Library

What is the primary goal of application security?

To protect software applications from threats, vulnerabilities, and attacks
To increase the speed of software development
To reduce the cost of software maintenance
To enhance user interface design

Which of the following is NOT a phase of the traditional SDLC model?

Planning
Analysis
Security Testing
Maintenance

What is the purpose of Multi-Factor Authentication (MFA)?

To add an extra layer of security by requiring users to provide two or more verification factors
To reduce the complexity of authentication processes
To make authentication processes more user-friendly
To increase the risk of unauthorized access

Which encryption method uses a pair of keys: a public key for encryption and a private key for decryption?

Symmetric Encryption
Hashing
Token-based Encryption
Asymmetric Encryption

What is the primary purpose of a SIEM system?

To design secure software architectures
To develop new security software
To monitor and analyze security-related data
To manage user access controls

Which type of XSS stores the malicious script on the target server?

Reflected XSS
Persistent XSS
Stored XSS
DOM-based XSS

What is the main goal of penetration testing?

To enhance software performance
To reduce software development time
To identify vulnerabilities in the security posture
To increase user satisfaction

Which of the following is NOT a key element of an incident response plan?

Detection and Analysis
Preparation
Post-Incident Activity
Log Management

What is the primary benefit of using AI and ML in security?

To enable security systems to learn from data and make predictions
To increase the risk of security breaches
To make security systems more complex
To reduce the need for human intervention

Which of the following is a unique challenge in securing serverless applications?

Reduced software performance
Enhanced user interface design
Increased software development time
Isolation and Segmentation

Which phase of the SDLC involves defining the project scope, objectives, and requirements?

Implementation
Planning
Analysis
Design

What is the primary goal of the Analysis phase in the SDLC?

Releasing the software to the production environment
Creating system architecture
Coding and developing the software
Gathering and documenting detailed requirements

Which activity is part of integrating security into the SDLC and involves identifying security requirements?

Threat Modeling
Secure Design Principles
Security Training
Security Requirements Gathering

What is the purpose of threat modeling in the SDLC?

Implementing proper error handling
Identifying potential threats and vulnerabilities in the system design
Conducting security testing
Providing security training

Which best practice involves validating all inputs to ensure they meet expected formats and values?

Error Handling
Output Encoding
Secure Dependency Management
Input Validation

What is the primary benefit of integrating security into the SDLC?

Identifying and mitigating security vulnerabilities early in the development cycle
Ensuring faster deployment
Improving customer satisfaction
Reducing the cost of software development

Which phase of the SDLC involves releasing the software to the production environment?

Planning
Deployment
Testing
Maintenance

What is the purpose of secure dependency management in the SDLC?

Implementing proper error handling
Avoiding introducing known vulnerabilities into the project
Conducting regular code reviews
Using SAST tools

Which activity is part of secure coding practices and involves encoding outputs to prevent injection attacks?

Output Encoding
Secure Dependency Management
Input Validation
Error Handling

What is the role of security training in the SDLC?

Ensuring development teams are aware of security best practices
Creating system architecture
Conducting security testing
Identifying potential threats

What is the primary purpose of authentication in application security?

Verifying the identity of a user
Monitoring network traffic for threats
Determining what resources a user can access
Encrypting data during transmission

Which of the following is NOT a type of authentication mechanism?

Knowledge-based Authentication
Password-based Authentication
Token-based Authentication
Biometric Authentication

What does MFA stand for in the context of authentication?

Multi-Factor Authentication
Master File Authentication
Multi-Level Authentication
Multiple Factor Authentication

Which factor is an example of 'Something you have' in MFA?

Fingerprint scan
A security question
A mobile device
A password

What is the primary goal of authorization in application security?

Monitoring network traffic for threats
Determining what authenticated users are allowed to do
Encrypting data during transmission
Verifying the identity of a user

Which authorization model grants access based on user attributes?

Discretionary Access Control (DAC)
Role-Based Access Control (RBAC)
Mandatory Access Control (MAC)
Attribute-Based Access Control (ABAC)

What does OAuth primarily allow?

