Application Vulnerabilities Practice Questions

Answers and explanations appear when you work through the set above.

1. A security review finds that user supplied profile text is inserted into an HTML response without context appropriate output encoding. Which attack is the reviewer primarily addressing?

   • Cross-site request forgery, because the browser submits an unwanted state change.
   • Cross-site scripting, because the browser may interpret profile text as active content.
   • SQL injection, because the database parses the response body.
   • Buffer overflow, because the response exceeds the browser buffer.

2. An online banking application accepts a state changing request based only on a session cookie. Which control should the application owner prioritize to reduce cross-site request forgery risk?

   • Increase the session timeout so the browser retains its cookie throughout the banking transaction.
   • Add a database index on the transaction table.
   • Validate an unpredictable, server-generated anti-CSRF token tied to the session.
   • Encode all response data as Base64 before sending it to the browser.

3. A C application copies a length supplied by a remote client into a fixed size stack array without checking the destination capacity. What is the MOST direct security concern?

   • Inference from statistical database queries.
   • A replay attack against a serialized object.
   • A race condition caused by two users updating the same record.
   • A buffer overflow that corrupts memory and may alter control flow.

4. A file service checks that a requested path is inside an approved directory, then opens the path after a short delay. Which design change BEST addresses a time of check to time of use vulnerability?

   • Check authorization and open the file atomically using a safe handle-based mechanism.
   • Log the path check at debug level and retain the existing delay.
   • Increase the delay so monitoring tools have more time to inspect the path.
   • Have the client submit the canonical path twice, comparing the strings before the delayed file open.

5. A service deserializes objects supplied by an untrusted client using a framework that can invoke class methods during reconstruction. What is the FIRST risk treatment a security manager should require?

   • Reject untrusted deserialization or allowlist simple data types.
   • Increase the serialization compression level to reduce payload size.
   • Place the service behind a load balancer that distributes object reconstruction across application nodes.
   • Disable audit logging to prevent sensitive object fields from being recorded.

6. A database administrator must publish aggregate reports from a sensitive employee table. Which combination BEST reduces disclosure through aggregation and inference?

   • Give analysts unrestricted access to detailed employee rows, with confidentiality agreements and annual training.
   • Enforce minimum group sizes and query limits that prevent reconstruction of individual values.
   • Remove backups and permit unlimited ad hoc queries on the production database.
   • Use polyinstantiation for every report and disable all database constraints.

7. An API accepts a JSON request with an undocumented field that changes the account owner when mass assignment occurs. What is the BEST preventive control?

   • Require longer API keys for each client and rotate them annually.
   • Accept every field but hide undocumented fields in the API documentation.
   • Validate a request schema and map permitted fields to updates.
   • Rely on TLS because it protects the request while in transit.

8. A payment operation must either debit an account and record the ledger entry together, or make neither change. Which database property is MOST relevant?

   • Atomicity, which makes the transaction an all or nothing unit.
   • Polyinstantiation, which provides different rows to users at different classifications.
   • Inference control, which limits conclusions from query results.
   • Input canonicalization, which converts equivalent strings to one representation.

9. A critical open source library used by a customer portal receives a high severity vulnerability notice. What should the software security manager do FIRST?

   • Remove all open source software from the organization immediately.
   • Wait for an exploit to appear before changing the release plan.
   • Use the component inventory to identify affected usage, assess exposure, and prioritize risk-based remediation.
   • Patch the production operating system and mark the library finding resolved because its source is maintained externally.