Understanding Application Security, Threats, and Attacks CASENET Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is it important to address application security early in the software development lifecycle (SDLC)?

   • ABecause early security testing is required by law for all software development projects
   • BBecause security requirements are only defined during the requirements phase and cannot be added later
   • CBecause all security vulnerabilities are introduced during the coding phase, so earlier phases do not matter
   • DBecause early identification and remediation of security issues is generally less expensive and less disruptive than fixing them after deployment
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary goal of a cross-site scripting (XSS) attack?

   • ATo execute malicious scripts in a user's browser within the context of a trusted web application
   • BTo trick the user into revealing their password through a fake login page
   • CTo overload the server with a high volume of requests to cause denial of service
   • DTo intercept and modify network traffic between the user and the server
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing an ASP.NET application that uses a legacy SOAP service. The service accepts XML documents from external partners. The analyst notices that the XML parser is configured to resolve external entities. Which attack is the application most vulnerable to, and what is the primary mitigation?

   • ASQL Injection; parameterize all queries
   • BXXE; disable DTD processing and external entity resolution
   • CXSS; encode all XML output
   • DCSRF; add anti-forgery tokens
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A .NET web application accepts a JSON payload from an authenticated partner system. The payload includes a 'callbackUrl' field that the application later uses to send status notifications. During a security review, a tester discovers that the application does not validate the scheme or host of this URL. Which attack is the application most directly exposed to?

   • ASQL Injection
   • BCross-Site Request Forgery (CSRF)
   • CXML External Entity (XXE) Injection
   • DServer-Side Request Forgery (SSRF)
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A development team is building a new .NET application that will process personal data of EU citizens. The application will be deployed in a public cloud. The compliance team requires that personal data not leave the EU. The security team wants to use a cloud region in the EU. Which statement is correct?

   • AData residency is satisfied by encrypting the data at rest
   • BThe application must be deployed on-premises because public cloud cannot meet EU data residency requirements
   • CThe application must use dedicated physical servers in the EU region
   • DUsing an EU region satisfies the data residency requirement, but the team must also ensure that data is not transferred to other regions by support or backup processes
   Reveal Solution Discussion Select an answer first