Objective 3.3 Protect Software. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A web application includes a form that allows users to change their email address. The security team wants to prevent cross-site request forgery (CSRF) attacks. What should be implemented?

   • ACheck the 'Referer' header to ensure the request comes from the same domain.
   • BUse a hidden field that contains the user's password to verify the request.
   • CSet the 'SameSite' cookie attribute to 'Lax' and rely on the browser to block all cross-site requests.
   • DEmbed a unique anti-CSRF token in the form and validate it on the server for each submission.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is it important to validate file extensions during upload?

   • ATo prevent upload of executable or malicious files
   • BTo compress files for storage
   • CTo make the upload process faster
   • DTo encrypt files before storing them
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A developer is building a forum where users can post messages that include HTML formatting. The developer wants to prevent stored XSS attacks while allowing basic formatting like bold and italics. What should the developer do?

   • AUse a blacklist that removes common XSS payloads like '<script>' and 'onerror'.
   • BUse a modern sanitization library that allows a whitelist of safe HTML tags and attributes, and strips or encodes everything else.
   • CEncode the entire input using base64 before storing it in the database.
   • DRemove all HTML tags from the input and display the text as plain text.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which Content-Type would be appropriate for a PNG image upload?

   • Atext/html
   • Bapplication/octet-stream
   • Capplication/x-php
   • Dimage/png
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a benefit of using stored procedures for database access?

   • AThey automatically encrypt all data
   • BThey make the database faster by skipping security checks
   • CThey eliminate the need for input validation
   • DThey can limit direct table access and enforce business logic
   Reveal Solution Discussion Select an answer first