Why Applications Become Vulnerable to Attacks CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A .NET web application has a search feature that constructs SQL queries by concatenating user input directly into the query string. The application is vulnerable to SQL injection. Which combination of factors most likely contributed to this vulnerability?

   • AUse of an outdated third-party library that contains a SQL injection flaw.
   • BInsecure coding practices, lack of security awareness, and prioritizing functionality over security.
   • CAn insider threat deliberately inserting malicious code into the application.
   • DA misconfigured web server and weak network firewall rules.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common reason why applications become vulnerable to attacks?

   • AUsing parameterized queries consistently
   • BFailing to validate user input
   • CPerforming regular security code reviews
   • DApplying security patches promptly
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is expanding its .NET web application to include a public REST API that exposes customer order data. The API will be used by external partners and will also be accessible from the public internet. The security team is concerned about the increased attack surface. Which approach best balances the need to provide the API with the need to minimize security risk?

   • AMake the API publicly accessible without authentication because the data is not highly sensitive.
   • BRestrict the API to internal use only and do not expose it to external partners.
   • CImplement OAuth 2.0 with scoped access tokens and require all API requests to be authenticated and authorized.
   • DUse a shared API key for all partners to simplify access.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A developer receives an urgent email from what appears to be the IT department asking them to 'verify' their credentials by clicking a link and entering their password. The developer complies, and the attacker uses those credentials to access the source code repository and inject malicious code. Which human factor contributed most directly to this breach?

   • ALack of security awareness training
   • BExpanded attack surface
   • CMisconfiguration of the repository
   • DInsecure coding practices
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's customer support team needs to access a database to help customers with issues. The team wants to use a shared generic account with a simple password for convenience. The security team is concerned about accountability and the risk of misuse. What is the best way to balance convenience and security?

   • ACreate individual accounts with role-based permissions and use a password manager for the team
   • BUse the shared account but change the password monthly
   • CUse the shared account but restrict access to business hours
   • DUse the shared account but log all queries
   Reveal Solution Discussion Select an answer first