Applications to encrypt data
Users to authorize access to their resources
Users to authenticate themselves
Third-party applications to access user resources without exposing user credentials

Which protocol extends OAuth 2.0 to provide authentication?

OpenID Connect
OAuth
Kerberos
SAML

What is the primary purpose of data classification in application security?

To delete all data to save storage space.
To encrypt all data regardless of its sensitivity.
To make all data publicly accessible.
To determine the appropriate level of protection needed based on data sensitivity and importance.

Which of the following is NOT a common data classification level?

Confidential
Secret
Internal
Public

What is the primary difference between symmetric and asymmetric encryption?

Symmetric encryption is more secure than asymmetric encryption.
Symmetric encryption is used for data in transit, while asymmetric encryption is used for data at rest.
Symmetric encryption is faster than asymmetric encryption.
Symmetric encryption uses the same key for both encryption and decryption, while asymmetric encryption uses a pair of keys.

Which encryption method is typically used for data integrity verification?

Hashing
Asymmetric Encryption
Symmetric Encryption
Tokenization

Which regulation requires organizations to notify authorities of data breaches within 72 hours?

SOX
CCPA
HIPAA
GDPR

What does pseudonymization involve?

Storing personal data in plaintext.
Completely removing identifying information.
Encrypting all personal data.
Replacing identifying information with pseudonyms.

Which of the following is a key provision of the CCPA?

The requirement to delete all personal data upon request.
The mandate to make all data publicly accessible.
The right to know what personal information is collected about them.
The obligation to encrypt all data using symmetric encryption.

What is the primary goal of data minimization?

To delete all data to save storage space.
To make all data publicly accessible.
To encrypt all data regardless of its relevance.
To collect and process only the data absolutely necessary for a specific purpose.

Which encryption method uses a public key for encryption and a private key for decryption?

Tokenization
Symmetric Encryption
Hashing
Asymmetric Encryption

What is the primary purpose of anonymization?

To encrypt all personal data.
To completely remove identifying information.
To replace identifying information with pseudonyms.
To store personal data in plaintext.

What is the primary goal of input validation?

To increase the speed of data processing
To make the application look more attractive
To minimize the use of system resources
To ensure that the data received from users is safe and expected

Which of the following is a common input validation technique?

Data Type Validation
Data Compression
Data Deletion
Data Encryption

What is the purpose of output encoding?

To make the application look more attractive
To convert data into a format that is safe for inclusion in different contexts
To increase the speed of data transmission
To minimize the use of system resources

Which of the following is a common output encoding technique?

Data Compression
Data Encryption
HTML Encoding
Data Deletion

What is the primary goal of error handling and logging?

To identify and address issues in an application
To make the application look more attractive
To minimize the use of system resources
To increase the speed of data processing

Which of the following is a key practice in secure error handling?

Data Encryption
Data Compression
Data Deletion
Sensitive Information Protection

What is the primary goal of secure dependency management?

To increase the speed of data processing
To make the application look more attractive
To minimize the use of system resources
To manage dependencies to ensure they are secure and up-to-date

Which of the following is a key practice in secure dependency management?

Data Encryption
Regular Updates
Data Compression
Data Deletion

What is the benefit of input validation in preventing common attacks?

It increases the speed of data processing
It makes the application look more attractive
It minimizes the use of system resources
It prevents many common attacks such as SQL injection, cross-site scripting (XSS), and buffer overflows

What is the benefit of output encoding in protecting applications?

It increases the speed of data transmission
It minimizes the use of system resources
It makes the application look more attractive
It protects applications from attacks like XSS and ensures that user data is displayed as intended

Which of the following is NOT listed as one of the OWASP Top 10 web application security risks?

Broken Authentication
Cross-Site Request Forgery (CSRF)
Sensitive Data Exposure
Injection

What is the primary goal of using prepared statements with parameterized queries to prevent SQL Injection?

To encrypt SQL queries
To obfuscate SQL code
To disable SQL features
To separate SQL code from data

Which type of XSS vulnerability exists in the client-side code rather than the server-side code?

Stored XSS
Reflected XSS
Server-side XSS
DOM-based XSS

What is the primary method to mitigate CSRF attacks?

