Secure Software Implementation

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

Which TWO of the following are crucial when performing a manual code review for security?

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Which standard security practice should be applied to all passwords stored in a database?

In an OAuth2 flow, what is the purpose of the 'state' parameter?

Which THREE of the following are best practices for the secure use of third-party libraries?

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

During a peer code review, you find a function that constructs an OS command using user input. What is the most secure way to handle this?

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

Which THREE of the following practices contribute to secure configuration of a web server?

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

Which TWO of the following are required to successfully implement a secure logging mechanism?

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

What is the primary security benefit of using a hardened container base image for microservices?

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?