Secure Software Implementation

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

Which TWO of the following are crucial when performing a manual code review for security?

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?

A developer is implementing a file upload feature in a web application. The application must allow users to upload images but prevent the execution of malicious scripts. The developer decides to validate the file extension and MIME type. Which additional security control is most effective to prevent stored cross-site scripting (XSS) via uploaded files?

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

A developer is writing code that handles sensitive cryptographic keys. The keys must be protected from unauthorized access. Which practice is most appropriate for securing cryptographic keys in the application?

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

A security architect is reviewing the design of a new web application. The application must ensure that session identifiers are unpredictable and resistant to guessing attacks. The development team proposes using a random number generator. Which approach should the architect recommend to meet this requirement?

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Which standard security practice should be applied to all passwords stored in a database?

In an OAuth2 flow, what is the purpose of the 'state' parameter?

Which THREE of the following are best practices for the secure use of third-party libraries?

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

During a peer code review, you find a function that constructs an OS command using user input. What is the most secure way to handle this?

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

A development team is implementing input validation for a web application. They want to ensure that all user-supplied data is properly sanitized to prevent injection attacks. Which TWO of the following are effective techniques for input validation? (Choose two.)

Which THREE of the following practices contribute to secure configuration of a web server?

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

Which TWO of the following are required to successfully implement a secure logging mechanism?

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

What is the primary security benefit of using a hardened container base image for microservices?

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?