Common Application Security Risks and OWASP Top 10 DSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is developing a new web application and wants to ensure that it is secure from the start. The team is considering using the OWASP Top 10 as a guide. Which approach best applies the OWASP Top 10 during the development lifecycle?

   • ARely on automated tools to automatically fix all OWASP Top 10 vulnerabilities without developer involvement.
   • BWait for the application to be deployed and then run a penetration test to identify OWASP Top 10 issues.
   • CIncorporate OWASP Top 10 risk categories into threat modeling, secure coding standards, and testing activities at each phase.
   • DUse the OWASP Top 10 as a checklist only during the final security review.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security engineer is reviewing a web application that allows users to upload and share documents. The application uses a third-party file storage service. The engineer discovers that the application does not validate the file content, only the file extension. An attacker uploads a file with a .txt extension but containing malicious HTML. When other users download and open the file, the script executes in their browser. Which OWASP Top 10 risk is most directly demonstrated, and what is the best mitigation?

   • AXSS; validate the file content and set the Content-Disposition header to attachment
   • BBroken Access Control; restrict file downloads to authenticated users only
   • CInjection; sanitize the file name to prevent path traversal
   • DSecurity Misconfiguration; disable file uploads entirely
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is migrating a legacy web application to the cloud. The application currently stores user passwords using MD5 hashes. The security team wants to remediate this before the migration. The team has limited budget and must minimize downtime. Which approach best balances security and operational constraints?

   • AImmediately switch to bcrypt for all new passwords and force a password reset for all users.
   • BMigrate to a modern hashing algorithm like bcrypt and rehash passwords on next login.
   • CUse a reversible encryption algorithm to store passwords so they can be decrypted if needed.
   • DContinue using MD5 but add a global salt to all hashes.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   During a code review, a developer notices that a web application constructs SQL queries by directly concatenating user input into the query string. Which common application security risk does this practice most directly introduce?

   • AInjection
   • BSecurity misconfiguration
   • CSensitive data exposure
   • DBroken authentication
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer is building a customer feedback form that stores comments in a SQL database. The form accepts free-text input and the developer concatenates the input directly into a SQL query. During a security review, a colleague points out that this pattern is listed in the OWASP Top 10. Which OWASP Top 10 category does this vulnerability belong to, and what is the most effective mitigation?

   • ASensitive Data Exposure; encrypt the database at rest
   • BSecurity Misconfiguration; enable verbose error messages to see the exact query structure
   • CBroken Access Control; restrict database permissions to read-only
   • DInjection; use parameterized queries or prepared statements
   Reveal Solution Discussion Select an answer first