Application Security CCT Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A company is deploying a web application to a cloud environment. The application stores sensitive data and must comply with a regulation that requires data to be encrypted at rest. The security team must choose a key management strategy. They want to minimize the risk of key compromise while maintaining the ability to revoke keys quickly if a breach occurs. Which approach is BEST?

   • AUse a cloud provider's managed key management service (KMS) with automatic key rotation and enable key revocation.
   • BEncrypt the data with a key derived from the user's password.
   • CStore encryption keys in the application's source code repository for easy access.
   • DUse a single static key that never rotates to simplify management.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A system administrator is deploying a new web application to a production server. The application stores sensitive customer data and uses a configuration file with database credentials. Which deployment practice is most secure?

   • AStore the configuration file outside the web root and set strict file permissions so only the application service account can read it.
   • BEmbed the database credentials directly in the application source code for simplicity.
   • CSet the configuration file permissions to world-readable so the web server can always read it.
   • DPlace the configuration file in the web root but rename it to `config.php.bak` to hide it.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is it important to consider application security early in the software development lifecycle (SDLC)?

   • ATo eliminate the need for security testing during the later stages of the SDLC
   • BTo satisfy the requirement that all code must be reviewed by a security expert before any development begins
   • CTo reduce the cost and effort required to fix security issues after deployment
   • DTo ensure that the application is completely immune to all future attacks
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A company uses a Web Application Firewall (WAF) to protect its web application. The WAF is currently blocking a legitimate user who is submitting a form with a text field that contains the string `' OR 1=1 --`. The user is a researcher entering a mathematical expression. The security team wants to allow this legitimate request while still blocking SQL injection attempts. What is the BEST approach?

   • ABlock all requests from the user's IP address to prevent further issues.
   • BAsk the user to encode the input as HTML entities before submitting.
   • CCreate a WAF rule that allows this specific request by matching the exact context (e.g., the form field and the user's session) while keeping the general SQL injection rule enabled.
   • DDisable the SQL injection rule entirely to avoid blocking legitimate users.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A developer is fixing a cross-site scripting (XSS) vulnerability. The application reflects user input in a JavaScript context within an HTML page. Which encoding practice is most appropriate?

   • AUse HTML entity encoding only
   • BRemove all quotes from user input
   • CEncode input before storing it in the database
   • DUse JavaScript context-aware output encoding
   Reveal Solution Discussion Select an answer first