1
SECURE CODING FINAL EXAM QUESTIONS AND
ANSWERS 2026-27 LATEST UPDATED STUDY GUIDE
What are the two high-level approaches to make web apps stateful? -
1. Set session IDs (SIDs)
2. Use web-app framework to send state to client and have client send
state back to server.
Examples of why states are good in client/server model: - Banking,
online shopping carts
Client state manipulation - Web app attacks in which an attacker
modifies a state stored on the client and returns to the server
,2
Defend against client state manipulation: - 1. Keep states on server side
(send client SID)
2. Send state to client using cryptography to enforce state integrity
Session hijacking - An attack in which an attacker attempts to
impersonate the user by using his SID
Session-fixation attack - Attacker tricks the user to access a genuine
web server using an explicit session ID value, and then the attacker
assumes the identity of the victim and exploits their credentials at the
server.
Defenses against session attacks - 1. Dont put SIDS in URLs (Instead,
use POST variables)
2. Expire SIDs
3. Hash SIDS and client info
4. Use cookies
Cookies - A state passes between communicating processes.
Server can set SID cookies (e.g by returning for the confirmation page)
XSRF - Cross-Site Request Forgery (similar to confused deputy)
Attack in which a privileged client (victim) sends a request (i.e transfer
$) on behalf of a less privileged 3rd party (attacker)
XSRF Defenses - 1. Server may confirm/reauthenticate user before
satisfying sensitive requests
2. Server embeds a hidden, hard to guess (cryptograph) token in all
HTML forms and only satisfies requests with the proper tokens
Proper tokensq - Request comes from returned webpage, not attacker
OWASP top 10 - Open web app security project
, 3
Database - Organized collection of data
DBMS - software for managing the database
Relational Database - Data is organized into tables (i.e. relations) of
rows and columns with a unique key identifying each row
Logical schema - Defines types and names
Physical schema - Defined data layout
SECURE CODING FINAL EXAM QUESTIONS AND
ANSWERS 2026-27 LATEST UPDATED STUDY GUIDE
What are the two high-level approaches to make web apps stateful? -
1. Set session IDs (SIDs)
2. Use web-app framework to send state to client and have client send
state back to server.
Examples of why states are good in client/server model: - Banking,
online shopping carts
Client state manipulation - Web app attacks in which an attacker
modifies a state stored on the client and returns to the server
,2
Defend against client state manipulation: - 1. Keep states on server side
(send client SID)
2. Send state to client using cryptography to enforce state integrity
Session hijacking - An attack in which an attacker attempts to
impersonate the user by using his SID
Session-fixation attack - Attacker tricks the user to access a genuine
web server using an explicit session ID value, and then the attacker
assumes the identity of the victim and exploits their credentials at the
server.
Defenses against session attacks - 1. Dont put SIDS in URLs (Instead,
use POST variables)
2. Expire SIDs
3. Hash SIDS and client info
4. Use cookies
Cookies - A state passes between communicating processes.
Server can set SID cookies (e.g by returning for the confirmation page)
XSRF - Cross-Site Request Forgery (similar to confused deputy)
Attack in which a privileged client (victim) sends a request (i.e transfer
$) on behalf of a less privileged 3rd party (attacker)
XSRF Defenses - 1. Server may confirm/reauthenticate user before
satisfying sensitive requests
2. Server embeds a hidden, hard to guess (cryptograph) token in all
HTML forms and only satisfies requests with the proper tokens
Proper tokensq - Request comes from returned webpage, not attacker
OWASP top 10 - Open web app security project
, 3
Database - Organized collection of data
DBMS - software for managing the database
Relational Database - Data is organized into tables (i.e. relations) of
rows and columns with a unique key identifying each row
Logical schema - Defines types and names
Physical schema - Defined data layout
