Avoid Vulnerability CT-STE Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A project manager is writing security requirements for a new customer portal. The portal will allow users to view their account balances and transfer funds. Which security requirement best supports vulnerability avoidance from the outset?

   • AThe system shall encrypt all data in transit using TLS 1.2 or higher.
   • BThe system shall validate all user input on the server side, including length, type, and format, before processing.
   • CThe system shall log all user actions for audit purposes.
   • DThe system shall use multi-factor authentication for all administrative users.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A developer is writing a web application that allows users to search for products. The search term is included in the SQL query. Which secure coding practice should the developer use to avoid SQL injection?

   • AValidating that the search term contains only alphanumeric characters.
   • BEscaping single quotes in the search term before including it in the query.
   • CUsing a parameterized query with a prepared statement.
   • DUsing a stored procedure that dynamically builds the SQL query.
   Reveal Solution Discussion Select an answer first