Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SAST scan has identified several vulnerabilities in a codebase. The team has limited development resources. Which vulnerabilities should be fixed first?

   • AVulnerabilities that are easy to fix, regardless of severity.
   • BVulnerabilities in third-party dependencies, because they are easier to fix.
   • CAll high-severity vulnerabilities, regardless of exploitability or impact.
   • DVulnerabilities that are remotely exploitable and affect sensitive data, even if they are classified as medium severity.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SAST scan identifies several vulnerabilities in a codebase: a SQL injection in a login form, a hardcoded API key, and a minor information disclosure in an error message. The team has limited time before the next release. What is the correct prioritization?

   • AFix the information disclosure first because it is the easiest to fix.
   • BFix the hardcoded API key first because it is the most visible in the code.
   • CDefer all fixes to the next release because the current release is feature-focused.
   • DFix the SQL injection first, then the hardcoded API key, and finally the information disclosure.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization wants to enforce secure coding standards across multiple development teams. They have different programming languages and frameworks. What is the most effective way to implement this?

   • ARequire all teams to use the same programming language and framework.
   • BLet each team define its own security standards based on their preferences.
   • CCreate a centralized set of secure coding guidelines and integrate automated linters and SAST tools into each team's CI pipeline.
   • DProvide a one-time training session on secure coding and rely on developers to remember it.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security audit reveals that the application logs full credit card numbers in plain text. The team must comply with PCI DSS and reduce the risk of data breaches. What is the best remediation?

   • ARemove all logging from the application to avoid storing sensitive data.
   • BEncrypt the log file with a strong encryption algorithm.
   • CMask the credit card number in logs, showing only the last four digits, and ensure that logs are stored in a secure, access-controlled location.
   • DLog the full card number but restrict access to the log file to a small group of developers.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   During a security code review, a reviewer finds that a developer has used a blacklist-based input validation approach. The reviewer recommends switching to a whitelist approach. Why is this recommendation valid?

   • AWhitelist validation is faster than blacklist validation.
   • BWhitelist validation is easier to implement than blacklist validation.
   • CBlacklist validation is deprecated by OWASP.
   • DWhitelist validation is more secure because it allows only known-good input, reducing the risk of bypasses.
   Reveal Solution Discussion Select an answer first