Implement Mitigation Strategies for OWASP Threats (such as XSS, CSRF, and SQL Injection) 350-901 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A DevNet engineer is reviewing a web application that has been in production for several years. The application has a login form, a search feature, and a profile update feature. A penetration test identified XSS, CSRF, and SQL injection vulnerabilities. The team has a limited budget and must fix the vulnerabilities in the next sprint. Which fix should the engineer prioritize?

   • AFix the XSS in the login form first, because it can steal user credentials.
   • BFix the SQL injection in the search feature first, because it can lead to full database compromise.
   • CImplement a WAF to block all three attack types and defer code fixes.
   • DFix the CSRF in the profile update feature first, because it can change user data.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A DevNet engineer is deploying a web application that uses a third-party single sign-on (SSO) service. The application sets a session cookie after successful authentication. The security team is concerned about CSRF on the logout endpoint. Which mitigation should the engineer implement?

   • AImplement a CSRF token on the logout form and validate it on the server.
   • BSet the session cookie's SameSite attribute to 'Lax' and rely on it for CSRF protection.
   • CUse a GET request for logout to simplify the implementation.
   • DRely on the SSO service to handle CSRF protection for logout.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A DevNet engineer is developing a single-page application (SPA) that renders user-generated content. The application uses a JavaScript framework that automatically escapes data in templates. However, the engineer needs to render a rich text editor's HTML output. Which mitigation should the engineer implement to prevent XSS while allowing safe HTML?

   • ADisable the rich text editor and use plain text input only.
   • BSanitize the HTML output using a well-maintained allowlist-based sanitizer library.
   • CRender the HTML in an iframe with the sandbox attribute.
   • DUse a Content Security Policy that disallows all inline scripts.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which security concept involves layering multiple independent defenses so that if one control fails, another still provides protection?

   • ADefense in depth
   • BLeast privilege
   • CSingle point of failure
   • DFail-open design
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A DevNet engineer is reviewing a Python Flask application that queries a database. The current code builds SQL queries by concatenating user input directly into the query string. The team needs to fix this vulnerability without rewriting the entire data access layer. Which approach should the engineer recommend?

   • AUse parameterized queries with placeholders (e.g., '?' or '%s') and pass user input as parameters.
   • BUse a stored procedure that dynamically builds the query using EXECUTE IMMEDIATE.
   • CAdd a web application firewall (WAF) rule to block requests containing SQL keywords like 'SELECT' or 'UNION'.
   • DEscape single quotes in user input before concatenating it into the SQL string.
   Reveal Solution Discussion Select an answer first