Objective 3.3 Protect Software. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is testing a newly developed web application for runtime vulnerabilities such as memory leaks and improper error handling. The application is already deployed in a staging environment. Which testing method should the analyst use?

   • ADynamic software analysis, which tests the running application by sending inputs and observing its behavior.
   • BStatic code analysis, which reviews the source code for potential flaws without running it.
   • CPatch management, ensuring the application's dependencies are up to date.
   • DManual code review, focusing on the application's business logic.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a common secure coding practice to prevent buffer overflows?

   • ADisabling stack protection features
   • BIncreasing buffer sizes arbitrarily
   • CUsing unsafe functions like strcpy without checks
   • DUsing bounds checking on array and buffer operations
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Where should anti-CSRF token validation occur?

   • AOn the server side, before processing the request
   • BIn the database, after storing the data
   • COn the client side, using JavaScript
   • DIn the network firewall
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is static code analysis?

   • ATesting the application's performance under load
   • BRunning the application and observing its behavior
   • CAnalyzing source code without executing it to find vulnerabilities
   • DReviewing user documentation for accuracy
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A web application has a feature that allows users to submit HTML content that is displayed to other users. The security team wants to prevent XSS but also wants to preserve the ability to use safe HTML tags like <b> and <i>. The team is considering using a sanitization library. What is the most important factor to consider when selecting the library?

   • AThe library should be fast and have a small memory footprint.
   • BThe library should be open source and widely used.
   • CThe library should use a whitelist-based approach that allows only safe tags and attributes, and it should be consistently applied to all user inputs.
   • DThe library should automatically encode all HTML entities in the input.
   Reveal Solution Discussion Select an answer first