Application Security & Pentesting test (Intermediate)

Sample questions

5 sample questions from the Application Security & Pentesting test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. A development team is working on a web application that uses several third-party libraries. Which of the following actions would best help them ensure that they are not using components with known vulnerabilities?

   1. Implement input validation and output encoding for all user inputs and outputs.
   2. Regularly update and patch the application's server and operating system.
   3. Use a Software Composition Analysis (SCA) tool to scan for known vulnerabilities in third-party libraries.
   4. Ensure that all application logs are encrypted and stored securely.

   Answer: C. Use a Software Composition Analysis (SCA) tool to scan for known vulnerabilities in third-party libraries.

   Using a Software Composition Analysis (SCA) tool allows developers to identify and address vulnerabilities in third-party libraries before they are deployed. This is a critical step in ensuring that components with known vulnerabilities are not used in a project. Other options may be related to secure coding practices but do not directly address the specific issue of using components with known vulnerabilities.

2. Which of the following statements accurately describes the difference between a vulnerability scan and a penetration test?

   1. A penetration test is a subset of a vulnerability scan and focuses only on low-risk issues.
   2. A vulnerability scan is performed post-penetration testing to confirm the results.
   3. A vulnerability scan identifies potential weaknesses, but a penetration test attempts to exploit them to assess actual impact.
   4. A vulnerability scan and a penetration test are identical in their approach and objectives.

   Answer: C. A vulnerability scan identifies potential weaknesses, but a penetration test attempts to exploit them to assess actual impact.

   A vulnerability scan is an automated process that identifies potential weaknesses in a system, while a penetration test goes further by attempting to exploit these weaknesses to determine the real-world impact and the effectiveness of existing security controls. This distinction is crucial for understanding the depth and scope of each process.

3. Which of the following is a valid exploitation strategy for a vulnerability related to insecure deserialization?

   1. Use SQL injection to bypass authentication mechanisms.
   2. Perform a brute-force attack on the application's login page.
   3. Exploit cross-site scripting (XSS) to steal session cookies.
   4. Exploit insecure deserialization by injecting a malicious object into the application's data stream.

   Answer: D. Exploit insecure deserialization by injecting a malicious object into the application's data stream.

   Insecure deserialization is a vulnerability where untrusted data is deserialized without proper validation, allowing attackers to inject malicious objects. This can lead to remote code execution or other serious issues. The correct exploitation strategy involves injecting a malicious object into the data stream. The other options are not valid exploitation strategies for insecure deserialization.

4. Which of the following is an example of an insecure input validation practice?

   1. Implementing strong password hashing algorithms like bcrypt or Argon2id
   2. Using prepared statements to prevent SQL injection
   3. Using a blacklist to filter input for special characters like < and >
   4. Encoding output for its context (e.g., HTML, JavaScript, URLs)

   Answer: C. Using a blacklist to filter input for special characters like < and >

   Using a blacklist to filter input is not a secure coding practice because it can miss edge cases and is easily bypassed. Secure coding practices require the use of allow-lists, which only permit known safe inputs, and ensure that input is validated on the server side.

5. Which of the following statements accurately reflects the best practice for threat modeling in a realistic project scenario?

   1. Threat modeling is only necessary during the deployment phase of a project.
   2. Threat modeling is not needed if the system is already secure.
   3. Threat modeling should be performed only once at the beginning of the project and never revisited.
   4. Threat modeling should be performed at design time and revisited after major changes to the system.

   Answer: D. Threat modeling should be performed at design time and revisited after major changes to the system.

   Threat modeling is an essential practice in application security that should be performed during the design phase of a project to identify potential security threats early on. It should also be revisited after major changes to ensure that new vulnerabilities are not introduced and that existing mitigations remain effective. This ensures that security is considered throughout the development lifecycle, not just once and forgotten.