Secure Coding Practices CSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is conducting a code review of a web application. The application uses a JavaScript framework that automatically escapes output. The team finds that the application uses a function that inserts user input directly into an HTML attribute without escaping. What is the most appropriate recommendation?

   • ARely on the framework's automatic escaping, since it covers all contexts.
   • BDisable the framework's auto-escaping and implement manual encoding for all output.
   • CUse the framework's built-in output encoding for the attribute context and avoid direct DOM manipulation with user input.
   • DAdd a Content Security Policy (CSP) to mitigate any potential XSS.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A team is designing a new cloud-based file-sharing application. They want to identify potential threats early in the development process to guide secure design decisions. Which activity should they perform?

   • AWait until the application is deployed and then run a vulnerability scanner.
   • BPurchase a web application firewall (WAF) to protect the application.
   • CConduct a threat modeling session using a structured methodology like STRIDE.
   • DAsk the development team to write secure code based on their experience.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is migrating a legacy application to the cloud. The application uses session-based authentication with a 24-hour timeout. The security team wants to reduce the risk of session hijacking while minimizing user disruption. Which change should they implement?

   • AUse a longer session timeout but require multi-factor authentication (MFA) only on login.
   • BStore session tokens in local storage instead of cookies to prevent cross-site scripting from stealing them.
   • CImplement sliding session expiration that requires re-authentication after 30 minutes of inactivity, but keep the absolute timeout at 24 hours.
   • DReduce the absolute session timeout to 15 minutes for all users.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is adopting a DevSecOps model. The security team wants to integrate security into the CI/CD pipeline without slowing down development. Which approach best balances security and speed?

   • AUse a third-party security team to perform penetration testing after each release.
   • BRequire a full manual code review for every commit, regardless of size.
   • CRun automated SAST and dependency scanning on every commit, and require manual code review for high-risk changes only.
   • DRun all security tests only on the final release candidate to avoid slowing down development.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company stores customer PII in a cloud database. The application encrypts data in transit using TLS, but the security team is concerned about data at rest. The database service supports transparent data encryption (TDE) with service-managed keys. The compliance team requires that the company control the encryption keys. What should the application team do?

   • AEncrypt the database files manually using a custom encryption library before storing them.
   • BUse application-level encryption for all PII fields and store the encryption key in the application configuration.
   • CEnable TDE with customer-managed keys stored in a cloud KMS and restrict access to the key via IAM policies.
   • DEnable TDE with service-managed keys and rely on the cloud provider's security guarantees.
   Reveal Solution Discussion Select an answer first