Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A developer needs to encrypt sensitive data before storing it in a database. Which approach is most secure?

   • AUse the DES algorithm with a 56-bit key.
   • BUse base64 encoding to obscure the data.
   • CUse a custom encryption algorithm developed by the team.
   • DUse a well-established encryption algorithm like AES-256 with a securely managed key.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A developer is writing logging code for a web application. They want to log security-relevant events, such as login failures. Which practice is most appropriate?

   • ALog the password entered by the user to help debug authentication issues.
   • BLog the username, timestamp, source IP, and outcome of the login attempt, without logging the password or session token.
   • CLog only the fact that a login failure occurred, without any details.
   • DLog the full request headers, including the Authorization header, for every login attempt.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A team is designing a new microservice that processes user-uploaded files. During threat modeling, they identify that an attacker could upload a malicious file that is later executed on the server. Which mitigation should be applied at the code stage?

   • AAllow any file type but rename the file to a random string before saving.
   • BScan the file with antivirus software after upload and reject if a virus is found.
   • CValidate the file type by checking the extension and MIME type, and store files outside the web root.
   • DStore the file in a database as a BLOB and never write it to the filesystem.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A development team is building a web application that accepts user-supplied search terms and displays them in an HTML results page. A SAST scan flags a potential cross-site scripting (XSS) issue. The team wants to remediate this in the code stage. Which remediation approach is most effective?

   • AStore the search term in a database and retrieve it with a parameterized query before displaying it.
   • BAdd a client-side JavaScript validation function that blocks characters like '<' and '>' before the form is submitted.
   • CSet the HTTP response header Content-Security-Policy to 'default-src 'none''.
   • DEncode the search term using the appropriate output-encoding function for the HTML context before rendering it in the response.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A team wants to integrate security testing into their CI/CD pipeline. They currently have unit tests and a build step. They want to catch vulnerabilities as early as possible without slowing down the pipeline significantly. What should they add first?

   • ARun a DAST scan only on the production environment after deployment.
   • BRun a full penetration test on every commit.
   • CAdd a manual security review gate that must be approved before any merge.
   • DRun a SAST scan on every commit and a dependency scan on every build.
   Reveal Solution Discussion Select an answer first