Common Application Security Risks and OWASP Top 10 DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is reviewing a web application that uses a captcha to prevent automated submissions. The captcha is implemented client-side and the server does not validate the captcha response. An attacker bypasses the captcha and floods the server with requests. Which OWASP Top 10 category is most relevant, and what is the best mitigation?

   • ASecurity Misconfiguration; enable server-side captcha validation
   • BSensitive Data Exposure; encrypt the captcha response in transit
   • CBroken Access Control; restrict the number of requests per IP address
   • DInjection; sanitize the captcha response to prevent SQL injection
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is developing a REST API that returns JSON responses. The API uses API keys for authentication. The security team discovers that the API keys are hardcoded in the client-side JavaScript code. Which OWASP Top 10 risk is most directly demonstrated, and what is the best mitigation?

   • ASensitive Data Exposure; rotate the API keys regularly
   • BBroken Access Control; restrict API key permissions to the minimum required
   • CSensitive Data Exposure; move the API key to a server-side proxy or backend service
   • DInjection; validate the API key format to prevent injection attacks
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A developer is reviewing code for an e-commerce application. The code builds a SQL query by concatenating a user-supplied product ID directly into the WHERE clause. The application is deployed behind a Web Application Firewall (WAF) that blocks common SQL injection patterns. The developer wants to fix the root cause. What is the most appropriate action?

   • AUse parameterized queries or prepared statements for all database access.
   • BRely on the WAF to block all SQL injection attempts.
   • CEncode the product ID using HTML entity encoding before using it in the query.
   • DSanitize the product ID by removing single quotes and semicolons.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A web application allows users to view their own profile and edit it. A tester discovers that by changing the 'user_id' parameter in the URL, they can view and edit other users' profiles. Which OWASP Top 10 category does this vulnerability belong to, and what is the primary mitigation?

   • ABroken Access Control; implement server-side authorization checks for every request
   • BSecurity Misconfiguration; disable URL parameter manipulation in the web server
   • CInjection; sanitize the 'user_id' parameter to prevent SQL injection
   • DSensitive Data Exposure; encrypt the 'user_id' parameter in transit
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A development team is building a customer portal that allows users to upload profile pictures. The portal stores the images in Azure Blob Storage and serves them directly to other users via public URLs. During a security review, the team discovers that an attacker could upload a file containing malicious script that executes when another user views the image. Which OWASP Top 10 category does this vulnerability primarily fall under, and what is the most effective mitigation?

   • ACross-Site Scripting (XSS); validate file type and content, and serve images with a Content-Disposition header or from a separate domain.
   • BBroken Access Control; require authentication for all image URLs.
   • CInjection; sanitize the filename before storing it in the database.
   • DSecurity Misconfiguration; disable directory browsing on the storage account.
   Reveal Solution Discussion Select an answer first