Implement Mitigation Strategies for OWASP Threats (such as XSS, CSRF, and SQL Injection) 350-901 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard · select all that apply

   A DevNet engineer is hardening a web application against OWASP threats. The application is a REST API that serves JSON responses and uses cookie-based authentication. Select all that apply. Which of the following are effective defense-in-depth measures to mitigate XSS and CSRF?

   • ASet the X-Content-Type-Options header to 'nosniff'.
   • BImplement anti-CSRF tokens on all state-changing API endpoints.
   • CDisable CORS entirely by not sending any Access-Control-Allow-Origin header.
   • DSet the SameSite attribute on session cookies to 'Strict'.
   • ESet the Content-Type header to 'application/json' for all API responses.
   Check answers Discussion Select an answer first
2. 2foundation · easy

   Which technique is the most effective defense against SQL injection when building a SQL query that includes user-supplied input?

   • AUsing parameterized queries (prepared statements) with bound parameters
   • BValidating that the user input contains only alphanumeric characters
   • CEscaping single quotes in the user input before concatenating it into the query string
   • DStoring the query in a stored procedure and calling it with the user input as a parameter
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A developer is adding a security control to a web application to prevent stored cross-site scripting (XSS) attacks. The control must ensure that any user-supplied data rendered in HTML is treated as text, not as executable markup. Which technique directly achieves this?

   • AValidating that user input contains only alphanumeric characters before storing it
   • BImplementing output encoding on all user-controlled data before it is placed in the HTML response
   • CSetting the HttpOnly flag on all cookies used by the application
   • DAdding a Content Security Policy that only allows scripts from the same origin
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A DevNet engineer is reviewing a Node.js application that uses a SQL database. The application has a search feature that is vulnerable to SQL injection. The team wants to fix the vulnerability while minimizing changes to the existing codebase. Which approach should the engineer recommend?

   • AUse an ORM that automatically escapes all user input.
   • BAdd a validation layer that only allows alphanumeric characters in the search input.
   • CUse prepared statements with parameterized queries for all database interactions.
   • DImplement a custom input sanitization function that strips SQL keywords.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A DevNet engineer is reviewing a Java application that uses JDBC to query a database. The current code uses Statement objects and concatenates user input. The team wants to fix the SQL injection vulnerability. Which code change should the engineer recommend?

   • AReplace Statement with PreparedStatement and use parameter placeholders (?) for user input.
   • BUse Statement and escape single quotes in user input.
   • CUse CallableStatement to call a stored procedure that builds dynamic SQL.
   • DUse Statement and add a validation layer that rejects input containing SQL keywords.
   Reveal Solution Discussion Select an answer first