28 questions · Secure Software Implementation · All types, answers revealed
A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?
Taint analysis tracks data from source to sink to identify leaks.
Why this answer
Data flow analysis (or taint analysis) is required to track whether sensitive data reaches an insecure sink like a log file.
When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?
SBOMs allow for rapid vulnerability identification across the entire supply chain.
Why this answer
An SBOM provides a comprehensive list of all components, making it possible to identify if a newly disclosed vulnerability affects your application.
Which TWO of the following are crucial when performing a manual code review for security?
Correct - central to spotting injection flaws.
Why this answer
Identifying data sources and sinks and checking for authorization controls are central to manual security audits.
Which THREE of the following are recognized techniques for minimizing the attack surface of an API?
Correct - ensures access control.
Why this answer
Disabling unused methods, authentication, and rate limiting are standard API hardening techniques.
You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?
Native serialization formats are often susceptible to gadget chain attacks.
Why this answer
Deserialization of untrusted data in languages like Java (ObjectInputStream) or Python (pickle) can allow code execution.
When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?
Lock files ensure reproducibility and prevent tampering.
Why this answer
Pinning dependencies to specific versions and using hash verification ensures you are not pulling in malicious or modified code.
You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?
The <%= tag performs HTML entity escaping on the rendered content.
Why this answer
Escaping output is the primary defense against XSS; EJS uses the <%= %> tag for escaped output, which handles special characters.
Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?
Correct - separates code from data.
Why this answer
Parameterized queries, input validation, and the principle of least privilege are core defenses against SQLi.
When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?
Static analysis tools scan for dangerous function calls like strcpy or gets that cause buffer overflows.
Why this answer
Static analysis tools are highly effective at identifying buffer overflows, which are common in C++ due to manual memory management.
You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?
This is the correct CSP directive for controlling script origins.
Why this answer
The script-src directive dictates valid sources for executable scripts, preventing malicious code injection from untrusted domains.
A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?
The suppression file is the standard mechanism to filter out known false positives.
Why this answer
The --suppression flag allows developers to provide an XML file that defines rules to ignore specific CVEs or false positives in the dependency scan report.
In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?
Validating CSRF tokens ensures the request originated from the trusted UI.
Why this answer
Spring Security enables CSRF protection by default, which validates tokens for non-GET requests; disabling it (csrf().disable()) is the primary cause of vulnerability.
When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?
mTLS is the standard for gRPC service authentication.
Why this answer
Mutual TLS (mTLS) ensures both the client and server verify each other's certificates, providing strong authentication.
Which standard security practice should be applied to all passwords stored in a database?
Salting prevents rainbow table attacks.
Why this answer
Salting and hashing with a strong, slow algorithm (like Argon2 or bcrypt) is required to protect passwords.
In an OAuth2 flow, what is the purpose of the 'state' parameter?
It binds the request to the user's session.
Why this answer
The state parameter is used to prevent CSRF in OAuth flows by ensuring the redirect matches the original request.
Which THREE of the following are best practices for the secure use of third-party libraries?
Correct - proactive security management.
Why this answer
Monitoring for vulnerabilities, pinning versions, and auditing updates are key practices.
You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?
Dedicated services provide encryption and centralized access control for secrets.
Why this answer
Secret management services like HashiCorp Vault or AWS Secrets Manager allow externalizing and rotating secrets without code changes.
Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?
Correct - defines the security posture.
Why this answer
Threat modeling and security requirements are foundational to the SSDLC process.
During a peer code review, you find a function that constructs an OS command using user input. What is the most secure way to handle this?
Native APIs avoid the shell and prevent injection.
Why this answer
Avoid calling OS commands entirely. If necessary, use built-in language APIs that don't involve shell execution, or enforce strict allow-lists.
A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?
Parameterized queries separate code from data in the database layer.
Why this answer
Parameterized queries ensure that user input is treated as data, not executable code, effectively preventing SQL Injection.
Which THREE of the following practices contribute to secure configuration of a web server?
Correct - reduces attack surface.
Why this answer
Disabling directory listing, removing default pages, and enforcing HTTPS are essential for server hardening.
Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?
AES-256 is the current standard for secure encryption.
Why this answer
AES-256 is the industry standard for symmetric encryption of data at rest.
Which TWO of the following are required to successfully implement a secure logging mechanism?
Correct - prevents leakage of PII/credentials.
Why this answer
Sensitive data must be filtered, and logs must be stored in a secure, tamper-evident location.
Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?
Correct - prevents execution of unauthorized scripts.
Why this answer
Context-aware encoding and CSP are the most effective defenses against XSS.
A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?
DTOs act as an allow-list for fields, preventing unauthorized property injection.
Why this answer
Mass assignment occurs when input fields are mapped directly to database objects; using Data Transfer Objects (DTOs) allows explicit control over allowed fields.
What is the primary security benefit of using a hardened container base image for microservices?
Removing unused tools makes it harder for an attacker to escalate privileges.
Why this answer
Hardened images remove unnecessary binaries and shells, reducing the attack surface for potential exploits.
A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?
Using raw query functions with dynamic strings bypasses ORM protections.
Why this answer
Even with ORMs, developers can introduce SQL injection if they dynamically construct queries using string concatenation inside the ORM's raw query methods.
When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?
This prevents direct execution of uploaded files by the web server.
Why this answer
Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.
Ready to test yourself?
Try a timed practice session using only Secure Software Implementation questions.