Application Software Security GCCC Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team is evaluating testing tools for a web application that is already in production. The team wants to identify runtime vulnerabilities that require a valid authenticated session, such as IDOR and business-logic flaws. The team also wants to minimize the overhead of writing and maintaining custom test scripts. Which approach best meets these requirements?

   • ARun a SAST scan against the source code to identify all potential injection points and then manually verify each one in the running application.
   • BDeploy a WAF in front of the application and use its logs to identify suspicious requests that indicate IDOR or business-logic abuse.
   • CConfigure a DAST scanner to crawl the application anonymously and then use the results to infer which endpoints require authentication.
   • DUse an IAST agent that runs inside the application and monitors data flow during normal and automated testing, including authenticated traffic.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which application security testing approach is best suited for identifying vulnerabilities that only appear at runtime, such as authentication flaws?

   • ADynamic application security testing (DAST)
   • BSoftware composition analysis (SCA)
   • CManual code review
   • DStatic application security testing (SAST)
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A web application allows users to post comments that are displayed to other users. A security tester discovers that entering <script>alert('xss')</script> in a comment causes the script to execute in other users' browsers. Which combination of controls should the development team implement to mitigate this vulnerability?

   • ARun a DAST scan monthly to detect any XSS payloads that are stored in the database and delete them.
   • BRemove all <script> tags from the input using a blacklist and store the sanitized text in the database.
   • CEncode all user-generated content on output using a context-appropriate encoding library, and set the Content-Security-Policy header to restrict script sources.
   • DUse a WAF to block any request that contains the string '<script>' and rely on that as the primary defense.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which secure coding practice is most effective in preventing SQL injection vulnerabilities?

   • AEncoding all output before displaying it to users
   • BUsing parameterized queries or prepared statements
   • CUsing a web application firewall (WAF) in front of the application
   • DDisabling error messages on the production server
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is designing a public API that allows clients to retrieve sensitive documents. The API currently uses a single static API key for all clients. The security team wants to enforce least privilege and reduce the impact of a key leak, but the operations team wants to minimize the overhead of managing many credentials. Which approach best balances these concerns?

   • AImplement mutual TLS with a single client certificate shared by all clients, and rely on the certificate's validity period for security.
   • BContinue using a single shared key but rotate it monthly and require all clients to update their integrations.
   • CIssue a unique API key per client, restrict each key to the minimum scopes needed, and implement per-key rate limiting and revocation procedures.
   • DUse a single key but embed it in a mobile app so that only authenticated users can access the API.
   Reveal Solution Discussion Select an answer first