Join our channel if you haven’t joined yet https://t.
me/fresco_milestone ( @fresco_milestone )
Secure Programming Practices
Which of the following is true about improper error handling?
Answer : All the above options
Which of the following statement is not true regarding Error Handling and Logging?
Answer : All the above statements are true. (Incorrect)
Exception Handling refers to:
Answer : All the above options
Which of the following is not an appropriate method to make an authentication mechanism secure?
Answer: Providing default access.
When valuable information has to be transmitted as part of a client request, which of the following
mode should be used?
Answer : POST method with a suitable encryption mechanism
Which of the following methods can be used by the client and server to validate user input?
Answer : E) A) and B)
Which of the following is not recommended to secure web applications against authenticated users?
Answer: Client-side data validation
There are various HTTP authentication mechanisms to authenticate a user. Login credentials are sent
to the web server in clear text, in which of the following authentication scheme?
Answer: Basic
A race condition in a web server can cause which of the following?
Answer : E) Both A) and C)
What is the purpose of Audit Trail and Logging?
Answer : All the above options
Which of the following is not an authentication method?
Answer: Cookie-based
Temporarily files created by applications can expose confidential data if:
Answer: File permissions are not set appropriately
Join our channel if you haven’t joined yet https://t.me/fresco_milestone ( @fresco_milestone )
Which of the following are secure programming guidelines?
Answer : E) A), B) and C)
To improve the overall quality of web applications, developers should abide by which of the
following rules?
Answer : Clean and validate all user input
Setting the cookie flag to which of the following mode is a good programming practice?
Answer : Secure
Security check can be enforced at compile time by:
Answer : E) A) and C)
Which of the following is a best practice for Audit Trail and Logging?
Answer : Restrict the access level of configuration and program-level resources. & All the above
options(incorrect)
Which of the following is a security advantage of managed code over unmanaged code?
Answer : Size of the attack surface
Set2:
Identify the correct statement in the following:
Answer : Unclear security requirements and inadequate security reviews are the primary reasons for
security issues. (Incorrect)
Secure practices for access control include which of the following?
Answer : ALl
Identify the correct statement in the following:
Answer : Logic bomb is an unintentional weakness.
Which of the following is not an authorization type?
Answer : User Access Control
Which of the followings are secure programming guidelines?
Answer : A, B & C
Which of the following is the best approach to use when providing access to an SSO application in a
portal?
Answer : Role-based access control
Join our channel if you haven’t joined yet https://t.me/fresco_milestone ( @fresco_milestone )
Authentication and session management are security concerns of which of the following
programming languages?
Answer : All
From application security perspective, why should a CAPTCHA be used in a web application?
Answer : To prevent scripted attacks
Temporarily files created by applications can expose confidential data if:
Answer : File permissions are not set appropriately
Securing a database application with username/password access control should be considered
sufficient:
Answer : Only when combined with other controls
In a multi-staged login mechanism, which of the following regarding application security should be
ensured by the developer?
Answer : The application should validate the credentials supplied at each stage and the previous
stages.
Identify the correct statement in the following:
Development teams need not worry about rework due to security vulnerability.
High vulnerability can be ignored, and software can be released to the customer.
A firewall is the best protection against application attacks.
Answer : None of the above options.
Which of the following statement is not true regarding Error Handling and Logging?
Answer : Never implement a generic error page.
Identify the correct statement in the following:
Answer : E) A and B
