D385 SOFTWARE SECURITY AND TESTING UPDATED
ACTUAL QUESTIONS AND CORRECT ANSWERS
Question:
1. What is the primary defense against log injection attacks?
Answer:
Sanitize outbound log messages
Question:
2. An attacker exploits a cross-site scripting vulnerability. What is the attacker able to do?
Answer:
Access the user's data
Question:
3. Which Python function is prone to a potential code injection attack?
Answer:
eval()
Question:
4. What are two common defensive coding techniques?
Answer:
Check functional preconditions and postconditions
Question:
5. Which package is meant for internal use by Python for regression testing?
Answer:
test
Question:
6. Which Python function is used for input validation?
Answer:
type()
Question:
7. A security analyst has noticed a vulnerability in which an attacker took over multiple users' accounts.
Which vulnerability did the security analyst encounter?
Answer:
Broken access control
Question:
8. When creating a new user, an administrator must submit the following fields to an API endpoint:
Name Email Address Password IsAdmin
What is the best way to ensure the API is protected against privilege escalation?
Answer:
Implement resource and field-level access control
, Question:
9. Which method is used for a SQL injection attack?
Answer:
Exploiting query parameters
Question:
10. Which response method, when sent a request, returns information about the server's response and is
delivered back to the console?
Answer:
response.content
Question:
11. What does cross-origin resource sharing (CORS) allow users to do?
Answer:
Override same starting policy for specific resources
Question:
12. Which protocol caches a token after it has been acquired?
Answer:
MSAL
Question:
13. OK - Your request was successful
Answer:
200
Question:
14. CREATED - Your request was accepted, and the resource was created
Answer:
201
Question:
15. BAD REQUEST - Your request is either wrong or missing information
Answer:
400
Question:
16. UNAUTHORIZED - Your request requires additional permissions
Answer:
401
Question:
17. FORBIDDEN - website can be reached, but more permissions needed before accessing further
Answer:
403
ACTUAL QUESTIONS AND CORRECT ANSWERS
Question:
1. What is the primary defense against log injection attacks?
Answer:
Sanitize outbound log messages
Question:
2. An attacker exploits a cross-site scripting vulnerability. What is the attacker able to do?
Answer:
Access the user's data
Question:
3. Which Python function is prone to a potential code injection attack?
Answer:
eval()
Question:
4. What are two common defensive coding techniques?
Answer:
Check functional preconditions and postconditions
Question:
5. Which package is meant for internal use by Python for regression testing?
Answer:
test
Question:
6. Which Python function is used for input validation?
Answer:
type()
Question:
7. A security analyst has noticed a vulnerability in which an attacker took over multiple users' accounts.
Which vulnerability did the security analyst encounter?
Answer:
Broken access control
Question:
8. When creating a new user, an administrator must submit the following fields to an API endpoint:
Name Email Address Password IsAdmin
What is the best way to ensure the API is protected against privilege escalation?
Answer:
Implement resource and field-level access control
, Question:
9. Which method is used for a SQL injection attack?
Answer:
Exploiting query parameters
Question:
10. Which response method, when sent a request, returns information about the server's response and is
delivered back to the console?
Answer:
response.content
Question:
11. What does cross-origin resource sharing (CORS) allow users to do?
Answer:
Override same starting policy for specific resources
Question:
12. Which protocol caches a token after it has been acquired?
Answer:
MSAL
Question:
13. OK - Your request was successful
Answer:
200
Question:
14. CREATED - Your request was accepted, and the resource was created
Answer:
201
Question:
15. BAD REQUEST - Your request is either wrong or missing information
Answer:
400
Question:
16. UNAUTHORIZED - Your request requires additional permissions
Answer:
401
Question:
17. FORBIDDEN - website can be reached, but more permissions needed before accessing further
Answer:
403
