Software Development Security

Which secure software development practice involves validating all input on the server side and rejecting data that does not conform to an explicit list of acceptable values?

• A Output encoding
• B Allow-list (whitelist) input validation ✓
• C Obfuscation
• D Code signing

Answer: Allow-list input validation accepts only data matching a predefined set of permitted values, which is more secure than trying to block known-bad input.

A web application allows attackers to inject malicious SQL because user input is concatenated directly into database queries. Which control is the MOST effective defense?

• A Disabling logging on the database
• B Renaming the database tables
• C Increasing the database server's RAM
• D Using parameterized queries (prepared statements) ✓

Answer: Parameterized queries separate code from data so user input is treated strictly as a value, preventing SQL injection.

In the OWASP context, which attack injects malicious scripts into a trusted website so they execute in other users' browsers, potentially stealing session cookies?

• A Server-Side Request Forgery (SSRF)
• B SQL injection
• C Cross-Site Scripting (XSS) ✓
• D Cross-Site Request Forgery (CSRF)

Answer: Cross-Site Scripting (XSS) injects scripts into a trusted page that then run in victims' browsers, often used to steal session tokens.

Which software development methodology emphasizes building security in from the start by integrating security activities such as threat modeling and code review into each phase of the SDLC?

• A Ad hoc development
• B Big-bang integration
• C Waterfall with security only at deployment
• D DevSecOps ✓

Answer: DevSecOps integrates security practices like threat modeling and continuous testing throughout the development pipeline rather than bolting them on at the end.

A database enforces that a transaction either completes entirely or has no effect at all, leaving the database unchanged if any part fails. Which ACID property describes this guarantee?

• A Isolation
• B Durability
• C Atomicity ✓
• D Consistency

Answer: Atomicity guarantees that all operations within a transaction succeed together or none take effect, treating the transaction as an indivisible unit.

A developer accidentally commits an API secret key to a public code repository. Which secure development practice would have BEST prevented this exposure?

• A Storing secrets in environment variables or a secrets manager and scanning commits ✓
• B Adding more code comments
• C Increasing the application's logging verbosity
• D Renaming the variable holding the key

Answer: Keeping secrets out of source code by using a secrets manager or environment variables, combined with pre-commit secret scanning, prevents credentials from being committed.