A web application accepts user comments that are later displayed to other users. The security team wants to prevent both SQL injection and cross-site scripting (XSS) attacks. Which input validation strategy should be implemented?

Reject any input that contains characters such as single quotes, angle brackets, or semicolons.

Sanitize the input by removing or encoding dangerous characters, and use parameterized queries for database access.

Limit the length of the input to 10 characters to prevent injection.

Store the input in the database without any changes, but display it using a secure rendering library.

Which practice is considered a secure coding practice?

Ignoring compiler warnings to speed up development

Using hardcoded credentials for simplicity

Disabling error handling to avoid revealing information

Validating all input from users and external sources

A database administrator wants to reduce the risk of SQL injection in a legacy application that frequently executes complex database operations. The application code is difficult to modify. Which approach should the administrator recommend?

Encapsulate the database operations in stored procedures and grant the application only EXECUTE permissions on them.

Use a web application firewall (WAF) to block all SQL keywords in incoming requests.

Disable all dynamic SQL in the application by removing the database connection string.

Increase the database server's memory to handle larger queries.

A developer implements anti-CSRF tokens in a web application. The token is generated and stored in the user's session. When the user submits a form, the application compares the submitted token with the session token. What is the purpose of this server-side comparison?

To check if the user has permission to submit the form.

To ensure the request was initiated by the legitimate user and not by a malicious third-party site.

To verify that the user's browser supports JavaScript.

To encrypt the form data before it is sent to the server.

Which technique is commonly used in dynamic software analysis?

Fuzzing the application with random or malformed inputs

Checking for missing semicolons

Reviewing code for proper indentation

Scanning the source code for hardcoded passwords

CertNexusCyberSec First Responder (CFR)

Domain 3Objective 3

Objective 3.3 Protect Software. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 6)

Part of the 3.0 Address the Security Concerns of Computing Environments domain, which accounts for 28% of the CYBERSEC-FIRST-RESPONDER exam.

53questions here

11free pages

18concepts

28%of the exam

18 Concepts in This Objective

Patching
Assessment and testing of updates
Static code analysis
Dynamic software analysis
Secure coding practices
Static queries
Prepared statements and parameterized queries
Stored procedures
Input validation
Input sanitization for XSS
Modern sanitization functions
Consistent application of sanitization
Anti-CSRF tokens
Server-side checking of tokens
Validation of file extensions
Validation of Content-Type headers
Scrubbing of metadata
Re-encoding of uploaded files

Questions 26–30

26application · medium
A web application accepts user comments that are later displayed to other users. The security team wants to prevent both SQL injection and cross-site scripting (XSS) attacks. Which input validation strategy should be implemented?
Select an answer first
27foundation · easy
Which practice is considered a secure coding practice?
Select an answer first
28application · medium
A database administrator wants to reduce the risk of SQL injection in a legacy application that frequently executes complex database operations. The application code is difficult to modify. Which approach should the administrator recommend?
Select an answer first
29application · medium
A developer implements anti-CSRF tokens in a web application. The token is generated and stored in the user's session. When the user submits a form, the application compares the submitted token with the session token. What is the purpose of this server-side comparison?
Select an answer first
30foundation · easy
Which technique is commonly used in dynamic software analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSEC-FIRST-RESPONDER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CYBERSEC-FIRST-RESPONDER” is a trademark of its owner, used for identification only.