Secure Software Implementation

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

In an OAuth2 flow, what is the purpose of the 'state' parameter?

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

What is the primary security benefit of using a hardened container base image for microservices?

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Which standard security practice should be applied to all passwords stored in a database?

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?

During a peer code review, you find a function that constructs an OS command using user input. What is the most secure way to handle this?

Which THREE of the following practices contribute to secure configuration of a web server?

Which THREE of the following are best practices for the secure use of third-party libraries?

Which TWO of the following are required to successfully implement a secure logging mechanism?

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

Which TWO of the following are crucial when performing a manual code review for security?

A security architect is reviewing the design of a new web application. The application must ensure that session identifiers are unpredictable and resistant to guessing attacks. The development team proposes using a random number generator. Which approach should the architect recommend to meet this requirement?

A developer is implementing a file upload feature in a web application. The application must allow users to upload images but prevent the execution of malicious scripts. The developer decides to validate the file extension and MIME type. Which additional security control is most effective to prevent stored cross-site scripting (XSS) via uploaded files?

A development team is implementing input validation for a web application. They want to ensure that all user-supplied data is properly sanitized to prevent injection attacks. Which TWO of the following are effective techniques for input validation? (Choose two.)

A developer is writing code that handles sensitive cryptographic keys. The keys must be protected from unauthorized access. Which practice is most appropriate for securing cryptographic keys in the application?