Secure Coding Practices CSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a common output of a threat modeling exercise?

   • AA marketing plan for the application
   • BA list of potential threats and corresponding mitigations
   • CA compiled binary of the application
   • DA set of performance benchmarks
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company's cloud application logs all user actions, but the logs contain sensitive data such as credit card numbers and passwords. The security team must reduce the risk of data exposure in logs while maintaining the ability to audit user actions. What should they do?

   • AStop logging user actions entirely to avoid storing sensitive data.
   • BStore logs in a separate database with stronger encryption and no other changes.
   • CImplement logging filters to redact sensitive fields and ensure logs are encrypted at rest and access is restricted.
   • DMask the logs only for non-admin users and show full logs to administrators.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company is adopting a secure development lifecycle (SDL) for a new cloud application. They want to ensure that security is integrated without slowing down the development process. Which approach is most effective?

   • AAutomate security checks (such as SAST and dependency scanning) in the CI/CD pipeline and conduct manual reviews for high-risk changes.
   • BUse a single security tool that covers all aspects of security testing.
   • CRequire a full manual security review of every code change before merging.
   • DPerform security testing only at the end of the development cycle.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the difference between static and dynamic application security testing?

   • AStatic testing only finds SQL injection, while dynamic testing only finds XSS
   • BStatic testing analyzes source code without executing it, while dynamic testing analyzes the running application
   • CStatic testing is performed by automated tools, while dynamic testing is always manual
   • DStatic testing is used for cloud applications, while dynamic testing is used for on-premises applications
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a core component of secure authentication and session management?

   • AUsing strong password hashing and enforcing session timeouts
   • BStoring session tokens in the URL for easy retrieval
   • CDisabling session expiration to improve user experience
   • DUsing the same session ID for all users to simplify management
   Reveal Solution Discussion Select an answer first