Application Security

Question 1 of 6

A development team wants to discover input validation gaps before deploying a new web application. They use an automated tool that generates thousands of unexpected, malformed, and boundary-value inputs — including oversized strings, null bytes, special characters in numeric fields, and negative numbers where positive values are expected — and submits them to the application to observe crashes or unexpected behavior. What technique is this?

Static Application Security Testing (SAST) Fuzz testing Code signing verification Normalization

Question 2 of 6

A web application sets a session cookie after successful login. A security auditor finds that the cookie lacks the Secure attribute. What specific risk does this create?

Attackers can run the cookie as executable code to compromise the server The session cookie may be transmitted over HTTP connections, where a network attacker can capture it and use it to hijack the authenticated session The cookie will expire immediately after the browser window is closed JavaScript on the page can read and modify the cookie content

Question 3 of 6

A SAST tool scans an application and flags a call to gets() as a potential buffer overflow vulnerability. The same application uses AES encryption with a 128-bit key and a hardcoded initialization vector (IV) that never changes across sessions — a serious cryptographic flaw. Which of these two vulnerabilities will the SAST tool most likely identify?

The hardcoded IV cryptographic flaw only — cryptographic errors are SAST's primary detection target The gets() buffer overflow only — SAST identifies unsafe function calls as code patterns, but cannot evaluate whether a cryptographic implementation is correct Both vulnerabilities — SAST comprehensively finds all security flaws in source code Neither — SAST requires a running application to identify vulnerabilities

Question 4 of 6

A user downloads a software update from a vendor's website. Before installation, the operating system verifies the code signing signature and displays a warning: "The digital signature of this file is invalid." What does this warning most likely indicate, and what should the user do?

The software requires administrator privileges to install — the user should right-click and select "Run as Administrator" The software file has been modified since it was signed by the developer — the user should not proceed and should obtain the installer from the official source The software's certificate has a stronger encryption algorithm than the OS supports — the update should be applied to the OS first The software is too large for the current version of the OS to verify — splitting the installer into smaller parts will resolve the issue

Question 5 of 6

An attacker exploits a vulnerability in a mobile banking app's PDF viewer feature. They achieve code execution within the PDF viewer process. Despite this, they cannot access the user's stored account credentials in the banking app's secure storage, cannot read messages from the messaging app, and cannot silently activate the microphone. Which security control most directly limited the attacker's capabilities after exploitation?

Input validation — rejecting malformed PDF input before exploitation Code signing — verifying the app's integrity before execution Sandboxing — the mobile OS isolates each app and feature in its own restricted permission boundary SAST — the vulnerability was identified during development but marked as a false positive

Question 6 of 6

An application security monitoring system generates an alert: in the past 10 minutes, a single user account has made 847 requests to the application — compared to a baseline of fewer than 30 per 10-minute period for this user. The account is attempting to access administrative endpoints it has never accessed before. Which monitoring capability detected this, and what does the pattern most likely indicate?

Audit logging — this is normal administrative activity and the log is a compliance record Anomaly detection — the dramatic deviation from baseline behavior suggests the account has been compromised or the user is conducting unauthorized reconnaissance Fuzzing — the application is automatically testing its own endpoints Code signing verification — the application is checking the authenticity of user requests

Matching

1. A developer's automated build pipeline runs a security scan on every code commit. After one commit, the scan flags line 203 as using a function that performs no bounds checking on the destination buffer, recommending a safer alternative.

2. A web application rejects any username containing single quotes, double dashes, or semicolons, returns an error message asking the user to re-enter valid characters, and normalizes all input by decoding percent-encoded characters before applying the character check.

3. A mobile gaming app has been granted permission to use the device's display and speakers. When the app is compromised through a malicious in-game ad, the attacker can manipulate the game but cannot read the user's contact list, access their photos, or interact with other installed applications.

4. Before a software installer executes, the operating system uses the application's attached certificate (issued by a trusted CA) and the developer's public key to verify that the installer binary matches the hash the developer computed when they released it.

1. 2. 3. 4.

A. SAST

B. Input validation

C. Sandboxing

D. Code signing

Application Security — Quiz

Matching