NEW
Font size
WorksheetsT6 - Application Security
Total questions: 75
Worksheet time: 1hrs 15mins
An organization wants to ensure that security requirements are formally identified before application design begins. During which SDLC phase should this primarily occur?
Planning
Requirements definition
Design
Coding
A security analyst reviews source code without executing it and identifies unsafe string handling. Which technique is being used?
Static code analysis
Fuzz testing
Dynamic application security testing
Regression testing
Which SDLC phase most directly focuses on integrating individual software components and validating functionality?
Design
Coding
Testing
Training and transition
Which environment is intended to mirror production while preventing impact on live users?
Test
Decommissioning
Development
Staging
An organization automates builds, testing, and deployment while embedding security checks throughout the process. This approach best aligns with:
DevSecOps practices
Traditional waterfall development
Agile without security oversight
Post-deployment hardening
Which DevOps concept emphasizes frequent code commits to a shared repository?
Continuous validation
Continuous monitoring
Continuous integration
Continuous deployment
Which risk is most associated with automated CI/CD pipelines lacking proper security validation?
Reduced system availability
Increased developer workload
Introduction of untested vulnerabilities into production
Delayed application releases
A developer uses parameterized SQL queries to prevent malicious input manipulation. Which secure coding principle is being applied?
Encoding output
Enforcing access controls
Validating all inputs
Leveraging secure frameworks
Which OWASP proactive control emphasizes encrypting sensitive data both at rest and in transit?
Implement security logging
Protect data everywhere
Handle errors securely
Secure database access
An API that lacks rate limiting is most susceptible to which risk?
Denial-of-service conditions
Privilege escalation
Directory traversal
Replay attacks
Which testing method executes code and observes runtime behavior?
Dependency checking
Static analysis
Code review
Dynamic analysis
Which advantage is unique to static code analysis compared to dynamic testing?
Identifies runtime configuration flaws
Operates without executing the application
Detects memory leaks in production
Simulates real-world attack patterns
Fuzz testing is particularly effective at identifying:
Business logic errors
Cryptographic weaknesses
Memory handling issues
Authorization misconfigurations
Which condition most limits the effectiveness of fuzz testing?
Incomplete monitoring of test progress
Insufficient network bandwidth
Excessive logging output
Use of compiled languages
An attacker inserts malicious SQL commands through user input fields. This is an example of:
Code injection
Command injection
Cross-site scripting
SQL injection
Blind SQL injection differs from standard SQL injection because it:
Targets only stored procedures
Does not return visible query results
Uses encrypted payloads
Requires administrative credentials
Which method relies on observing application response delays to extract database information?
Union-based SQL injection
Timing-based blind SQL injection
Content-based blind SQL injection
Stored SQL injection
An application returns no data after an unexpected query modification. This behavior most strongly suggests:
Content-based blind SQL injection vulnerability
Timing-based SQL injection resistance
Secure input validation
Database connection failure
Which mitigation best prevents SQL injection attacks?
Output encoding
Parameterized queries
Database replication
Error suppression
An attacker injects operating system commands through a vulnerable application interface. This is classified as:
Command injection
SQL injection
XML injection
Code injection
Which characteristic increases the risk of command injection?
Strong authentication controls
Direct execution of user-supplied input
Client-side input validation
Use of encryption for input fields
Which environment hosts the live application accessed by end users?
Staging
Production
Development
Test
Why is change management critical when moving code between environments?
It eliminates regression testing
It increases application performance
It enforces accountability and auditability
It reduces development time
Which SDLC phase typically represents the longest operational timeframe?
Testing
Planning
Training and transition
Operations and maintenance
What is the primary goal of secure coding practices?
Increase development speed
Reduce software licensing costs
Improve user interface consistency
Minimize exploitable vulnerabilities
Which OWASP control focuses on denying access by default?
Implement digital identity
Protect data everywhere
Enforce access controls
Secure database access
Which API security requirement ensures that users can only perform permitted actions?
Authorization
Authentication
Input encoding
Rate limiting
Which API risk arises when excessive data is returned in responses?
Injection
Broken authentication
Insufficient logging
Excessive data exposure
Which testing approach best identifies vulnerabilities during runtime execution?
Static analysis
Manual code review
Dependency mapping
Dynamic analysis
Why is continuous monitoring essential in CI/CD pipelines?
It detects vulnerabilities introduced after deployment
It replaces regression testing
It ensures deployment consistency
It reduces build times
Which secure coding principle addresses improper error messages?
Encode output
Handle errors and exceptions
Validate all inputs
Secure database access
Which factor most increases the effectiveness of automated security testing?
Post-deployment testing only
Limited test scope
Integration into CI/CD workflows
Manual execution oversight
What is a key limitation of static code analysis?
Requires executing the application
Generates excessive false negatives
May miss runtime configuration issues
Cannot analyze compiled code
Which phase ensures users are trained before full production release?
Training and transition
Coding
Decommissioning
Testing
Which SDLC phase formally ends a system’s lifecycle?
