8.5 - Define and Apply Secure Coding Guidelines and Standards CISSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A developer is writing a function that parses XML input from an external source. The application is vulnerable to XML External Entity (XXE) attacks. The team wants to fix this while still supporting legitimate XML features. Which configuration is the most secure?

   • ASanitize the XML input by removing all '&' characters.
   • BUse a regular expression to validate the XML structure before parsing.
   • CUse a blocklist of dangerous entity names.
   • DDisable external entity resolution and DTD processing in the XML parser.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A developer is writing error-handling code for a web application. The current code logs the full exception stack trace to the console and returns the exception message to the client. Which change aligns with secure coding guidelines?

   • AReturn the exception message to the client but do not log it.
   • BLog detailed errors server-side and return a generic message to the client.
   • CSuppress all error messages and do not log anything.
   • DDisplay a custom error page but include the exception type in the URL.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A web application displays user-generated content in HTML pages. A penetration test revealed a stored cross-site scripting (XSS) vulnerability. The development team is planning a fix. Which secure coding practice is the most direct and effective mitigation?

   • AFilter all user input with a blocklist of dangerous tags and attributes.
   • BEncode all dynamic output according to the context where it is placed in the HTML page.
   • CStore all user content in a database with parameterized queries.
   • DSet the HTTPOnly flag on all cookies.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a code review, a developer notices that a database query is built by concatenating user input directly into a SQL string. The application is written in Java and uses JDBC. Which remediation is the most effective?

   • AUse PreparedStatement with bind variables for all database queries.
   • BValidate the user input against a whitelist of allowed characters.
   • CEscape single quotes in the user input before concatenating it into the SQL string.
   • DStore the user input in a separate table and join it at runtime.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a security consideration for APIs that ensures only authorized users can access specific resources?

   • ALogging
   • BAuthorization
   • CEncryption
   • DRate limiting
   Reveal Solution Discussion Select an answer first