10. Describe Top OWASP Threats (such as XSS, SQL Injections, and CSRF) 200-901 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer at a company is building a login form. The current code concatenates the username and password directly into a SQL query string. A security review flags this as vulnerable. Which remediation should the developer implement to prevent SQL injection?

   • AUse parameterized queries with bound parameters for the login query
   • BHash the password before inserting it into the query
   • CEscape single quotes in the username and password before concatenation
   • DUse a stored procedure that dynamically builds the query
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A network monitoring portal has a legacy dashboard that renders device names in HTML without encoding. The development team wants to fix the XSS vulnerability but must preserve the ability to display device names that contain the ampersand character (&) as entered by users. The team is considering three options: (A) encode the device name with htmlspecialchars before rendering, (B) sanitize the device name by stripping all non-alphanumeric characters before storing it, (C) use a JavaScript-based client-side encoder. Which option best balances security and functional requirements?

   • AOption D: Disable HTML rendering for the entire dashboard
   • BOption A: Encode the device name with htmlspecialchars before rendering
   • COption C: Use a JavaScript-based client-side encoder
   • DOption B: Sanitize the device name by stripping all non-alphanumeric characters before storing it
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which characteristic best describes DOM-based XSS?

   • AThe malicious script is reflected off the server in the HTTP response, often via a crafted URL.
   • BThe vulnerability exists in client-side JavaScript that uses untrusted data to modify the DOM without proper sanitization.
   • CThe attack requires the attacker to have physical access to the user's browser.
   • DThe malicious script is stored on the server and executed when other users view the page.
   Reveal Solution Discussion Select an answer first
5. 14application · medium · select all that apply

   A development team is implementing a security checklist for a new network automation web app. Which three practices are effective mitigations for XSS, SQL injection, or CSRF? Select all that apply.

   • AInclude a unique CSRF token in every state-changing form and validate it server-side
   • BUse a WAF to completely eliminate all injection and XSS risks
   • CSet the HttpOnly flag on all cookies to prevent XSS
   • DEncode all user-controlled data when rendering it in HTML
   • EUse parameterized queries for all database interactions
   Check answers Discussion Select an answer first
6. 15expert · hard

   A developer is tasked with fixing a SQL injection vulnerability in a legacy application. The application uses dynamic SQL queries that are built from user input. The team cannot switch to an ORM or rewrite the data access layer. Which approach is the most secure under these constraints?

   • AUse a database-level prepared statement API with bound parameters
   • BEscape all user input using a database-specific escaping function
   • CUse a stored procedure that dynamically builds the query
   • DImplement a global input validation function that rejects any input containing SQL keywords
   Reveal Solution Discussion Select an answer first