Blocking all external requests
Using anti-CSRF tokens
Using only HTTPS
Disabling JavaScript

Which of the following is a common web hacking technique that can destroy a database?

SQL Injection
Cross-Site Scripting (XSS)
Broken Access Control
Cross-Site Request Forgery (CSRF)

What is the main type of XSS where the malicious script is permanently stored on the target server?

Stored XSS
Reflected XSS
Persistent XSS
DOM-based XSS

Which of the following is a best practice to prevent XSS?

Using Content Security Policy (CSP)
Ignoring user inputs
Disabling client-side scripting
Using only server-side rendering

What is the primary method to verify the origin of requests in the context of CSRF mitigation?

Checking the HTTP Referer header
Disabling cookies
Using only GET requests
Ignoring request origins

Which of the following is a technique to protect against SQL Injection by automatically handling escaping and quoting?

Disabling SQL features
Using ORM tools
Writing custom SQL parsers
Manually escaping all inputs

What is the main type of XSS where the malicious script is reflected off a web server?

Echo-based XSS
Stored XSS
DOM-based XSS
Reflected XSS

Which of the following is NOT a key threat to mobile applications?

Cross-Site Scripting (XSS)
Malware
Supply Chain Attacks
Phishing

What technique is used to gain administrative control over a mobile device?

Supply Chain Attacks
Malware
Phishing
Rooting/Jailbreaking

Which of the following is a key component of a secure mobile architecture?

Phishing
Malware
Secure Data Storage
Supply Chain Attacks

What is the primary goal of mobile code obfuscation?

To make the code harder to understand and exploit
To increase app performance
To reduce app size
To enhance user interface

Which feature is provided by Mobile Device Management (MDM) solutions?

Supply Chain Attacks
Phishing
Malware
Remote Wipe

Which encryption technique is commonly used to protect data during transmission in mobile applications?

SHA-1
MD5
AES
HTTPS

What is the primary purpose of applying security policies in MDM?

To reduce app development time
To increase app download rates
To enforce security measures on mobile devices
To enhance user experience

Which of the following is a common obfuscation technique used in mobile apps?

Supply Chain Attacks
Phishing
Control Flow Flattening
Malware

What is the main advantage of using biometrics for mobile authentication?

Higher development costs
Increased app complexity
Reduced user convenience
Enhanced security through unique identification

Which of the following is NOT a feature of MDM?

Remote Wipe
Compliance Reporting
Cross-Site Scripting (XSS)
Policy Enforcement

Which of the following is NOT a common authentication method for APIs?

Session Cookies
JSON Web Tokens (JWT)
OAuth
API Keys

What is the primary purpose of rate limiting in API security?

To enforce fair usage policies
To prevent Denial of Service (DoS) attacks
To encrypt data in transit
To integrate with Web Application Firewalls (WAF)

Which of the following is a key security feature of API gateways?

Database Management
SSL/TLS Termination
User Interface Design
Network Routing

Which design principle involves granting only the necessary permissions to access API resources?

Least Privilege
Use Standard Protocols
Fail-Safe Defaults
Keep it Simple

What is the purpose of OAuth in API authentication?

To enforce fair usage policies
To manage resource usage efficiently
To encrypt data in transit
To allow third-party services to access your API on behalf of a user

Which of the following is a popular authorization model used to enforce fine-grained access control?

Mandatory Access Control (MAC)
Attribute-Based Access Control (ABAC)
Role-Based Access Control (RBAC)
Discretionary Access Control (DAC)

What is the primary benefit of using JSON Web Tokens (JWT) for API authentication?

To manage resource usage efficiently
To allow third-party services to access your API on behalf of a user
A compact, URL-safe means of representing claims to be transferred between two parties
Simple and easy to implement

Which algorithm is commonly used for rate limiting?

Fixed window
Token bucket
Sliding window
All of the above

What does SSL/TLS Termination in API gateways primarily protect against?

Cross-Site Scripting (XSS)
Denial of Service (DoS) attacks
SQL Injection
Eavesdropping and man-in-the-middle attacks

Which design principle suggests denying access by default and granting access explicitly?

