CND Application And Data Protection — Timed 10 Questions

Question 1

A security administrator is hardening an Apache HTTP Server 2.4 configuration on Ubuntu to protect web applications against Cross-Site Scripting (XSS) and clickjacking. Which directives should be added to the httpd.conf file to enforce a Content Security Policy (CSP) and prevent framing?

10 minute time limit — choose an answer to begin.

Accepted Answer

LoadModule headers_module modules/mod_headers.so followed by Header set X-Frame-Options 'DENY' and Header set Content-Security-Policy "default-src 'self'". To send CSP and X-Frame-Options headers, Apache must load mod_headers and then use the Header directive to set them. Header set X-Frame-Options 'DENY' prevents clickjacking by disallowing framing, and Header set Content-Security-Policy "default-src 'self'" restricts resource loading to the same origin, mitigating XSS. This is the correct directive combination for Apache 2.4.

Answer

TraceEnable Off and ServerTokens Prod

Answer

FileETag None and Options -Indexes

Answer

SecurityHeadersEngine On followed by SetFrameOptions DENY

Question 2

A developer is configuring TLS 1.3 encryption on an Nginx web server. To ensure maximum cryptographic strength and forward secrecy, which cipher suite configuration should be specified for TLS 1.3?

Accepted Answer

ssl_protocols TLSv1.3; and relying on the protocol's mandated secure cipher suites (e.g., TLS_AES_256_GCM_SHA384). TLS 1.3 removed the ability to negotiate arbitrary cipher suites via ssl_ciphers; the protocol mandates a fixed set of five AEAD cipher suites (e.g., TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256) that all provide forward secrecy. Configuring ssl_protocols TLSv1.3 and letting the protocol's built-in suites apply is the correct approach. Specifying legacy ssl_ciphers strings has no effect on TLS 1.3 handshakes.

Answer

ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';

Answer

ssl_prefer_server_ciphers off; combined with MD5

Answer

ssl_cipher_suites 'TLS_RSA_WITH_AES_128_CBC_SHA';

Question 3

An organization is implementing database encryption in Oracle Database 19c and wants to protect specific sensitive columns containing Social Security Numbers using Advanced Security Transparent Data Encryption (TDE). Which SQL command correctly creates a table with a column encrypted using AES256?

Accepted Answer

CREATE TABLE employee (ssn VARCHAR2(11) ENCRYPT USING 'AES256');. In Oracle Database 19c, column-level TDE encryption is declared inline in the CREATE TABLE statement using the ENCRYPT USING '<algorithm>' clause. The correct syntax is `CREATE TABLE employee (ssn VARCHAR2(11) ENCRYPT USING 'AES256');`, which encrypts the SSN column with AES-256 using the TDE master key stored in the wallet. No IDENTIFIED BY clause is required for TDE column encryption because key management is handled by the Oracle Wallet, not a per-column password.

Answer

CREATE ENCRYPTED TABLE employee (ssn VARCHAR2(11)) STORAGE ENGINE INNODB_TDE;

Answer

CREATE TABLE employee (ssn VARCHAR2(11) ENCRYPT USING 'AES256' IDENTIFIED BY master_key);

Answer

ALTER DATABASE ENCRYPT COLUMN ssn WITH ALGORITHM = 'AES256';

Question 4

A security analyst is investigating a web application vulnerability and identifies that user input is reflected directly inside a JavaScript block without adequate sanitization, leading to execution in the victim's browser. What specific type of vulnerability is present?

Accepted Answer

DOM-based Cross-Site Scripting (DOM XSS). DOM-based XSS occurs when client-side JavaScript reads attacker-controllable data (such as location.hash or document.URL) and writes it into a dangerous sink like innerHTML or eval() without sanitization, causing execution entirely in the browser. The server never sees the payload, so server-side filtering cannot prevent it. The scenario describes input reflected into a JavaScript block and executing in the victim's browser via client-side processing, which is the defining characteristic of DOM XSS.

Answer

Stored Cross-Site Scripting (Stored XSS)

Answer

Server-Side Request Forgery (SSRF)

Answer

Reflected Cross-Site Scripting (Reflected XSS)

Question 5

A cybersecurity analyst is auditing a Linux server running Apache Tomcat. To prevent attackers from exploiting directory traversal vulnerabilities to download sensitive configuration files from outside the web root, which Tomcat configuration parameter must be properly configured in server.xml?

Accepted Answer

Set allowLinking="false" in the Context element of server.xml. The allowLinking attribute or docBase security restrictions in Tomcat control whether symbolic links outside the web app base can be followed. Additionally, the privileged context setting manages administrative access.