Maintenance
Operations
Transition
Decommissioning
Which injection type targets directory services using LDAP queries?
SQL injection
XML injection
LDAP injection
DLL injection
Which secure practice minimizes reliance on custom authentication logic?
Encode output
Enforce access controls
Leverage security frameworks
Implement digital identity
Which concept ensures security considerations are shared across development and operations teams?
Agile development
DevSecOps
Waterfall methodology
Secure SDLC
Which risk increases when APIs lack proper authentication?
Buffer overflows
Memory exhaustion
Unauthorized data access
Replay attacks
Which testing method is best suited for identifying known vulnerability patterns?
Fuzz testing
Manual testing
User acceptance testing
Static analysis
Why is input validation insufficient when implemented only on the client side?
It increases latency
It can be bypassed by attackers
It conflicts with encryption
It limits usability
Which secure coding practice directly supports nonrepudiation?
Error handling
Input validation
Secure logging
Encryption
Which factor most complicates blind SQL injection attacks?
Encrypted databases
Lack of visible output
Database normalization
Strong authentication
Which environment typically supports quality assurance activities?
Decommissioned
Test
Development
Production
Which API protection limits abuse from automated requests?
Authorization
Rate limiting
Tokenization
Input encoding
Which SDLC phase determines feasibility and cost considerations?
Testing
Design
Requirements
Planning
Which practice best reduces technical debt over time?
Delaying security testing
Ongoing secure coding standards
Manual patch management
Post-incident remediation
Which vulnerability arises when an application executes attacker-supplied code libraries?
XML injection
DLL injection
SQL injection
Command injection
Which CI/CD risk increases without proper access controls?
Unauthorized code deployment
Privilege escalation
Data exfiltration
Memory exhaustion
Which secure coding control helps prevent privilege escalation?
Least privilege enforcement
Secure logging
Input encoding
Output sanitization
Which testing method generates large volumes of malformed input?
Regression testing
Static analysis
Fuzzing
Penetration testing
Which attack inserts attacker-written scripts into web pages viewed by other users?
SQL injection
Cross-site scripting
Command injection
Directory traversal
Which SDLC phase focuses on architectural decisions and data flows?
Testing
Requirements
Planning
Design
Which API flaw allows users to access data belonging to others?
Broken object level authorization
Excessive data exposure
Injection vulnerabilities
Insufficient logging
Which control ensures sensitive credentials are not stored in plaintext?
Access logging
Secure password storage
Input validation
Output encoding
Which secure coding practice reduces attack surface?
Removing unused features
Logging all input
Error handling
Increasing code complexity
Which DevOps benefit most directly improves response time to security incidents?
Infrastructure scaling
Reduced deployment frequency
Automated monitoring
Code reuse
Which testing approach best identifies logic flaws during execution?
Code linting
Dependency scanning
Dynamic analysis
Static analysis
Which injection attack targets XML parsers?
LDAP injection
Command injection
XML injection
SQL injection
Which phase ensures deployed software continues to function securely?
Testing
Operations and maintenance
Training
Planning
Which factor most contributes to successful DevSecOps adoption?
Delayed testing cycles
Dedicated security teams only
Shared responsibility across roles
Manual security reviews
Which attack modifies queries without displaying results to users?
Stored SQL injection
Union SQL injection
Reflected SQL injection
Blind SQL injection
Which mitigation best addresses command injection risks?
Output encoding
Secure logging
Database encryption
Input validation and sanitization
Which practice ensures vulnerabilities are not reintroduced after fixes?
User acceptance testing
Regression testing
Fuzz testing
Static analysis
Which SDLC benefit improves predictability and consistency?
Ad hoc development
Secure SDLC adoption
Rapid prototyping only
Minimal documentation
Which API control prevents credential reuse attacks?
Authorization
Input encoding
Strong authentication
Rate limiting
Which testing limitation applies to dynamic analysis?
Produces excessive false positives
May miss code paths not executed
Cannot test running applications
Requires source code access
Which secure coding practice ensures sessions are properly managed?
Log errors
Validate inputs
Secure cookies
Encrypt databases
Which environment is typically isolated for developers?
Production
Development
Test
Staging
Which SDLC phase confirms functional requirements are met?
Design
Decommissioning
Planning
Testing
Which risk increases when APIs lack proper authorization checks?
Data exposure
Buffer overflows
Injection attacks
Replay attacks
Which practice helps detect suspicious application behavior after deployment?
Input validation
Static analysis
Secure logging and monitoring
Code signing
Which injection attack leverages database delay functions?
Timing-based blind SQL injection
Error-based SQL injection
Union SQL injection
Content-based SQL injection
Which SDLC activity ensures security controls are built into design decisions?
Requirements gathering
Regression testing
User training
Secure design reviews
Which overarching goal ties together secure coding, testing, and deployment?
Simplifying user experience
Eliminating all vulnerabilities
Reducing application attack surface
Maximizing development speed
