Common Application Security Risks and OWASP Top 10 DSE Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   A security team is introducing a new application security program. They plan to use the OWASP Top 10 as the basis for their secure coding standards and training. Which statement best describes the appropriate use of the OWASP Top 10 in this context?

   • AIt is a compliance framework that, if followed, guarantees a secure application.
   • BIt is a comprehensive standard that covers all possible web application vulnerabilities, so no other testing is needed.
   • CIt is an awareness document that highlights the most critical risks, and it should be used as a baseline for training and testing, supplemented with other standards.
   • DIt is a static list that rarely changes, so it can be used as a permanent checklist.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A developer is implementing a login form. The current code uses a simple comparison of the username and password against a database. The security team wants to implement multi-factor authentication (MFA) to reduce the risk of credential stuffing. However, the product owner is concerned that MFA will reduce user adoption. Which approach best balances security and usability?

   • AUse a CAPTCHA instead of MFA to prevent automated attacks
   • BDo not implement MFA because the risk of credential stuffing is low
   • CImplement MFA only for administrative accounts and high-risk transactions
   • DImplement MFA for all users immediately, regardless of adoption concerns
   Reveal Solution Discussion Select an answer first