Common Application Security Risks and OWASP Top 10 DSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A developer is building a file upload feature for a document management system. The system stores files on disk and later serves them to authenticated users. The developer wants to prevent an attacker from uploading a malicious executable that could be run on the server. Which combination of controls is most effective?

   • ACheck the MIME type from the HTTP header and store files in the web root.
   • BCheck the file extension against a whitelist and store files outside the web root.
   • CRename the file to a random name and store it in the web root.
   • DUse a blacklist of dangerous extensions and store files in a database.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is developing a web application that uses a SQL database. The development team is considering two approaches to prevent SQL injection: (1) use parameterized queries, and (2) use an ORM (Object-Relational Mapping) framework. The team is concerned that parameterized queries are too verbose and ORM might hide complex queries. Which approach is more secure and why?

   • AUse parameterized queries because they are the only way to prevent SQL injection
   • BUse an ORM because it is always more secure than parameterized queries
   • CUse an ORM because it automatically prevents all SQL injection
   • DUse parameterized queries for all database operations because they separate data from code
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company's web application allows users to reset their passwords by answering security questions. During a penetration test, the tester discovers that the application reveals whether a username exists during the reset process, and that the security questions have a limited set of possible answers (e.g., 'What is your favorite color?'). Which OWASP Top 10 category is most directly exploited, and what is the best remediation?

   • ASensitive Data Exposure; encrypt the security questions in the database.
   • BInjection; parameterize the SQL query used to check security answers.
   • CSecurity Misconfiguration; disable error messages that reveal user existence.
   • DBroken Authentication; implement multi-factor authentication and remove security questions.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which statement best describes the scope of the OWASP Top 10?

   • AIt covers all possible security vulnerabilities in any software system.
   • BIt is a detailed penetration testing methodology.
   • CIt is a legal compliance standard required for all public-facing websites.
   • DIt focuses on the most critical security risks to web applications.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security manager is introducing OWASP Top 10 to a development team that has never used it. The manager wants to set realistic expectations about what the list provides. Which statement accurately describes the purpose and scope of the OWASP Top 10?

   • AIt is a ranking of the most common and impactful web application security risks, based on community data
   • BIt is a comprehensive standard that certifies an application as secure if all items are addressed
   • CIt is a detailed penetration testing methodology that replaces manual testing
   • DIt is a legal requirement that all web applications must comply with to operate
   Reveal Solution Discussion Select an answer first