Use Verified Secure Software CCSP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   A development team is exposing a REST API that handles customer account data. Which combination of controls directly addresses the OWASP API Security Top 10 risks of broken object-level authorization (BOLA) and excessive data exposure?

   • AApply rate limiting per API key and log all API requests for audit purposes.
   • BValidate all input against a JSON schema and reject requests with unexpected fields.
   • CEnforce per-object authorization checks in the API handler and return only explicitly selected fields in responses.
   • DRequire a strong API key in the Authorization header and enable TLS for all API traffic.
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   An organization is adopting a formal API lifecycle security program. Which practice best ensures that security controls remain effective as the API evolves through multiple versions?

   • AConduct a security review of each API version before it is released and retire deprecated versions on a defined schedule.
   • BPerform a comprehensive threat model only when the API is first designed.
   • CAutomatically redirect all traffic from old versions to the newest version without notification.
   • DUse the same API key for all versions to simplify authentication management.
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   During threat modeling for a public API that accepts user-supplied JSON, the team identifies a risk of SQL injection via a legacy backend. Which mitigation is most directly aligned with the threat model's finding?

   • ARequire clients to use a specific API version.
   • BIncrease the API rate limit to allow more requests per second.
   • CAdd a Web Application Firewall (WAF) in front of the API.
   • DUse parameterized queries in the backend database access layer.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which document is commonly required by an open-source governance policy to track the components and dependencies used in a cloud application?

   • AService level agreement (SLA)
   • BMemorandum of understanding (MOU)
   • CData processing agreement (DPA)
   • DSoftware bill of materials (SBOM)
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   A security engineer downloads a software package from a vendor's website. Which action best verifies the package's integrity and authenticity?

   • ACompare the SHA-256 hash of the downloaded file with the hash published on the vendor's official site over HTTPS.
   • BCheck that the file size matches the size listed on the vendor's website.
   • CVerify the file's digital signature using the vendor's public key from a trusted certificate authority.
   • DConfirm the download URL uses HTTPS and the site displays a security seal.
   Reveal Solution Discussion Select an answer first