NEW
Font size
S
M
L
XL
WorksheetsSecurityTraining
Total questions: 20
Worksheet time: 10mins
Name
Class
Date
1.
What is the primary purpose of the training outlined in Chapter 1?
a)
To teach developers how to deploy web applications
b)
To focus on database optimization techniques
c)
To train developers in UI design for React
d)
To equip developers with knowledge to identify and mitigate OWASP Top 10 vulnerabilities in C# .NET 8 and TypeScript/React applications
e)
To promote the use of new programming languages
2.
Why is the OWASP Top 10 emphasized in the training?
a)
It provides a list of programming languages to use
b)
It focuses on frontend design best practices
c)
It highlights critical web application risks like Broken Access Control and Injection
d)
It outlines cloud deployment strategies
e)
It defines database schema standards
3.
What is a key risk of Broken Access Control (A01:2021)?
a)
SQL injection attacks
b)
Cross-site scripting (XSS)
c)
Hardcoded encryption keys
d)
Data exposure or privilege escalation
e)
Server misconfiguration
4.
How can you secure a C# .NET 8 endpoint against Broken Access Control?
a)
Allow unrestricted access to endpoints
b)
Use client-side checks for authorization
c)
Expose endpoints without authentication
d)
Use the [Authorize] attribute with role-based policies
e)
Use hardcoded user IDs
5.
What is a secure practice for handling CORS in a .NET 8 API?
a)
Allow all origins with any method
b)
Disable CORS entirely
c)
Use HTTP instead of HTTPS for CORS
d)
Expose all headers to all origins
e)
Restrict CORS to trusted domains only
6.
What is the impact of Cryptographic Failures (A02:2021)?
a)
Unauthorized access to endpoints
b)
Execution of malicious scripts
c)
Data breaches exposing credentials or PII
d)
Server downtime due to misconfiguration
e)
Dependency vulnerabilities
7.
How should encryption keys be managed in a C# .NET 8 application?
a)
Hardcode keys in the source code
b)
Store keys in a public config file
c)
Store keys in secure storage like Azure Key Vault
d)
Use plaintext storage for keys
e)
Share keys via email
8.
What is a frontend mitigation for Cryptographic Failures in TypeScript/React?
a)
Store passwords in local state
b)
Use plaintext inputs for passwords
c)
Store secrets in localStorage
d)
Use type='password' for sensitive inputs and encrypt data
e)
Send unencrypted data to the API
9.
What is a common consequence of Injection flaws (A03:2021)?
a)
Unauthorized endpoint access
b)
Hardcoded secret exposure
c)
Data loss or system compromise
d)
Debug log exposure
e)
Dependency vulnerabilities
10.
How does Entity Framework Core prevent SQL injection in C# .NET 8?
a)
By concatenating user inputs into queries
b)
By disabling database validation
c)
By using parameterized queries
d)
By exposing raw SQL queries
e)
By bypassing ORM entirely
11.
What is a secure way to handle dynamic content in TypeScript/React to prevent XSS?
a)
Use dangerouslySetInnerHTML without sanitization
b)
Allow raw HTML from user inputs
c)
Sanitize content with DOMPurify
d)
Disable JSX escaping
e)
Store user inputs in local state
12.
What is a risk of Security Misconfiguration (A05:2021)?
a)
SQL injection attacks
b)
Hardcoded encryption keys
c)
Client-side script execution
d)
Unauthorized access or data leaks
e)
Dependency corruption
13.
How should debug mode be handled in a C# .NET 8 production environment?
a)
Enable UseDeveloperExceptionPage
b)
Expose stack traces to users
c)
Disable UseDeveloperExceptionPage
d)
Disable exception handling
e)
Log all errors publicly
14.
What is a frontend mitigation for Security Misconfiguration in TypeScript/React?
a)
Enable source maps in production
b)
Allow all external scripts
c)
Configure Content Security Policy (CSP)
d)
Disable npm audit
e)
Use HTTP for script loading
15.
What is a consequence of Identification and Authentication Failures (A07:2021)?
a)
Data corruption
b)
SQL injection
c)
Debug log exposure
d)
Unauthorized account access
e)
Hardcoded secrets
16.
How can a C# .NET 8 API secure authentication?
a)
Allow unauthenticated access to endpoints
b)
Store tokens in query strings
c)
Use JWT with token validation parameters
d)
Disable MFA
e)
Use hardcoded tokens
17.
What is a secure way to store tokens in a TypeScript/React application?
a)
Store tokens in URLs
b)
Store tokens in plain localStorage
c)
Use HttpOnly cookies or encrypted localStorage
d)
Log tokens to the console
e)
Send tokens in query parameters
18.
What is a mitigation for Software and Data Integrity Failures (A08:2021)?
a)
Use outdated dependencies
b)
Disable dependency scanning
c)
Use Subresource Integrity (SRI) for scripts
d)
Allow unsigned CI/CD artifacts
e)
Bypass checksum validation
19.
How can SSRF (A10:2021) be prevented in a C# .NET 8 API?
a)
Allow unrestricted URL requests
b)
Enable automatic redirects
c)
Validate URLs against an allow list
d)
Bypass URL validation
e)
Use HTTP for requests
20.
What is a key practice for input validation in C# .NET 8?
a)
Allow unvalidated inputs
b)
Disable model validation
c)
Use data annotations for model validation
d)
Use raw SQL queries
e)
Store inputs in plaintext
Reset
