Secure Software Implementation practice questions

Using cleartext with database permissions

Why wrong: Cleartext provides no protection if the database file is exfiltrated.

Using MD5 hashing

Why wrong: MD5 is cryptographically broken and unsafe for passwords or data protection.

Storing data in base64 encoding

Why wrong: Base64 is an encoding, not encryption, and provides zero security.

Using <%- %> tags for all variables

Why wrong: The <%- tag renders unescaped HTML, which is a major XSS risk.

Disabling the template engine

Why wrong: Disabling the engine makes the application non-functional.

Implementing a global regex filter

Why wrong: Regex filtering for XSS is prone to bypasses and is not a best practice.

Set the Content-Type header to application/json

Why wrong: Changing the header does not prevent CSRF attacks.

Use a stateless session strategy with no tokens

Why wrong: Stateless APIs still require CSRF protection if they use cookies for authentication.

Enable csrf().disable() in the SecurityFilterChain

Why wrong: This explicitly turns off the protection.

Disable SSL on the API endpoint

Why wrong: Disabling SSL increases the attack surface.

Increase the request timeout

Why wrong: This is a performance tuning setting, not a security control.

Store user passwords in plaintext

Why wrong: This is a severe security violation.

--ignore-cve

Why wrong: This is not the correct command-line argument for Dependency-Check.

--exclude-all

Why wrong: This flag is not a valid parameter for Dependency-Check.

--skip-analysis

Why wrong: This skips the scan entirely rather than filtering results.

Database connection timeout

Why wrong: This is an operational runtime issue, not a static code vulnerability.

Business logic flaws

Why wrong: Static analysis struggles with context-dependent business logic.

Zero-day authentication bypass

Why wrong: Static analysis cannot predict unknown zero-day vulnerabilities.

style-src

Why wrong: This restricts CSS sources.

img-src

Why wrong: This restricts image sources, not scripts.

connect-src

Why wrong: This restricts AJAX/fetch connection targets.

Syntax checking

Why wrong: Syntax checking only catches code structure errors.

Unit testing

Why wrong: Unit tests verify functionality, not security properties of logs.

Dead code detection

Why wrong: This identifies unused code, not data leaks.

To store the user's password

Why wrong: Passwords should never be passed in OAuth flow parameters.

To track the user's location

Why wrong: OAuth2 does not track location via state.

To encrypt the access token

Why wrong: The state parameter is for validation, not encryption.

To encrypt source code

Why wrong: SBOMs are documentation, not encryption tools.

To speed up build times

Why wrong: SBOMs do not impact build performance.

To replace the need for unit testing

Why wrong: Testing and supply chain security are distinct processes.

Session Hijacking

Why wrong: This is prevented by secure session management and HTTPS.

Insecure Deserialization

Why wrong: This is prevented by validating input types during deserialization.

Directory Traversal

Why wrong: This is prevented by path sanitization.

It increases execution speed

Why wrong: Speed is not the primary security benefit.

It automatically encrypts application logs

Why wrong: Encryption is an application-level concern.

It eliminates the need for patching

Why wrong: Containers still require constant vulnerability patching.

Store it in a public environment variable

Why wrong: Public environment variables can be leaked easily.

Add it to the .gitignore file

Why wrong: This prevents uploading to Git but does not solve the runtime management issue.

Obfuscate the key in the code

Why wrong: Obfuscation is easily reversible and not a security control.

Checking the file size

Why wrong: Size limits prevent DoS, not RCE.

Validating the file extension only

Why wrong: Extensions can be easily spoofed.

Enabling execution permissions on the upload folder

Why wrong: This would facilitate RCE, not prevent it.

Cross-Site Scripting

Why wrong: ORMs are database-focused, not UI-focused.

Brute force attacks

Why wrong: This is a credential management issue.

Buffer overflows

Why wrong: ORMs manage data types, usually abstracting memory access.

Encryption with a symmetric key

Why wrong: Encryption is reversible; hashing is preferred for passwords.

Storing in a configuration file

Why wrong: Storing credentials in files is insecure.

Base64 encoding

Why wrong: Encoding is not security.

Hardware procurement

Why wrong: Incorrect - not a core SSDLC component.

Marketing strategies

Why wrong: Incorrect - not a security component.

Unlimited project budget

Why wrong: Incorrect - not a process component.

The use of internal logging

Why wrong: Logging does not handle object graphs.

The use of JSON.parse()

Why wrong: JSON parsing is generally safe unless processed into objects dynamically.

The use of static typing

Why wrong: Static typing improves security.

HTTP Basic Auth

Why wrong: Basic auth is not suitable for inter-service communication.

IP allow-listing

Why wrong: IP spoofing makes this unreliable.

Shared API keys in headers

Why wrong: Managing shared keys at scale is complex and error-prone.

Relying on antivirus software

Why wrong: Incorrect - AV does not block XSS.

Disabling cookies

Why wrong: Incorrect - does not prevent XSS.

Using insecure HTML comments

Why wrong: Incorrect - comments provide no security.