CAS-004 Application Environment, Configuration and Security — Timed 20 Questions

Question 1

Which of the following is the primary purpose of input validation in application security?

Accepted Answer

To prevent injection attacks by ensuring data conforms to expected formats. Input validation is a security control that ensures user-supplied data matches expected formats, types, lengths, and ranges before processing. By rejecting malformed input, it directly prevents injection attacks (e.g., SQL injection, XSS, command injection) where an attacker embeds malicious code within input fields. This aligns with OWASP's top application security risks and is a foundational defense-in-depth measure.

Answer

To improve application performance by filtering out large inputs

Answer

To encrypt user input before storing it in the database

Answer

To log all user input for auditing purposes

Question 2

A security architect is designing a microservices application that uses JWTs for authentication. Which of the following is the most critical security concern regarding JWT handling?

Accepted Answer

The server not validating the JWT's 'alg' header properly. Option C is correct because a failure to validate the JWT's 'alg' header can allow an attacker to change the algorithm to 'none' or from an asymmetric algorithm (e.g., RS256) to a symmetric one (e.g., HS256), potentially bypassing signature verification. This vulnerability, known as a JWT algorithm confusion attack, is a critical security concern because it directly undermines the integrity and authenticity of the token, which is the core security mechanism for authentication in microservices.

Answer

Token expiration not being enforced

Answer

The JWT being transmitted over HTTP instead of HTTPS

Answer

The JWT containing personally identifiable information (PII)

Question 3

During a security review, you find that a web application uses a Content Security Policy (CSP) header with the value: 'default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.example.com;'. Which attack is the application still vulnerable to?

Accepted Answer

Cross-site scripting (XSS) via inline script injection. Option B is correct because the CSP includes 'unsafe-inline' in the script-src directive, which explicitly allows inline scripts. This bypasses the primary protection CSP offers against XSS, as an attacker can inject malicious JavaScript directly into the HTML (e.g., via a <script> tag or event handler) without violating the policy. The 'self' source only restricts external scripts to the same origin, but inline scripts remain permitted, leaving the application vulnerable to stored, reflected, or DOM-based XSS attacks.

Answer

Cross-site request forgery (CSRF)

Answer

SQL injection

Answer

Man-in-the-middle (MITM) attack due to CDN inclusion

Question 4

An application uses a relational database and constructs SQL queries by concatenating user input. Which secure coding practice should be implemented to mitigate SQL injection?

Accepted Answer

Implement parameterized queries / prepared statements. Parameterized queries (prepared statements) separate SQL logic from user data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver automatically escapes the input values, ensuring they are treated as data, not executable code. This directly prevents SQL injection because the query structure is fixed before user input is bound.

Answer

Use stored procedures exclusively

Answer

Escape all user input with a database-specific escaping function

Answer

Use an ORM (Object-Relational Mapping) framework

Question 5

A DevOps team is implementing a CI/CD pipeline for a Java application. They want to ensure that all dependencies are scanned for known vulnerabilities before deployment. Which type of tool should they integrate into the pipeline?

Accepted Answer

Software Composition Analysis (SCA). Software Composition Analysis (SCA) is the correct tool because it specifically analyzes open-source and third-party libraries (dependencies) for known vulnerabilities by cross-referencing them against databases like the National Vulnerability Database (NVD). In a CI/CD pipeline for a Java application, SCA tools (e.g., OWASP Dependency-Check, Snyk) scan build artifacts such as pom.xml or build.gradle to identify vulnerable components before deployment.

Answer

Static Application Security Testing (SAST)

Answer

Dynamic Application Security Testing (DAST)

Answer

Interactive Application Security Testing (IAST)

Question 6

Which two of the following are effective mitigations against XML External Entity (XXE) injection attacks? (Select the two best options.)

Accepted Answer

Disable Document Type Definition (DTD) processing in the XML parser. Option A is correct because XXE attacks exploit the XML parser's ability to process external entities defined in a DTD. By disabling DTD processing entirely, the parser cannot resolve or fetch external resources, which neutralizes the primary vector for XXE injection. This is a standard security hardening step for XML parsers like libxml2, Xerces, or .NET's XmlReader, often achieved by setting properties such as `LIBXML_NOENT` to false or `XmlReaderSettings.DtdProcessing` to `Prohibit`.

Answer

Use a blacklist to filter out dangerous XML tags

Answer

Validate all XML input against a schema

Question 7

A security assessor is reviewing a containerized application. Which three of the following practices help secure the container runtime environment? (Select the three best options.)

