Free Cyber Secure Coder™ Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Cyber Secure Coder™ practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An application displays a customer's private records to an unauthorized visitor. Which security objective has been directly violated?

   1. A. Integrity
   2. B. Confidentiality
   3. C. Availability
   4. D. Authenticity

   Answer: B

   Explanation: FIPS 199 states, "A loss of confidentiality is the unauthorized disclosure of information." Displaying private records to an unauthorized visitor is a disclosure, rather than an alteration or an interruption of access.

   Reference: FIPS 199: Standards for Security Categorization of Federal Information and Information Systems — Section 2, Security Objectives, p. 2

2. 2How should secure development practices relate to the software development life cycle (SDLC)?

   1. A. Confine them to the release approval phase
   2. B. Integrate them throughout the selected SDLC
   3. C. Use them after deployment replaces development
   4. D. Apply them only when the SDLC is waterfall

   Answer: B

   Explanation: NIST states, "Regardless of which SDLC model is used, secure software development practices should be integrated throughout it". Security is integrated across the selected life cycle, rather than restricted to one phase or methodology.

   Reference: NIST SP 800-218: Secure Software Development Framework (SSDF) Version 1.1 — Section 1, Introduction, p. 1

3. 3What distinguishes an abuse case from a use case that describes intended application behavior?

   1. A. It specifies the preferred user interface for a normal task
   2. B. It records the expected steps of an authorized transaction
   3. C. It summarizes implementation modules for a planned feature
   4. D. It describes unintended or malicious use of application features

   Answer: D

   Explanation: OWASP SAMM states, "Misuse and abuse cases describe unintended and malicious use scenarios of the application, describing how an attacker could do this." An abuse case focuses on misuse, rather than the intended workflow, interface preference, or module structure.

   Reference: OWASP SAMM: Requirements-driven Testing — Misuse/Abuse Testing — Maturity Level 2, Activity

4. 4A forum places untrusted comments into generated pages without neutralizing script content. Another user's browser executes an attacker's script when viewing a comment. Which weakness is demonstrated?

   1. A. Server-side request forgery
   2. B. Cross-site scripting
   3. C. Cross-site request forgery
   4. D. Insecure deserialization

   Answer: B

   Explanation: MITRE CWE-79 states, "The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users." The attack crosses from untrusted comment data into executable page content. The other weaknesses concern server requests, unwanted authenticated requests, or object reconstruction.

   Reference: MITRE CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) — CWE-79, Description

5. 5A browser validates a submitted quantity before sending it to an API. Where must the API's acceptance rules also be enforced to resist modified requests?

   1. A. Only in the browser's JavaScript validation function
   2. B. Only in the HTML input element's attributes
   3. C. On the server before the quantity is used
   4. D. In the interface text that explains permitted quantities

   Answer: C

   Explanation: OWASP states, "Validate on the server even when the browser checks the same fields." Attackers can bypass browser checks and send modified requests. JavaScript, HTML attributes, and explanatory text do not enforce acceptance at the API.

   Reference: OWASP Input Validation Cheat Sheet — Common Pitfalls, Client-only checks

6. 6An attacker changes the amount in a stored invoice without authorization. Which security objective is directly harmed by that change?

   1. A. Preventing information disclosure to unauthorized readers
   2. B. Maintaining reliable information access for authorized users
   3. C. Verifying the identity claimed by a requesting user
   4. D. Preventing unauthorized modification of stored information

   Answer: D

   Explanation: FIPS 199 states, "A loss of integrity is the unauthorized modification or destruction of information." The unauthorized change to an invoice amount is a modification of information.

   Reference: FIPS 199: Standards for Security Categorization of Federal Information and Information Systems — Section 2, Security Objectives, p. 2

7. 7Which mechanism explains the remediation-cost benefit of shifting security work earlier in the SDLC?

   1. A. It batches defect correction after integration to share one final retest
   2. B. It substitutes operational monitoring for correcting early design flaws
   3. C. It treats early design defects as accepted risks rather than repair work
   4. D. It reduces downstream rework caused by leaving early flaws unresolved

   Answer: D

   Explanation: NIST states, "Shifting left minimizes any technical debt that would require remediating early security flaws late in development or after the software is in production." The benefit comes from avoiding downstream repair of early flaws. Batching late fixes, monitoring instead of correcting them, and accepting defects are different responses rather than this early-remediation mechanism.

   Reference: NIST SP 800-218: Secure Software Development Framework (SSDF) Version 1.1 — Section 1, Introduction, p. 1

8. 8A booking design permits a quoted discount for at most ten minutes from the initial price hold. An abuse case renews the hold repeatedly to keep the discount after that deadline. Which requirement directly addresses this abuse?

   1. A. Start a fresh ten-minute period whenever the customer renews the hold
   2. B. Enforce the original hold deadline even when the hold is renewed
   3. C. Measure the hold period from the customer's most recent page view
   4. D. Apply the hold deadline after accepting payment at the reserved price

   Answer: B

   Explanation: OWASP SAMM recommends turning important business rules into "experiments to verify whether the application properly enforces the business rule." The stated rule measures from the initial hold. Enforcing that original deadline prevents renewal abuse; resetting the clock, measuring from a later view, or checking after accepting the price does not enforce that rule.

   Reference: OWASP SAMM: Requirements-driven Testing — Misuse/Abuse Testing — Maturity Level 2, Activity, business logic testing

9. 9An application constructs a database command so that attacker-controlled input changes the command's logic instead of remaining ordinary data. Which vulnerability explains this behavior?

   1. A. Path traversal
   2. B. Cross-site scripting
   3. C. Session fixation
   4. D. SQL injection

   Answer: D

   Explanation: MITRE CWE-89 explains that "the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data." The interpreter is the database query engine, distinguishing SQL injection from filesystem traversal, browser script injection, and session identifier manipulation.

   Reference: MITRE CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) — CWE-89, Description

10. 10An API accepts a purchase quantity as an integer. Business rules permit values from 1 through 20. Which validation is still necessary after successful integer parsing?

    1. A. Verify that the quantity lies in the permitted range
    2. B. Accept every parsed integer because its type is correct
    3. C. Reject quantities based only on their original character count
    4. D. Convert the integer back to text instead of checking its value

    Answer: A

    Explanation: OWASP states, "Converting text to an integer only establishes a type: it does not establish an acceptable quantity." The parsed number must satisfy the business range. Parsing, text length, and converting back to text do not establish that range.

    Reference: OWASP Input Validation Cheat Sheet — Implementing Input Validation, Parse Safely, Then Validate