Application Security CCT Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company is deploying a new customer portal. The security team requires that passwords be stored in a way that resists brute-force and rainbow-table attacks, and that session tokens be invalidated after logout. Which combination of practices meets these requirements?

   • AStore salted hashes using a slow key-derivation function and clear the session cookie on logout
   • BStore passwords in plaintext for recovery and set short session expiration
   • CUse MD5 with a global salt and delete the session record from the database
   • DEncrypt passwords with AES-256 and rely on the session timeout
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A healthcare portal allows users to view their own lab results. A security analyst discovers that by changing the `patientId` value in the URL from `1001` to `1002`, an authenticated user can view another patient's results. The application uses session cookies for authentication but does not check whether the logged-in user owns the requested record. Which control should be implemented to fix this vulnerability?

   • ARequire users to re-authenticate with multi-factor authentication before viewing any lab results.
   • BEncrypt the `patientId` parameter using a symmetric cipher so users cannot guess other IDs.
   • CUse a Web Application Firewall to block requests that contain a `patientId` different from the session user's ID.
   • DAdd an object-level authorization check that verifies the logged-in user's ID matches the `patientId` in the request.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the first step in responding to a suspected application security incident?

   • AEradicate the root cause of the incident
   • BRecover systems to normal operation
   • CDetect and confirm that an incident has occurred
   • DContain the incident to prevent further damage
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   An organization's web application was defaced. The incident response team is investigating. They need to determine the attack vector and prevent recurrence. Which sequence of actions is most appropriate?

   • AChange all passwords and assume the incident is over
   • BTake the server offline and reinstall the OS without analysis
   • CPreserve evidence, analyze logs, identify the vulnerability, patch, and monitor
   • DImmediately restore from backup and ignore logs
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A developer is building a mobile app that calls a backend API. The API uses API keys for authentication. The developer notices that the API key is embedded in the mobile app's source code. What is the best practice to secure the API key?

   • AObfuscate the API key in the source code
   • BMove the API key to a server-side proxy and have the app call the proxy
   • CEncrypt the API key in the app's storage
   • DUse a stronger API key with more characters
   Reveal Solution Discussion Select an answer first