Application Security CCT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization's web application uses session cookies for authentication. A security audit reveals that the session ID is predictable and that the cookie is not marked with the `Secure` or `HttpOnly` attributes. Which combination of changes should be made to harden the session management?

   • AEncrypt the session ID with a static key and send it in a custom header.
   • BGenerate session IDs using a cryptographically secure random number generator and set the `Secure` and `HttpOnly` flags on the cookie.
   • CUse a longer session timeout and allow session IDs to be reused after logout.
   • DStore the session ID in a URL parameter instead of a cookie.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer is writing a web form that accepts user comments and displays them on a public page. The application currently inserts the raw user input directly into the HTML. A security tester finds that a user can submit `<script>alert(document.cookie)</script>` and it executes in other users' browsers. Which secure coding practice should the developer apply?

   • ADisable JavaScript in the users' browsers via a response header.
   • BUse a parameterized query to store the comment in the database.
   • CEncode the user input before inserting it into the HTML response.
   • DAdd a Web Application Firewall rule to block any request containing `<script>`.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of output encoding in secure coding?

   • ATo convert user input into a format that is safe to display in the application's output context
   • BTo encrypt data before storing it in the database
   • CTo compress data to reduce bandwidth usage
   • DTo validate that user input matches a specific format
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A system administrator is deploying a web application to a production server. The application stores sensitive user data. Which configuration practice is most important to reduce the risk of data exposure?

   • ASet the server's time zone correctly
   • BDisable directory browsing on the web server
   • CEnable HTTPS with a valid certificate and HSTS
   • DUse a custom error page that hides stack traces
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A development team is fixing a stored XSS vulnerability in a web application. The application allows users to submit rich text (including HTML) that is rendered to other users. The team must preserve the rich text functionality while preventing script execution. Which approach is most secure?

   • AEncode all HTML input so that it displays as plain text.
   • BAllow a strict whitelist of HTML tags and attributes, and sanitize all input server-side before storing it.
   • CUse a Web Application Firewall to block any request containing `<script>`.
   • DDisable JavaScript in the browser using a Content Security Policy (CSP) header.
   Reveal Solution Discussion Select an answer first