Application Environment, Configuration and Security practice questions

To improve application performance by filtering out large inputs

Why wrong: Performance improvement is a side effect, not the primary security goal.

To encrypt user input before storing it in the database

Why wrong: Encryption protects data at rest, but input validation focuses on input integrity.

To log all user input for auditing purposes

Why wrong: Logging is important but not the primary purpose of input validation.

Token expiration not being enforced

Why wrong: Though important, expiration can be mitigated with refresh tokens; algorithm confusion is more fundamental.

The JWT being transmitted over HTTP instead of HTTPS

Why wrong: Transmission security is important but is a network-layer concern, not JWT-specific.

The JWT containing personally identifiable information (PII)

Why wrong: PII in JWT is a data privacy concern, but not the most critical security vulnerability.

Cross-site request forgery (CSRF)

Why wrong: CSP does not directly prevent CSRF; CSRF is mitigated by anti-CSRF tokens.

SQL injection

Why wrong: CSP is a browser-side security mechanism and does not prevent server-side SQL injection.

Man-in-the-middle (MITM) attack due to CDN inclusion

Why wrong: The CDN is over HTTPS, so MITM is not the primary vulnerability; 'unsafe-inline' is the issue.

Use stored procedures exclusively

Why wrong: Stored procedures can still be vulnerable if dynamic SQL is used within them.

Escape all user input with a database-specific escaping function

Why wrong: Escaping is error-prone and not as reliable as parameterized queries.

Use an ORM (Object-Relational Mapping) framework

Why wrong: ORMs can reduce risk but may still generate dynamic SQL if not used carefully.

Static Application Security Testing (SAST)

Why wrong: SAST analyzes source code for security flaws, not third-party libraries.

Dynamic Application Security Testing (DAST)

Why wrong: DAST tests running applications for vulnerabilities, not dependencies.

Interactive Application Security Testing (IAST)

Why wrong: IAST combines SAST and DAST but still focuses on custom code, not dependencies.

Use a blacklist to filter out dangerous XML tags

Why wrong: Blacklists are easily bypassed; disabling DTD is more robust.

Validate all XML input against a schema

Why wrong: Schema validation does not prevent XXE if DTDs are still enabled.

Use the latest base image from Docker Hub

Why wrong: This is important for image security, not runtime configuration.

Implement Content Security Policy (CSP)

Why wrong: CSP is a defense-in-depth measure that can reduce the impact of XSS but does not prevent it entirely; proper input validation and output encoding are the primary controls.

Use HTTPS for all communications

Why wrong: HTTPS protects data in transit but does not prevent XSS attacks.

Deploy a Web Application Firewall (WAF)

Why wrong: WAF can detect and block some XSS attempts but is not a primary prevention; it can be bypassed and should not replace secure coding.

Disable root login inside the container by modifying /etc/passwd

Why wrong: Disabling root login does not prevent the container process from running as root; the process still has root privileges.

Use a read-only root filesystem for the container

Why wrong: A read-only filesystem limits writes but does not reduce privileges; the container still runs as root.

Enable SELinux or AppArmor on the host

Why wrong: These are mandatory access control mechanisms that can confine a process, but they do not directly address the root privilege issue; combining with non-root user is better.

Set the session timeout to 5 minutes

Why wrong: Short timeouts reduce risk but do not prevent hijacking; they are a mitigation, not a prevention.

Use the same session ID before and after authentication

Why wrong: Using the same session ID allows session fixation attacks.

Store session tokens in localStorage

Why wrong: localStorage is accessible by JavaScript and vulnerable to XSS; cookies with HttpOnly flag are more secure.

To encrypt the application code

Why wrong: Encryption is for confidentiality; code signing does not encrypt the code.

To prevent reverse engineering

Why wrong: Code signing does not prevent reverse engineering; obfuscation or other techniques are used for that.

To speed up application deployment

Why wrong: Code signing adds overhead, not speed.

Conduct annual penetration testing

Why wrong: Annual testing is not frequent enough for a DevSecOps pipeline, which requires continuous testing.

Use network segmentation for production

Why wrong: Network segmentation is a security control but not specific to the DevSecOps pipeline; it is an operational security measure.

Disable security scanning to speed up deployments

Why wrong: Disabling security scanning would defeat the purpose of DevSecOps.

Encode secrets in base64 in configuration files

Why wrong: Base64 is not encryption; it is easily reversible and does not protect secrets.

Store secrets in environment variables

Why wrong: Environment variables can be exposed via process listings, logs, or debug interfaces; they are not encrypted.

Hardcode secrets in the source code

Why wrong: Hardcoding secrets is insecure as they can be read from version control or decompiled code.

Run the container as root and use a restrictive seccomp profile

Why wrong: Running as root still gives elevated privileges; seccomp alone does not enforce user-level least privilege.

Run the container as root but use a read-only filesystem

Why wrong: Read-only filesystem does not prevent root-level process attacks; the container still runs as root.

Run the container with the --privileged flag and a custom AppArmor profile

Why wrong: --privileged gives the container nearly all host capabilities, violating least privilege.

Use of untrusted base image

Why wrong: While a risk, it's not as directly exploitable as an exposed private key.

Privilege escalation via SUID binaries

Why wrong: No indication of SUID; the main issue is secret leakage.

Dependency confusion from unpinned packages

Why wrong: Unpinned packages are a supply chain risk but not as immediate as credential exposure.

It encrypts all traffic between client and server

Why wrong: Encryption is typically handled by TLS, not the WAF.

It prevents all types of attacks against the application

Why wrong: WAFs cannot prevent all attacks, especially logic flaws or zero-days.

It performs static code analysis on the application

Why wrong: Static code analysis is a separate process, not a WAF function.

Mutual TLS (mTLS) between services

Why wrong: mTLS provides transport-layer authentication but does not enforce application-level authorization.

API keys in HTTP headers

Why wrong: API keys are static and often lack scoping; they are not as secure or granular as OAuth tokens.

IP whitelisting at the network firewall

Why wrong: IP whitelisting is network-level and does not authenticate users or services at the application layer.

Embed the secrets in the application's source code

Why wrong: Hardcoding secrets exposes them in version control and to anyone with code access.

Store them in environment variables

Why wrong: Environment variables can be leaked through debugging interfaces or process listings; they are not encrypted.

Store them in a configuration file with restricted file permissions

Why wrong: File permissions can be bypassed; configuration files are often not encrypted.

Performing penetration testing only after production deployment

Why wrong: Pen testing is important but occurs later; it's not integrated into the development process early.

Implementing runtime application self-protection (RASP) in development

Why wrong: RASP is a runtime control, not typically integrated into the development phase.

Deploying a web application firewall (WAF) in staging

Why wrong: WAF is a network security control, not a development practice.

Insecure deserialization of function input

Why wrong: A general web vulnerability, not specific to serverless.

Container escape vulnerabilities

Why wrong: Serverless functions run in isolated containers, but escape is more relevant to traditional containers.

SQL injection in the database

Why wrong: A general web vulnerability, not specific to serverless.