Covers application security fundamentals, secure design and requirements gathering, secure coding for input validation, authentication, cryptography, and session and error handling in .NET.
12 free sample questions138 in the full practice test
Understanding Application Security, Threats, and Attacks · Application Security Fundamentals
A financial institution is mapping out their application security posture. The CISO wants to ensure the team understands the difference between network-level and application-level threats. Which of the following attack vectors strictly targets the application layer by exploiting insecure coding practices rather than infrastructure misconfigurations?
Answer and explanation
Correct answer: A
XML External Entity (XXE) injection is a direct application-layer attack that exploits poorly configured XML parsers in the application code, allowing attackers to view files on the application server filesystem or interact with backend systems. SYN Flood and BGP Hijacking are network-layer attacks, while ARP Spoofing targets the data link layer. Understanding this distinction is critical for deploying appropriate defense-in-depth strategies at the application level.
Q2Question 2
Intermediate
Understanding Application Security, Threats, and Attacks · SDLC Security Integration
An organization is adopting the Microsoft Security Development Lifecycle (SDL) for their new ASP.NET Core project. The development team has just completed the 'Design' phase and is moving into the 'Implementation' phase. According to the Microsoft SDL, which specific security activity MUST be prioritized during this new phase?
Answer and explanation
Correct answer: A
In the Microsoft SDL, the Implementation phase strictly requires developers to use approved tools/compilers, deprecate unsafe functions (like older cryptographic algorithms or unmanaged unsafe code), and perform Static Application Security Testing (SAST). Threat modeling belongs to the Design phase. Dynamic analysis and fuzz testing belong to the Verification phase. Incident Response planning belongs to the Release phase.
flowchart LR
A[Design] -->|Transitions to| B[Implementation]
B --> C[Use Approved Tools]
B --> D[Deprecate Unsafe Functions]
B --> E[Static Analysis]
Q3Question 3
IntermediateMultiple answers
Understanding Application Security, Threats, and Attacks · Application Security Fundamentals
A .NET engineering team is reviewing their legacy application against the OWASP Top 10 guidelines. They discover that the application relies heavily on BinaryFormatter for transmitting serialized state between microservices. Which TWO immediate security risks are introduced by this architecture? (Select TWO)
Answer and explanation
Correct answers: A, C
BinaryFormatter is notoriously unsafe and is heavily deprecated in modern .NET because it can instantiate arbitrary types present in the application's loaded assemblies. An attacker can craft a malicious serialized payload that, when deserialized, executes arbitrary code (RCE). Additionally, it can lead to Denial of Service (DoS) by allocating massive objects or causing infinite loops during the deserialization process. It does not inherently cause SQL injection or direct DOM-based XSS.
Q4Question 4
Beginner
Understanding Application Security, Threats, and Attacks · SDLC Security Integration
True or False: In a secure Software Development Life Cycle (SDLC), defining Role-Based Access Control (RBAC) matrices and specifying encryption algorithms for data at rest are considered functional activities rather than security activities.
Answer and explanation
Correct answer: B
False. Defining RBAC matrices and specifying encryption algorithms are explicitly security activities (or security requirements). Functional activities describe what the system should do for the user (e.g., 'The system must allow a user to add items to a cart'), whereas security activities dictate how the system must protect itself and its data (e.g., 'The system must encrypt cart data using AES-256').
A development team is using the SQUARE (Security Quality Requirements Engineering) model to identify and prioritize security requirements for a new financial portal. They have just completed 'Step 3: Develop artifacts' which included creating architecture diagrams and use cases. What is the immediate next step in the SQUARE methodology?
Answer and explanation
Correct answer: D
The SQUARE methodology consists of 9 steps. Step 1 is Agree on definitions. Step 2 is Identify security goals. Step 3 is Develop artifacts. Step 4 is Perform risk assessment. After developing the artifacts, the team must assess the risks to identify vulnerabilities and threats before selecting elicitation techniques (Step 5) and actually eliciting the security requirements (Step 6).
A large healthcare provider is initiating a major overhaul of their patient management system. The organization handles highly sensitive Protected Health Information (PHI) and relies on a mix of legacy on-premises servers and modern cloud infrastructure.
The Chief Information Security Officer (CISO) mandates a robust, organizational-wide risk assessment before any code is written. The chosen methodology must be self-directed, focus heavily on organizational risks rather than just technological flaws, and specifically build asset-based threat profiles as its primary foundation.
The security engineering team is evaluating different requirement and risk models. They need a framework that progresses through organizational views, technological views, and finally strategy development.
Which of the following models is the MOST appropriate for this specific scenario?
Answer and explanation
Correct answer: E
The OCTAVE model is specifically designed as a self-directed information security risk evaluation methodology. It focuses on organizational risk and strategic practice rather than just technological flaws. Phase 1 builds asset-based threat profiles (organizational view), Phase 2 identifies infrastructure vulnerabilities (technological view), and Phase 3 develops security strategies and plans. SQUARE is focused on eliciting requirements rather than organizational risk profiling. STRIDE is a technical threat modeling tool, not an organizational risk assessment framework.