Accepted Answer

Run the container with a read-only root filesystem. Running a container with a read-only root filesystem (option A) prevents any writes to the container's filesystem layer, which blocks malware from dropping files, modifying binaries, or persisting changes. This is enforced by the container runtime (e.g., Docker, containerd) by mounting the root filesystem as read-only, typically using the `--read-only` flag. Even if an attacker gains code execution inside the container, they cannot alter system files or install tools, significantly reducing the blast radius of a compromise.

Answer

Use the latest base image from Docker Hub

Question 8

A security architect is designing a web application that handles sensitive user data. To protect against cross-site scripting (XSS) attacks, which of the following should be implemented?

Accepted Answer

Implement input validation and output encoding. Input validation and output encoding are the primary defenses against XSS because they prevent malicious scripts from being interpreted by the browser. Input validation rejects or sanitizes dangerous characters (e.g., <, >, &) at the point of entry, while output encoding (e.g., HTML entity encoding) ensures that any user-supplied data rendered in the page is treated as text, not executable code. This directly addresses the root cause of XSS—untrusted data being injected into the DOM.

Answer

Implement Content Security Policy (CSP)

Answer

Use HTTPS for all communications

Answer

Deploy a Web Application Firewall (WAF)

Question 9

During a security review, a developer discovers that a containerized application runs with root privileges. Which of the following is the most secure approach to mitigate this risk while maintaining functionality?

Accepted Answer

Set the container to run as a non-root user and drop all unnecessary capabilities. Running a container as a non-root user with dropped capabilities is the most secure approach because it follows the principle of least privilege. By default, containers run as root, which grants unnecessary kernel capabilities that could be exploited for privilege escalation. Setting a non-root user and using `--cap-drop=ALL` with selective `--cap-add` ensures the application retains only required permissions, reducing the attack surface without breaking functionality.

Answer

Disable root login inside the container by modifying /etc/passwd

Answer

Use a read-only root filesystem for the container

Answer

Enable SELinux or AppArmor on the host

Question 10

A security analyst is reviewing a web application's authentication mechanism. Which of the following are best practices to prevent session hijacking? (Select TWO.)

Accepted Answer

Regenerate session ID upon successful login. Regenerating the session ID upon successful login (option A) is a critical defense against session fixation attacks, where an attacker forces a known session ID on a user before authentication. By issuing a new, server-generated session ID after login, the application ensures that any pre-authentication session ID controlled by an attacker becomes invalid. This practice is recommended by OWASP and aligns with RFC 6265 session management guidelines.

Answer

Set the session timeout to 5 minutes

Answer

Use the same session ID before and after authentication

Answer

Store session tokens in localStorage

Question 11

Which of the following is a primary purpose of using code signing for application deployment?

Accepted Answer

To verify the integrity and authenticity of the code. Code signing uses a digital signature (typically RSA or ECDSA) to bind the publisher's identity to the code. The primary purpose is to verify both the integrity (the code has not been tampered with) and the authenticity (the code comes from a trusted source) before deployment. This is achieved by hashing the code and signing the hash with the publisher's private key; the recipient verifies the signature using the publisher's public certificate.

Answer

To encrypt the application code

Answer

To prevent reverse engineering

Answer

To speed up application deployment

Question 12

An organization is implementing a DevSecOps pipeline. Which of the following are essential security controls to include? (Select TWO.)

Accepted Answer

Implement SAST in the build phase. SAST (Static Application Security Testing) is essential in the build phase because it analyzes source code, bytecode, or binary code for security vulnerabilities without executing the program. Integrating SAST early in the DevSecOps pipeline allows developers to identify and remediate flaws like SQL injection, buffer overflows, or cross-site scripting before the code is compiled and deployed, aligning with the 'shift left' security principle.

Answer

Conduct annual penetration testing

Answer

Use network segmentation for production

Answer

Disable security scanning to speed up deployments

Question 13

Which of the following is a secure method for storing secrets (e.g., API keys, passwords) in a cloud-native application?

Accepted Answer

Use a secrets management service. Option C is correct because a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) provides encryption at rest and in transit, automatic rotation, fine-grained access control via IAM policies, and audit logging. This prevents secrets from being exposed in configuration files, environment dumps, or version control, which is essential for cloud-native applications that must adhere to the principle of least privilege and compliance standards like SOC 2 or PCI DSS.

Answer

Encode secrets in base64 in configuration files

Answer

Store secrets in environment variables

Answer

Hardcode secrets in the source code

Question 14

A company is deploying a web application in a containerized environment. The security team wants to ensure that the application runs with the least privilege necessary. Which of the following is the BEST approach to achieve this?