Keep it Simple
Use Standard Protocols
Least Privilege
Fail-Safe Defaults

What is the first step in an incident response plan?

Preparation
Post-Incident Activity
Containment, Eradication, and Recovery
Detection and Analysis

Which of the following is NOT a key element of an incident response plan?

Detection and Analysis
Containment, Eradication, and Recovery
Log Aggregation
Preparation

What is the primary purpose of a Security Information and Event Management (SIEM) system?

Centralizing logs from different sources for analysis
Monitoring and analyzing security-related data
Ensuring adherence to regulatory requirements
Generating alerts for suspicious activities

Which of the following is a best practice for log management?

Centralized Logging
Regular Audits
Log Analysis Tools
Log Retention Policies

What is the main goal of penetration testing and red teaming?

Building skills and awareness
Validating incident response plans
Enhancing security posture
Identifying vulnerabilities and testing incident response capabilities

Which phase of the incident response plan involves isolating affected systems, removing threats, and restoring normal operations?

Detection and Analysis
Containment, Eradication, and Recovery
Preparation
Post-Incident Activity

What do regular drills and simulations help ensure in an incident response plan?

Effectiveness of the incident response plan and preparedness of team members
Documentation of the incident
Removal of threats from affected systems
Identification of suspicious activities

Which feature of SIEM systems helps in detecting anomalies by identifying patterns and relationships between events?

Event Correlation
Alerting and Reporting
Log Aggregation
Compliance and Auditing

What is the purpose of log retention policies in log management?

Collecting logs from all critical systems and applications in a centralized location
Conducting regular audits to ensure logs are being managed and analyzed effectively
Defining retention periods based on compliance requirements and analytical needs
Using tools to automate the analysis of logs

Which of the following is NOT a benefit of penetration testing and red teaming?

Enhancing security posture
Centralizing logs from different sources for analysis
Validating incident response plans
Identifying vulnerabilities

Which of the following is NOT a benefit of using Artificial Intelligence (AI) and Machine Learning (ML) in application security?

Identifying vulnerabilities in code
Automating responses to security incidents
Reducing the complexity of threats
Enabling real-time threat detection

What is a key challenge in securing serverless applications?

Reducing the attack surface
Implementing strong encryption
Ensuring isolation and segmentation of serverless functions
Using traditional security measures

Which of the following is a best practice for securing Internet of Things (IoT) devices?

Relying solely on cloud security
Ignoring network segmentation
Avoiding data protection measures
Implementing strong authentication and encryption

How can blockchain technology enhance security in application security?

Eliminating all security risks
Creating a tamper-evident and transparent system for data sharing
Being a standalone solution
Reducing the need for traditional security measures

Which of the following is a concern when using AI and ML in security?

The ability to detect all threats
Bias in AI models
The simplicity of AI solutions
The elimination of human oversight

What is a key aspect of serverless security?

Implementing the principle of least privilege
Relying on third-party security
Ignoring monitoring and logging
Using only open-source tools

Which of the following is a benefit of using blockchain for identity management?

Being a standalone identity solution
Giving users control over their digital identities
Eliminating the need for passwords
Reducing the complexity of identity management

What is a key aspect of securing IoT devices?

Isolating IoT devices on separate networks
Avoiding data encryption
Relying on cloud security alone
Ignoring firmware updates

Which of the following is a use case for blockchain in application security?

Eliminating the need for supply chain security
Reducing the complexity of supply chain management
Enhancing transparency and traceability in supply chains
Being a standalone supply chain solution

What is a key aspect of AI and ML in application security?

Ignoring historical data
Relying on manual threat detection
Using only open-source tools
Analyzing vast amounts of data to detect anomalies

Cybersecurity: Application Security

Chapter 1: Introduction

Chapter 2: Secure Software Development Lifecycle (SDLC)

Chapter 3: Authentication and Authorization

Chapter 4: Data Protection and Privacy

Chapter 5: Secure Coding Practices

Chapter 6: Web Application Security

Chapter 7: Mobile Application Security

Chapter 8: API Security

Chapter 9: Incident Response and Security Monitoring

Chapter 10: Emerging Trends in Application Security

Readings

Gallery