023.2 Application Security (weight: 2) SECURITY-ESSENTIALS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is deploying a new customer portal. Security policy requires that users prove their identity with two different factors and that each user can only access their own account data. Which combination of controls should be implemented?

   • ABiometric login only, and a user ID that is passed from the client to the server.
   • BPassword plus a one-time code sent to the user's phone, and role-based access control that limits data access to the user's own records.
   • CPassword plus a security question, and a single shared role for all users.
   • DPassword plus a CAPTCHA, and an access control list that grants all authenticated users full access.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a common risk of not applying security patches to an application?

   • AThe application will automatically stop working
   • BThe application will lose all user data
   • CThe application may become vulnerable to known exploits that have public proof-of-concept code
   • DThe application will become slower over time
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Why is it important to disable debugging features and verbose error messages in a production application?

   • ATo improve the performance of the application
   • BTo make the application easier to maintain
   • CTo reduce the amount of information available to attackers for reconnaissance
   • DTo comply with licensing agreements
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of proper input validation?

   • ARejecting input that does not match an expected pattern, such as a zip code format
   • BStoring all input in a database without checking
   • CAllowing any input but encoding it on output
   • DTruncating all input to a fixed length
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company runs a public-facing web application and wants to add a layer of defense against common web attacks such as SQL injection and XSS. They do not want to modify the application code immediately. What should they implement?

   • AA network firewall that blocks all inbound traffic except port 80.
   • BA reverse proxy that only caches static content.
   • CAn intrusion detection system (IDS) that monitors network traffic.
   • DA web application firewall (WAF) in front of the application.
   Reveal Solution Discussion Select an answer first