Secure Coding Practices CSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of integrating security into the requirements phase of the SDLC?

   • ADeploying the application to production
   • BWriting user documentation
   • CDefining security requirements such as authentication and data protection
   • DPerforming penetration testing on the final product
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is reviewing the logging configuration of a cloud application. They notice that the application logs full request bodies, which may contain sensitive personal data. They want to maintain auditability without exposing sensitive data. Which approach should they take?

   • AEncrypt the logs and store them in a public cloud storage bucket.
   • BStop logging request bodies entirely to avoid storing sensitive data.
   • CLog only error messages and discard all other logs.
   • DImplement structured logging that redacts sensitive fields before writing logs, and restrict access to logs to authorized personnel.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company runs a multi-tenant SaaS application. Users authenticate via SAML SSO. The application uses a shared session store. Recently, a user reported that after logging out, they could still access resources by reusing an old session token. The security team suspects that logout does not invalidate the session server-side. The team must fix this without forcing all users to re-authenticate immediately. What should they do?

   • AChange the session token format to include a timestamp and validate it on each request.
   • BDisable session reuse by requiring re-authentication for every request.
   • CImplement server-side session invalidation on logout and set a short absolute session timeout.
   • DRely on the SAML IdP to terminate the session and clear the local session cookie.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A cloud-based SaaS application uses session cookies for authentication. After a penetration test, the security team finds that session tokens are predictable and that users can access other users' data by modifying a numeric ID in the URL. Which set of changes should the team implement?

   • AUse a longer numeric ID for sessions and validate that the ID is a positive integer.
   • BUse a cryptographically random session token, set the Secure and HttpOnly flags, and enforce authorization checks on every data access.
   • CRegenerate the session ID on every request and log all URL parameters.
   • DEncrypt the session cookie with AES-256 and store the user ID in the cookie.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which cryptographic practice is most appropriate for storing passwords securely?

   • AUsing a strong one-way hashing algorithm with a unique salt
   • BStoring passwords in plaintext for simplicity
   • CUsing a weak hash like MD5 without a salt
   • DEncrypting passwords with a reversible encryption algorithm
   Reveal Solution Discussion Select an answer first