Application Security CCISO Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A developer is writing a web form that accepts a user's name and later displays it on a confirmation page. The application uses a modern framework with automatic output encoding. Which additional control is most important to prevent stored XSS?

   • AStore the input in a database without any transformation and rely solely on the framework's output encoding.
   • BUse a content security policy (CSP) header that allows inline scripts from the same origin.
   • CDisable JavaScript in the user's browser to prevent script execution.
   • DValidate the input on the server side to allow only letters, spaces, and hyphens, and reject other characters.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security architect is leading a threat modeling exercise for a new online payment application. The team has limited time and must prioritize which threats to address. The application will handle credit card data and is subject to PCI DSS. The team has identified several threats, including SQL injection, cross-site scripting, insecure deserialization, and business logic flaws. Which threat should be prioritized first, considering both likelihood and impact?

   • ASQL injection, because it could lead to full database compromise and theft of cardholder data.
   • BInsecure deserialization, because it can lead to remote code execution.
   • CCross-site scripting, because it affects all users and is easy to exploit.
   • DBusiness logic flaws, because they are hard to detect with automated tools.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A mobile app for a retail loyalty program stores the user's loyalty points balance and personal profile data on the device. The app also communicates with a backend server over HTTPS. A security review found that the app's local database is unencrypted and that the app uses a custom encryption scheme for network traffic instead of TLS. Which two issues must be fixed?

   • AUse a hash of the loyalty points balance and keep the custom encryption for network traffic.
   • BStore the profile data in the cloud and use a VPN for all network traffic.
   • CDisable the local database and rely on the server to store all data, using HTTP for simplicity.
   • DEncrypt the local database and replace the custom encryption with TLS for network communication.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary defense against Cross-Site Scripting (XSS) attacks?

   • AInput validation
   • BOutput encoding
   • CUsing HTTPS
   • DDisabling JavaScript in the browser
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary goal of the containment phase in application incident response?

   • ATo collect evidence for legal proceedings
   • BTo identify the root cause of the incident
   • CTo restore the application to normal operation
   • DTo limit the damage and prevent the incident from spreading further
   Reveal Solution Discussion Select an answer first