20 Jun 2012

Secure Coding Quiz

Thank you for taking the Secure Coding Quiz. For a better idea of application security, please download our free product ThreatModeler to learn more about threat modeling and building secure applications.

 



Secure Coding Quiz

Please wait while the activity loads.
If this activity does not load, try refreshing your browser. Also, this page requires javascript. Please visit using a browser with javascript enabled.
If loading fails, click here to try again

Congratulations – you have completed Secure Coding Quiz.

You scored %%SCORE%% out of %%TOTAL%%.

Your performance has been rated as %%RATING%%

Your answers are highlighted below.

Question 1
How do you implement efficient error handling?
A
Give verbose error messages to help obtain necessary technical feedback.
B
Generic error messages without any information on the type of error or stack traces
C
Redirect user to homepage
Question 2
What is the practice of encoding data to a common character set before validation formally known as?
A
Sanitization
B
Encryption
C
Canonicalization
D
Input Validation
Question 3
Before embedding data into an HTTP response header, validating input for CR/LFs would help mitigate against:
A
Brute Force Attack
B
Remote File Inclusion
C
Cross Site Request Forgery
D
HTTP Response Splitting
Question 4
For limited input type, what security measure is most viable as input validation?
A
Output Encoding
B
Blacklist: Create a list of known bad values
C
Prepared Statements
D
Create a list of legitimate values that a user is allowed to specify
Question 5
Why do you require to change the Session ID after Login?
A
To prevent XSS
B
To Prevent Cross Site Request Forgery
C
To Prevent SQL Injection
D
To prevent Session Fixation
Question 6
Which of the following should be avoided as a security measure?
A
Encryption
B
Blacklisting
C
Whitelisting
D
Parameterized Queries
Question 7
To harden your system against a Path Traversal attack, the following is considered a good practice
A
Using Parameterized Queries
B
Transfer data in a POST request
C
Generate a new session identifier to force change from HTTP to HTTPS and deactivate the old one.
D
Use a chrooted environment on the directory containing your application files
Question 8
For output data as input to another module of the application or to the underlying OS, what would be appropriate?
A
Per-request session token
B
Implement application at least privilege
C
Transfer data using HTTP POST method
D
Validate all Input
Question 9
Best practice for secure coding against SQL Injection attacks?
A
Use of Parameterized Queries.
B
Lowering application privileges
C
Database hardening
D
Use of Stored Procedures
Question 10
Consider the scenario where a developer uses a cookie to count failed login attempts to implement account lockout against a brute force attack. How can this measure be bypassed?
A
Attacker will attempt a session fixation attack
B
Account Lockout will cause a denial of service thus helping the attacker
C
User can manipulate the cookie
Question 11
For a web mail application that handles form input and displays them in the browser, what threat are you at risk of?
A
CSRF
B
XSS
C
Remote File Inclusion
D
SQL Injection
Question 12
For a centralized input validation component, what is the area at which you redirect input data for validation?
A
Client Side Form
B
Trust Boundary
C
At the database
D
At the communication medium
Question 13
The use of a Canary value is a safeguard against what type of attack?
A
Buffer Overflow by stack smashing
B
Brute Force
C
Denial of Service
D
Heap Overflow
Question 14
Failure of handling of concurrent requests by a process dependent on a sequence or timing of events leads to:
A
Session Fixation
B
SQL Injection
C
Brute Force Attack
D
Race Condition
Question 15
The best way to implement input validation is by:
A
Server Side Blacklisting
B
Client Side Input Validation
C
Server Side Whitelisting
D
Encrypted communications
Once you are finished, click the button below. Any items you have not completed will be marked incorrect.
Get Results


There are 15 questions to complete.
List

Return

Shaded items are complete.
1 2 3 4 5
6 7 8 9 10
11 12 13 14 15
End
Return


Leave a Reply