Answer

Set crossContext="true" in the Host configuration

Answer

Set debug="9" and swallowOutput="false"

Answer

Configure Enterprise Security Manager (ESM) connector bindings

Question 6

A security engineer is configuring AWS Key Management Service (KMS) for an application storing customer data in Amazon S3 buckets. The security policy dictates that the Customer Master Key (CMK) must be automatically rotated every year, and the key material must be managed within a dedicated hardware security module. Which KMS key type and rotation setting fulfill these requirements?

Accepted Answer

Customer Managed Key (CMK) with automatic annual key rotation enabled and backed by AWS CloudHSM. A Customer Managed Key (CMK) gives the account owner control over rotation policy, and KMS supports automatic annual rotation for symmetric CMKs. To meet the requirement that key material be managed within a dedicated HSM, the CMK must be backed by AWS CloudHSM (via a custom key store). This combination satisfies both the rotation cadence and the HSM custody requirement.

Answer

S3 Master Symmetric Key with client-side PGP encryption keys

Answer

External Key Store (XKS) with static key material managed on-premise without rotation

Answer

AWS Managed Key with manual rotation every 90 days via CLI

Question 7

A web application development team is reviewing the OWASP Top 10 web application security risks. Which TWO vulnerabilities directly involve improper handling of user-supplied data that is subsequently executed or interpreted by backend interpreters?

Accepted Answer

Injection (e.g., SQL Injection, OS Command Injection). Injection flaws (such as SQL, Command, and LDAP injection) and Server-Side Template Injection (SSTI) involve user input being interpreted as code or commands by backend parsers.

Answer

Broken Authentication

Answer

Server-Side Request Forgery (SSRF)

Answer

XML External Entities (XXE)

Answer

Insecure Deserialization

Question 8

A software developer is writing a secure web application and needs to protect sensitive user session cookies against theft and cross-site scripting (XSS) attacks. Which TWO cookie attributes must be set when creating session cookies?

Accepted Answer

Secure. Option D (Secure) is correct because the Secure attribute instructs the browser to transmit the cookie only over HTTPS-encrypted connections, preventing session cookies from being intercepted in cleartext over HTTP and thus mitigating theft via network sniffing. Option E (HttpOnly) is correct because it blocks client-side JavaScript from accessing the cookie via document.cookie, which directly defends against XSS-based session theft. Option A (Max-Age=31536000) is not required and is actually harmful for session cookies, since a one-year lifetime increases exposure and contradicts the short-lived nature of sessions. Option B (Domain=example.com) merely scopes which hosts receive the cookie and provides no protection against theft or XSS. Option C (SameSite=Strict or Lax) is a valuable CSRF defense but is not one of the two attributes specifically required here to counter theft and XSS.

Answer

Max-Age=31536000

Answer

Domain=example.com

Answer

SameSite=Strict or Lax

Question 9

A security analyst is examining a Windows Server 2022 file server that stores payroll records. The analyst discovers that the payroll folder inherits permissions from the parent volume, and members of the Domain Users group have Read access to every payroll file. The company policy requires that only the Payroll department and the CFO may read these files, and that access must be auditable. After removing the inherited permissions and granting NTFS Read to the Payroll group and CFO account, what should the analyst do to ensure the restriction is enforced when users access the share over the network?

Accepted Answer

Configure share permissions on the payroll share to grant Change to the Payroll group and CFO account, and remove access for Domain Users.. When a file is accessed through an SMB share, Windows evaluates both share permissions and NTFS permissions and applies the most restrictive result. Because the payroll folder inherited broad NTFS access from the parent volume, the analyst must also lock down the share so that Domain Users cannot reach the files over the network. Granting Change to the Payroll group and CFO while removing Domain Users at the share level, combined with the tightened NTFS permissions, enforces the policy for both network and local access.

Answer

Configure share permissions on the payroll share to grant Full Control to Domain Users and rely on the NTFS permissions to restrict access.

Answer

Enable access-based enumeration on the payroll share so that users without NTFS Read permission cannot see the folder in the share listing.

Answer

Enable the Windows Firewall rule for File and Printer Sharing and configure an IPsec connection security rule requiring Kerberos authentication for all SMB traffic.

Question 10

A security engineer is hardening a Linux web server that hosts a PHP application. The engineer needs to configure the PHP runtime so that user-supplied input cannot be executed as PHP code, even if an attacker manages to upload a file with a .php extension into an upload directory. Which PHP directive should be set to disable the execution of PHP code in files that are not explicitly intended to be scripts?

Accepted Answer

Set engine to Off for the upload directory using a per-directory php_admin_flag.. The PHP engine directive controls whether the interpreter processes files as PHP scripts. Disabling it for an upload directory ensures that even a file with a .php extension is not executed, neutralizing webshell uploads. Other directives restrict functions or file access but still allow the uploaded script to run, so they do not satisfy the requirement to stop code execution in that directory.

Answer

Set allow_url_include to Off.

Answer

Set disable_functions to include exec, system, and shell_exec.

Answer

Set open_basedir to restrict file access to the web root.