Application Security CCT Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company has a public-facing web application protected by a WAF. The WAF is blocking legitimate users because of false positives. The security team needs to reduce false positives without weakening security. Which action is most effective?

   • ATune the WAF rules to allow specific legitimate traffic patterns
   • BMove the application to a different IP address
   • CDisable the WAF entirely
   • DIncrease the WAF's sensitivity to block more traffic
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following best describes an SQL injection attack?

   • AAn attacker sends malicious SQL code in user input that is executed by the database
   • BAn attacker tricks a user into revealing their password through a fake login page
   • CAn attacker floods the application with traffic to cause a denial of service
   • DAn attacker intercepts network traffic to steal session cookies
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   After an application security incident has been contained and eradicated, what is the next step in the incident response process?

   • ARecover the application and restore normal operations
   • BDisconnect the application from the network permanently
   • CNotify the public about the incident before internal review
   • DImmediately delete all logs related to the incident
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company deploys a Web Application Firewall (WAF) in front of its public-facing web application. The security team wants to reduce false positives while still blocking common attacks. Which WAF configuration approach is most effective?

   • AEnable all default rules in prevention mode immediately to maximize security.
   • BDisable the WAF and rely on the application's built-in input validation.
   • CUse only IP-based blocking rules to stop attackers.
   • DStart in detection mode, review logs to tune rules, then switch to prevention mode for confirmed attack patterns.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company exposes a REST API for partners to retrieve order status. The API uses API keys passed in the URL query string. A security review finds that the keys are logged by the web server and can be leaked via browser history and referrer headers. Which change should be made to improve API security?

   • ARequire the API key to be sent in the `Authorization` header over HTTPS.
   • BKeep the API key in the query string but add a short expiration timestamp.
   • CUse HTTP Basic authentication with the API key as the username.
   • DSwitch to a shared secret embedded in the client-side JavaScript code.
   Reveal Solution Discussion Select an answer first