Application Security CCISO Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A development team wants to automate security checks in their CI/CD pipeline. They currently have a SAST tool that runs on every commit. What additional step should they add to ensure that security testing is not bypassed?

   • AAllow developers to suppress SAST findings without review.
   • BRun SAST only on release branches, not on feature branches.
   • CStore SAST reports in a shared folder without any action.
   • DMake the pipeline fail if the SAST tool reports any critical or high-severity vulnerability.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the primary purpose of hashing a password before storing it in a database?

   • ATo protect the password from being read if the database is compromised
   • BTo speed up the authentication process
   • CTo encrypt the password so it can be decrypted later
   • DTo ensure the password can be recovered if the user forgets it
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following is listed in the OWASP Top 10 as a critical web application security risk?

   • ACross-Site Request Forgery (CSRF)
   • BBuffer overflow
   • CDenial of Service (DoS)
   • DInjection
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A public API allows users to retrieve their own profile data. A security review finds that the API does not validate that the authenticated user owns the requested resource. Which vulnerability is this, and what is the best fix?

   • ASecurity Misconfiguration — enable verbose error messages to help debug.
   • BInsufficient Logging & Monitoring — add more logs to detect unauthorized access.
   • CBroken Object Level Authorization (BOLA) — enforce ownership checks in the API logic for every resource request.
   • DBroken Authentication — require stronger passwords for all users.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A web application allows users to post comments that are displayed to other users. A penetration test revealed that a user can submit a comment containing JavaScript that executes in other users' browsers. The application uses a framework that automatically encodes output, but the development team has disabled this feature in some places for performance reasons. What is the most effective control to prevent this vulnerability?

   • ASet the 'X-XSS-Protection' header to '1; mode=block' in the web server configuration.
   • BRe-enable automatic output encoding in the framework and apply context-aware encoding for all user-generated content.
   • CAdd a Web Application Firewall (WAF) rule to block any request containing the string '<script>'.
   • DSanitize the comment by removing all HTML tags before storing it in the database.
   Reveal Solution Discussion Select an answer first