Common Application Security Risks and OWASP Top 10 DSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of the OWASP Top 10 list?

   • ATo certify web applications as secure after passing a security review
   • BTo replace the need for penetration testing in web applications
   • CTo provide a comprehensive security standard for all software development processes
   • DTo list the most critical security risks to web applications based on broad industry data
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A web application stores user passwords in plain text in its database. Which common application security risk does this behavior exemplify?

   • ACross-site scripting
   • BInsecure deserialization
   • CBroken access control
   • DSensitive data exposure
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security auditor is reviewing a web application that uses session cookies. The auditor finds that the session cookie does not have the Secure flag set, and the application is accessible over both HTTP and HTTPS. The auditor also notes that the session timeout is set to 24 hours. Which combination of changes best reduces the risk of session hijacking?

   • ADisable HTTP access entirely and keep the session timeout at 24 hours
   • BUse a longer session token and rely on the browser's security features
   • CSet the HttpOnly flag and keep the session timeout at 24 hours
   • DSet the Secure flag on the cookie and reduce the session timeout to 30 minutes
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A developer is writing a function that logs user activity. The log message includes the username and the action performed. The username is provided by the user and is not sanitized. An attacker submits a username containing a malicious script. When an admin views the logs, the script executes in the admin's browser. Which OWASP Top 10 category does this represent, and what is the best fix?

   • ABroken Access Control; restrict admin access to logs
   • BXSS; encode or sanitize user input before logging and when displaying logs
   • CSensitive Data Exposure; encrypt the log files
   • DInjection; use parameterized logging to prevent log injection
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A team is developing a REST API that returns JSON responses. The API includes user profile data, and the team wants to prevent sensitive data exposure. Which approach is most aligned with OWASP Top 10 guidance?

   • AUse HTTPS for all communications and ensure that the API returns only the minimum necessary fields.
   • BRely on the client to redact sensitive fields before displaying them.
   • CDisable caching headers to prevent sensitive data from being stored in browser caches.
   • DEncrypt the JSON payload using a custom encryption algorithm before sending it.
   Reveal Solution Discussion Select an answer first