Why Applications Become Vulnerable to Attacks CASENET Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A .NET application has a feature that allows users to set a profile URL. The application does not validate the URL and stores it in a database. When other users view the profile, the URL is rendered as a hyperlink without encoding. Which vulnerability is most likely present?

   • ACross-site request forgery (CSRF), because the URL is rendered as a hyperlink.
   • BInsecure deserialization, because the URL is stored and retrieved.
   • CSQL injection, because the URL is stored in a database.
   • DCross-site scripting (XSS), because user input is rendered without proper encoding.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A .NET web application requires users to upload documents for processing. The current implementation allows any file type and stores files in a public folder. The business wants to keep the upload process simple for users, but the security team wants to reduce the risk of malicious file uploads. Which solution best balances usability and security?

   • AValidate file content and extension against an allowed list, store files outside the web root, and serve them with a content-disposition header.
   • BRename all uploaded files to a random name and store them in the web root.
   • CAllow only image files and reject all other file types.
   • DAllow any file type but store files in a database instead of the file system.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An e-commerce application originally accepted orders via a single web form. Over time, the company added a REST API for mobile clients, a partner integration webhook, and an admin panel. After a security incident, the team wants to identify all possible entry points an attacker could use. What is the most appropriate first step?

   • AImmediately patch all third-party libraries to the latest versions
   • BConduct a threat modeling exercise to map the expanded attack surface
   • CDisable the partner integration webhook to reduce functionality
   • DReview the code for insecure coding practices
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A development team is about to start a new .NET web application. The project manager wants to ensure security is considered from the beginning. Which approach best reduces the introduction of vulnerabilities during the software development lifecycle?

   • AConduct a single penetration test just before the production release.
   • BRely on the .NET framework's built-in security features and apply the latest patches after deployment.
   • CPerform threat modeling during the design phase and conduct security code reviews before each release.
   • DUse automated security scanning tools during the coding phase only.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which example represents a vulnerability introduced during the design phase?

   • AUsing a SQL query with string concatenation in the code
   • BNot running security tests before release
   • CLeaving default credentials in the production server
   • DFailing to include authentication in the application architecture
   Reveal Solution Discussion Select an answer first