Accepted Answer

Run the container with a non-root user and drop all capabilities. Option B is correct because running a container with a non-root user and dropping all capabilities enforces the principle of least privilege. By default, containers run with a limited set of capabilities, but explicitly dropping all capabilities and using a non-root user ensures that even if the application is compromised, an attacker cannot escalate privileges or perform privileged operations. This aligns with container security best practices, such as those outlined in the Docker security documentation and the CIS Docker Benchmark.

Answer

Run the container as root and use a restrictive seccomp profile

Answer

Run the container as root but use a read-only filesystem

Answer

Run the container with the --privileged flag and a custom AppArmor profile

Question 15

A security engineer is reviewing a CI/CD pipeline that builds a Docker image. The engineer notices that the Dockerfile uses a base image from a public registry, installs packages via apt-get without version pinning, and copies a private SSH key into the image. Which of the following vulnerabilities is MOST directly introduced by this practice?

Accepted Answer

Exposure of sensitive credentials in the image layers. Copying a private SSH key into a Docker image embeds the credential in one of the image's layers. Even if the key is deleted in a later layer, it remains accessible via `docker history` or by pulling the intermediate layers, directly exposing sensitive credentials to anyone who can access the image.

Answer

Use of untrusted base image

Answer

Privilege escalation via SUID binaries

Answer

Dependency confusion from unpinned packages

Question 16

Which of the following is a primary benefit of using a Web Application Firewall (WAF) in front of a web application?

Accepted Answer

It filters malicious HTTP requests and can block common web exploits. A Web Application Firewall (WAF) operates at Layer 7 (application layer) of the OSI model and inspects HTTP/HTTPS traffic for malicious payloads. It uses a combination of signature-based detection, behavioral analysis, and rule sets (e.g., OWASP ModSecurity Core Rule Set) to filter out common web exploits such as SQL injection, cross-site scripting (XSS), and path traversal. By intercepting and blocking malicious requests before they reach the web application, a WAF provides a critical layer of defense without requiring changes to the application code.

Answer

It encrypts all traffic between client and server

Answer

It prevents all types of attacks against the application

Answer

It performs static code analysis on the application

Question 17

An organization uses a microservices architecture where services communicate via REST APIs. To ensure defense in depth, they want to authenticate and authorize every API call. Which of the following implementations BEST enforces this at the application layer?

Accepted Answer

OAuth 2.0 with JWT bearer tokens and scoped permissions. OAuth 2.0 with JWT bearer tokens and scoped permissions is the best choice because it provides a standardized, token-based authentication and authorization mechanism at the application layer. The JWT contains claims (e.g., issuer, subject, expiration, and scopes) that can be cryptographically verified by each microservice without requiring a centralized session store, enabling fine-grained, per-API authorization. This directly addresses the requirement to authenticate and authorize every API call within a defense-in-depth strategy.

Answer

Mutual TLS (mTLS) between services

Answer

API keys in HTTP headers

Answer

IP whitelisting at the network firewall

Question 18

Which of the following is the BEST practice for securely storing secrets (e.g., database passwords) in a cloud-native application?

Accepted Answer

Use a secrets management service with encryption and access policies. Option C is correct because cloud-native applications should rely on a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) that encrypts secrets at rest and in transit, enforces fine-grained access policies via IAM, and supports automatic rotation. This approach decouples secrets from code and infrastructure, eliminating the risks of exposure through version control, logs, or misconfigured permissions.

Answer

Embed the secrets in the application's source code

Answer

Store them in environment variables

Answer

Store them in a configuration file with restricted file permissions

Question 19

A security architect is designing a secure software development lifecycle (SSDLC). Which of the following practices are essential for integrating security into the development process? (Select TWO.)

Accepted Answer

Conducting static application security testing (SAST) during coding. Static application security testing (SAST) analyzes source code, bytecode, or binaries without executing the program, allowing developers to identify vulnerabilities such as buffer overflows, SQL injection, and cross-site scripting during the coding phase. Integrating SAST early in the SSDLC reduces the cost and effort of fixing security flaws by catching them before they reach later stages like testing or production.

Answer

Performing penetration testing only after production deployment

Answer

Implementing runtime application self-protection (RASP) in development

Answer

Deploying a web application firewall (WAF) in staging

Question 20

A company is adopting a serverless architecture using AWS Lambda. Which of the following are security concerns specific to serverless functions? (Select TWO.)

Accepted Answer

Event injection via malformed input. Event injection via malformed input (B) is a specific serverless security concern because AWS Lambda functions are triggered by events from sources like API Gateway, S3, or DynamoDB Streams. An attacker can craft malicious input that exploits the function's event-handling logic, leading to unintended execution paths or data corruption. This differs from traditional injection attacks because the event structure itself can be manipulated to bypass validation.

Answer

Insecure deserialization of function input

Answer

Container escape vulnerabilities

Answer

SQL injection in the database