Secure Coding Practices CSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A team is designing a cloud-based healthcare application that will store patient records. They need to comply with data protection regulations and want to identify potential threats to patient data. Which threat modeling approach is most effective?

   • AUse a data-centric threat model that focuses on the flow of patient data through the system, identifying where data is stored, processed, and transmitted.
   • BUse a network-centric threat model that focuses on firewall rules and network segmentation.
   • CUse a generic threat model template without customization.
   • DWait until the application is built and then perform a penetration test.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A team is developing a REST API that accepts JSON payloads. The API is used by a mobile app and a web dashboard. The security team found that the API is vulnerable to SQL injection via a search parameter. The team wants to fix it without changing the API contract. Which remediation is most effective?

   • AUse parameterized queries for all database operations that incorporate user input.
   • BEscape single quotes in the search parameter before including it in the SQL query.
   • CUse a stored procedure that dynamically builds the SQL query.
   • DValidate the search parameter against a whitelist of allowed characters.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the main goal of output encoding in a web application?

   • ATo validate that the output data is correct
   • BTo ensure that data is displayed safely in the browser without being interpreted as code
   • CTo encrypt data in transit between the server and client
   • DTo compress data before sending it to the client
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is migrating a legacy application to the cloud. The application stores user passwords using MD5 hashes. The security team wants to improve password storage. The application must remain compatible with existing user accounts. What is the best approach?

   • AForce all users to reset their passwords immediately and store new passwords using bcrypt.
   • BReplace MD5 with SHA-256 for all passwords and rehash existing hashes immediately.
   • CStore new passwords using bcrypt and migrate existing MD5 hashes by rehashing them with bcrypt on next successful login.
   • DEncrypt the MD5 hashes with AES-256 and store the encryption key in the database.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A web application stores user passwords in a cloud database. The security team wants to ensure that even if the database is compromised, passwords cannot be easily reversed. Which practice should the team adopt?

   • AStore passwords in a separate cloud vault and only reference them by an ID.
   • BHash passwords with SHA-256 and store the hash in the database.
   • CUse a slow, salted hashing algorithm such as bcrypt or Argon2 for each password.
   • DEncrypt passwords with AES-256 using a static key stored in the application configuration.
   Reveal Solution Discussion Select an answer first