Application Software Security GCCC Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team must choose a testing strategy for a critical application that has both a legacy SOAP API and a new REST API. The team has limited budget and must identify vulnerabilities before release. Which strategy provides the best coverage within the constraint?

   • ARun SAST on all source code and DAST against both APIs
   • BRun DAST only against the new REST API
   • CPerform manual penetration testing only on the SOAP API
   • DRun SAST only on the new REST API code
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A team is threat modeling a new REST API that allows partners to submit bulk order files via a public endpoint. The file is parsed server-side and the results are stored in a database. The team has identified that the parser has a known buffer-overflow vulnerability that cannot be patched immediately. The API also has an endpoint that returns order status based on a user-supplied order ID. Which threat-modeling outcome should drive the immediate remediation priority?

   • AThe buffer overflow in the parser is the highest priority because it can lead to remote code execution, and the endpoint should be temporarily disabled or restricted to trusted partners until the parser is patched.
   • BBoth issues are equally critical, so the team should implement rate limiting on both endpoints and continue with the current release schedule.
   • CThe order-status endpoint is the highest priority because it is easier to exploit via SQL injection, so the team should add a WAF rule to block suspicious order IDs.
   • DThe team should deprioritize the buffer overflow because the parser runs in a sandboxed container, and focus on adding authentication to the order-status endpoint.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A development team is building a web application that accepts user-uploaded profile images. During a code review, a developer suggests using the file extension to determine the image type and then serving the file directly from the same domain. The security lead wants to reduce the risk of stored XSS and malicious file execution. Which combination of controls should the security lead require?

   • ARun a DAST scan after deployment to detect any XSS payloads that were uploaded, and block the upload if the scan flags the file.
   • BValidate the file's magic bytes, store files outside the web root, and serve them with a Content-Disposition: attachment header and a non-executable content type.
   • CRely on the file extension whitelist and store files in the web root with a .jpg extension so the server automatically sets the correct MIME type.
   • DEncode the file as base64 and embed it in an HTML <img> tag so the browser never treats it as a separate resource.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A DevOps team deploys a containerized application to a Kubernetes cluster. They want to ensure that containers run with the least privilege and that images are free of known vulnerabilities. Which set of practices should they implement?

   • AUse the latest image tags and rely on runtime monitoring
   • BDisable securityContext and use privileged mode for performance
   • CScan images only after deployment to production
   • DRun containers as non-root and scan images with a vulnerability scanner in the CI pipeline
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company runs a containerized application in production. They want to improve security without slowing down deployments. The team is considering adding image scanning, runtime monitoring, and network policies. Which combination is most balanced?

   • AScan images only in production and rely on runtime monitoring
   • BUse runtime monitoring only and disable network policies for performance
   • CScan images in CI, enforce network policies, and use runtime monitoring
   • DEnforce network policies but skip image scanning to save time
   Reveal Solution Discussion Select an answer first