Integrating Secure Coding in the Code Stage DSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A developer is writing a function that queries a database using user input. The developer wants to follow secure coding principles. Which approach is the most secure?

   • AValidate the input against a whitelist of allowed characters before using it in the query.
   • BUse a stored procedure that dynamically builds the SQL string.
   • CEscape single quotes in the user input before concatenating it into the SQL string.
   • DUse parameterized queries or prepared statements with bound parameters.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A web application uses role-based access control (RBAC). A security review finds that a low-privileged user can access an admin endpoint by changing a parameter in the URL. The application uses a session cookie for authentication. What is the most likely cause and the best fix?

   • AThe session cookie is not encrypted; encrypt the session cookie to prevent parameter tampering.
   • BThe application does not perform authorization checks on the server side; implement server-side authorization checks for every endpoint.
   • CThe URL parameter is not validated; add input validation to the admin endpoint.
   • DThe user's role is stored in the URL; move the role to the session cookie.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A developer is implementing a feature that allows users to upload profile pictures. The application will store the files on the server and serve them back to users. Which combination of controls is most important to prevent security issues?

   • AValidate the file extension and store files in the web root for easy access.
   • BValidate the file type by content, store files outside the web root, and serve them with a Content-Disposition header.
   • CUse a random filename and store the file in a temporary directory.
   • DRely on the client to send only image files and store them in a database.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   During a security code review, a reviewer notices that a developer has concatenated user input directly into a SQL query string. Which issue should the reviewer flag as the highest priority?

   • AThe code lacks a comment explaining the query logic.
   • BThe code does not follow the team's naming conventions for variables.
   • CThe code uses a database connection string that is hardcoded.
   • DThe code is vulnerable to SQL injection because user input is not parameterized.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A team is building a public-facing web application that allows users to upload profile pictures. During threat modeling, they identify a risk of stored XSS via SVG files. The team wants to allow image uploads but prevent XSS. They also need to keep the feature user-friendly and avoid breaking legitimate images. What is the best approach?

   • AStore all uploads in a separate domain and use a sandboxed iframe to display them.
   • BAllow SVG uploads but sanitize the XML by removing all script tags and event handlers.
   • CAllow only raster image formats (e.g., PNG, JPEG) and validate the file content by decoding it as an image.
   • DAllow SVG uploads but serve them with a Content-Type of text/plain.
   Reveal Solution Discussion Select an answer first