountability
Encrypting sensitive data primarily addresses which part of the CIA triad?
Confidentiality
Integrity
Availability
Authorization
Ensuring critical systems remain operational and accessible when needed is an example of protecting:
Confidentiality
Integrity
Availability
Authentication
A security breach that results in unauthorized disclosure of customer data most directly affects:
Confidentiality
Integrity
Availability
Authentication
Implementing redundancy and fault-tolerance mechanisms primarily supports which security goal?
Confidentiality
Integrity
Availability
Accountability
Non-repudiation ensures that:
Users cannot deny actions they performed
Users have unique logins for system access
Unauthorized users cannot access data
All transactions are encrypted in transit
A gap analysis primarily involves:
Evaluating security measures against industry standards to find deficiencies
Encrypting sensitive data to ensure confidentiality
Testing application code to find vulnerabilities
Authenticating users before granting network access
Which security model operates under the assumption that no internal or external entity should automatically be trusted?
AAA Model
Zero Trust Model
Defense-in-depth
CIA Triad
Requiring employees to use RFID badges for building access is an example of:
Logical security
Physical security
Administrative control
Software assurance
Which practice would best support non-repudiation in an e-commerce system?
Frequent backups of transaction data
Digital signatures on transactions
Multi-factor authentication
Secure storage of passwords
After conducting a gap analysis, the next step an organization should take is:
Immediately replace existing security controls
Ignore findings to reduce operational costs
Prioritize identified deficiencies for remediation
Encrypt all sensitive data immediately
In a Zero Trust architecture, access control decisions are made based primarily on:
Trust level determined by network location
Continual verification of user identity and device posture
A single verification upon user login
Physical location of devices within the building
Implementing biometric access control at a data center entrance directly improves:
Logical authentication processes
Physical security
Data encryption
Non-repudiation of transactions
A security control that records video footage of all entry and exit points primarily supports:
Integrity
Availability
Non-repudiation
Confidentiality
Zero Trust security frameworks typically:
Allow trusted users full access to resources without further checks
Continuously validate access regardless of user location or device
Require physical authentication at every entry door
Depend exclusively on firewall perimeter security
