Application Security CCT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A development team is about to release a web application. They want to identify vulnerabilities in the source code before deployment, focusing on issues like SQL injection and insecure deserialization. Which testing method should they use?

   • APenetration testing
   • BDynamic Application Security Testing (DAST)
   • CStatic Application Security Testing (SAST)
   • DRuntime application self-protection (RASP)
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A retail company's web application allows customers to search products by entering a keyword in a URL parameter. A penetration test reveals that an attacker can modify the parameter to `' OR '1'='1` and retrieve all customer records from the database. The development team is asked to remediate this immediately. Which combination of controls should be prioritized?

   • AUse parameterized queries and add a Web Application Firewall (WAF) rule to block common SQL injection patterns.
   • BDisable error messages and restrict database account permissions to read-only.
   • CEncode all output and enable HTTPS on the application server.
   • DImplement role-based access control and enforce strong password policies for all users.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which application security threat is characterized by an attacker guessing or obtaining valid credentials to impersonate a legitimate user?

   • ASecurity misconfiguration
   • BSensitive data exposure
   • CCross-site scripting (XSS)
   • DBroken authentication
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is designing a public API that will be used by mobile clients. The API handles sensitive user data. The security team wants to ensure that each request is authenticated and that users can only access their own data. They also want to avoid storing long-lived secrets on the mobile device. Which authentication approach is BEST?

   • AUse a single shared API key embedded in the mobile app.
   • BUse a long-lived API key stored in the device's secure storage.
   • CUse HTTP Basic authentication with the user's password sent on every request.
   • DUse OAuth 2.0 with short-lived access tokens and refresh tokens, and implement object-level authorization checks on the API.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which secure coding practice is most effective in preventing SQL injection vulnerabilities?

   • AUsing parameterized queries or prepared statements
   • BEncoding all user input with HTML entities
   • CUsing client-side validation only
   • DDisabling error messages in the application
   Reveal Solution Discussion Select an answer first