Examkin

Soru

Zorluk: KolayApplication and Software Vulnerabilities

A web application developer wants to remediate software vulnerabilities that allow attacker-controlled inputs to execute malicious scripts in user browsers or alter database commands. Which of the following secure coding practices should the developer implement to address these application vulnerabilities? (Select TWO.)

  1. Context-aware output encoding before rendering user input in HTML responsesCevap
  2. Parameterized queries and prepared statements for all database operationsCevap
  3. C
    Deploying network-level stateful firewalls at the enterprise perimeter
  4. D
    Using role-based access control (RBAC) to authenticate user credentials during session initiation

Cevap

The correct secure coding practices are context-aware output encoding and parameterized queries with prepared statements.
Context-aware output encoding neutralizes script execution to mitigate Cross-Site Scripting (XSS), while parameterized queries isolate user data from executable SQL commands to mitigate SQL Injection (SQLi). Both are essential application-level secure coding practices.

Adım Adım Çözüm

1
Identify the target application vulnerability types described in the scenario.
Executing scripts in browsers indicates Cross-Site Scripting (XSS), and altering database commands indicates SQL Injection (SQLi).
Accurate identification of vulnerability mechanisms is required to select effective code-level mitigations.
2
Select the appropriate mitigation control for client-side script execution (XSS).
Context-aware output encoding neutralizes special characters so the browser treats input purely as display text.
Encoding prevents script tags from executing in the web browser context.
3
Select the appropriate mitigation control for database command alteration (SQLi).
Parameterized queries ensure database engines treat user input strictly as parameter values rather than executable SQL syntax.
Prepared statements prevent input strings from redefining query logic.

Anahtar Kavram

Application Software Vulnerability Remediation and Secure Coding
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru