Secure Coding Practices CSE Practice Questions (Page 12)

Questions 56–60

1. 56application · medium

   A web application's error handling currently returns detailed stack traces to users and logs full SQL queries. The security team wants to reduce information disclosure while still enabling debugging in a development environment. What should the team implement?

   • ADisplay the stack trace only to users with an admin role and log all errors to the application's standard output.
   • BReturn generic error messages to users and log detailed errors only in a secure logging system with access restricted to authorized personnel.
   • CLog full SQL queries and user input to a centralized log for easier debugging.
   • DDisable all error logging in production and rely on the cloud provider's monitoring service.
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   What is the purpose of a software composition analysis (SCA) tool?

   • ATo test the application's user interface
   • BTo identify known vulnerabilities in open-source components and dependencies
   • CTo encrypt the application's source code
   • DTo compile the application into an executable
   Reveal Solution Discussion Select an answer first
4. 58foundation · easy

   Why is it important to regularly update third-party libraries and dependencies?

   • ATo increase the size of the application package
   • BTo make the application compatible with older operating systems
   • CTo remove all functionality from the libraries
   • DTo patch known security vulnerabilities in the libraries
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A team is designing a new microservices-based application that handles financial transactions. During the design phase, they want to identify potential threats and prioritize security controls. Which activity should they perform first?

   • ACreate a data flow diagram and identify trust boundaries, then use a threat modeling methodology like STRIDE to enumerate threats.
   • BImplement input validation on all microservices before writing any other code.
   • CSet up a bug bounty program to find vulnerabilities after release.
   • DDeploy the application to a staging environment and run a vulnerability scanner.
   Reveal Solution Discussion Select an answer first
6. 60application · medium

   A development team is about to merge a new feature that accepts file uploads from users. The team has a limited budget and wants to catch security issues before deployment. Which approach should they prioritize?

   • AUse a static analysis tool and ignore the results if the tool reports no critical issues.
   • BConduct a manual code review focused on file upload handling, including validation of file type and content.
   • CDeploy to production and monitor for anomalies using a security information and event management (SIEM) system.
   • DRun a dynamic application security test (DAST) against the staging environment only.
   Reveal Solution Discussion Select an answer first