200-901 Application Deployment and Security Practice Question
A developer is building a web application and wants to implement security best practices. Which TWO actions should be taken? (Choose two.)
⚠ Common exam trap
Cisco often tests the distinction between multiple valid security practices and forces you to select the two that are explicitly listed as correct in the answer options; the trap here is that parameterized queries (option A) are a real best practice, but the question's correct pair is B and E, so candidates who pick A instead of one of those will be wrong.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use CSRF tokens in forms
B is correct because CSRF tokens are a standard defense against Cross-Site Request Forgery attacks. By embedding a unique, unpredictable token in each form and validating it on the server, the application ensures that requests originate from the legitimate user session, not from a malicious third-party site. This is a fundamental security best practice for web applications handling state-changing requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use parameterized queries for SQL
Why it's wrong here
Incorrect. This prevents SQL injection but not directly related to the question's focus on web security.
- ✓
Use CSRF tokens in forms
Why this is correct
Correct. CSRF tokens prevent cross-site request forgery.
- ✗
Store passwords in plaintext
Why it's wrong here
Incorrect. Passwords should be hashed.
- ✗
Disable HTTPS to improve performance
Why it's wrong here
Incorrect. HTTPS is essential for security.
- ✓
Apply output encoding to prevent XSS
Why this is correct
Correct. Output encoding prevents XSS attacks.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.