I85PREP
⌘ K
C-SWCM study materials
C-SWCM study resources

C-SWCM practice questions

One question at a time. Build your C-SWCM understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Application Security Fundamentals and Threat Modeling

Which HTTP response header directs the browser to use HTTPS for future requests to a site for a specified period?

  1. Referrer-Policy
  2. Strict-Transport-Security Correct answer.
  3. X-Frame-Options
  4. Content-Security-Policy

Explanation

Strict-Transport-Security implements HSTS, instructing the user agent to rewrite future requests to HTTPS for a defined max-age and optionally include subdomains. It defends against protocol downgrade and cookie-hijacking attacks after the first successful HTTPS visit.

Question 2Web Application Security Fundamentals and Threat Modeling

In threat modeling, what does the STRIDE mnemonic represent?

  1. A framework for scoring the severity of identified vulnerabilities
  2. A set of categories of security threats used to classify risks Correct answer.
  3. A checklist of compliance controls required by regulators
  4. A ranked list of the most common web vulnerabilities by frequency

Explanation

STRIDE is a threat classification scheme covering spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. It helps analysts systematically enumerate threats against each element of a system model.

Question 3Web Application Security Fundamentals and Threat Modeling

Which practice most directly mitigates SQL injection in a web application?

  1. Using parameterized queries with bound parameters Correct answer.
  2. Rotating database credentials periodically
  3. Enforcing a strict Content-Security-Policy
  4. Escaping HTML entities in rendered output

Explanation

Parameterized queries separate SQL code from user-supplied data, so input is treated as a value and cannot alter query structure. This eliminates the injection vector at its source rather than filtering after the fact.

Question 4Web Application Security Fundamentals and Threat Modeling

Which attack does the SameSite cookie attribute primarily help prevent?

  1. Cross-site scripting
  2. Cross-site request forgery Correct answer.
  3. Server-side request forgery
  4. Directory traversal

Explanation

SameSite restricts when browsers attach cookies to cross-site requests, which blocks the automatic credential submission that cross-site request forgery depends on. Lax and Strict modes differ in how they treat top-level navigations.

Question 5Web Application Security Fundamentals and Threat Modeling

What is the primary purpose of a data flow diagram during threat modeling?

  1. To show how data moves between processes, stores, and external entities Correct answer.
  2. To document the database schema for the development team
  3. To define the service level agreements for uptime
  4. To record the results of penetration testing

Explanation

A data flow diagram depicts components, trust boundaries, data stores, and the flows between them, giving analysts a structural view for identifying where threats apply. Each element is then examined against relevant threat categories.

Question 6Web Application Security Fundamentals and Threat Modeling

Which control best protects against reflected cross-site scripting in HTML output?

  1. Encrypting the response body in transit
  2. Rate limiting requests per IP address
  3. Hashing user input before storage
  4. Context-aware output encoding of untrusted data Correct answer.

Explanation

Context-aware output encoding converts characters that are meaningful in the target context into inert representations, so injected markup is displayed rather than executed. The encoding must match the context, such as HTML body, attribute, or script.

Question 7Web Application Security Fundamentals and Threat Modeling

Which term describes the boundary across which data passes between components that trust each other differently?

  1. Encryption zone
  2. Network segment
  3. Trust boundary Correct answer.
  4. Session scope

Explanation

A trust boundary marks where data crosses between components with different privilege or assurance levels, such as between a browser and a server. Threats are commonly concentrated at these crossings because validation assumptions change there.

Question 8Web Application Security Fundamentals and Threat Modeling

An application reflects a user-supplied value into a JavaScript string inside an inline script block. Which encoding is appropriate for that context?

  1. JavaScript string escaping with Unicode-safe encoding Correct answer.
  2. Base64 encoding
  3. URL percent-encoding
  4. HTML entity encoding only

Explanation

Data placed inside a script string must be escaped using rules for the JavaScript context, including handling of quotes, backslashes, and characters that could break out of the string. HTML entity encoding alone does not apply inside a script element.

Question 9Web Application Security Fundamentals and Threat Modeling

A development team wants to reduce risk from third-party JavaScript libraries. Which approach best supports this goal?

  1. Disabling HTTPS for internal test environments
  2. Maintaining a software bill of materials and monitoring dependency versions Correct answer.
  3. Allowing any CDN origin in the Content-Security-Policy
  4. Storing library files in the database

Explanation

A software bill of materials records the components and versions in use, enabling timely identification of vulnerable dependencies and patch tracking. Combined with automated scanning, it reduces exposure from outdated third-party code.

Question 10Web Application Security Fundamentals and Threat Modeling

Which property does a Content-Security-Policy using nonce-based script sources provide?

  1. Only scripts bearing the current server-generated nonce may execute Correct answer.
  2. Scripts are blocked from running in any frame
  3. All inline scripts are permitted but external scripts are blocked
  4. Cookies are sent only over HTTPS

Explanation

A nonce source allows execution only for script elements whose nonce attribute matches the unpredictable value generated per response. Because attackers cannot guess the nonce, injected inline scripts are refused by the browser.

Question 11Web Application Security Fundamentals and Threat Modeling

During a threat modeling session, a team identifies that an attacker could replay a captured authentication token. Which mitigation most directly addresses this?

  1. Increasing the token length to 512 characters
  2. Logging every request for audit purposes
  3. Binding tokens to a short lifetime and validating one-time use Correct answer.
  4. Storing the token in a URL query string

Explanation

Replay attacks succeed when a captured credential remains valid and reusable, so limiting lifetime and enforcing single use reduces the window and prevents reuse. Binding tokens to a session or device further constrains misuse.

Question 12Web Application Security Fundamentals and Threat Modeling

Which vulnerability arises when an application trusts a client-supplied price field in a hidden form input?

  1. Session fixation
  2. Parameter tampering Correct answer.
  3. Open redirect
  4. Cross-site request forgery

Explanation

Parameter tampering occurs when the server accepts client-controlled values such as prices or identifiers without authoritative validation. The fix is to derive sensitive values server-side from trusted data rather than from the request.

Question 13Web Application Security Fundamentals and Threat Modeling

What is the main security benefit of applying the principle of least privilege to a web application's database account?

  1. Improving query performance through reduced permissions
  2. Ensuring backups run on schedule
  3. Preventing SQL syntax errors in application code
  4. Limiting the impact of a compromised application by restricting available operations Correct answer.

Explanation

Least privilege grants only the operations the application needs, so an exploited injection or compromised process cannot drop tables or read unrelated data. It reduces blast radius rather than preventing the initial flaw.

Question 14Web Application Security Fundamentals and Threat Modeling

An application sets a session cookie without the HttpOnly attribute. Which threat is most directly increased?

  1. Reuse of the cookie after server-side logout
  2. Prediction of the session identifier by brute force
  3. Interception of the cookie on an unencrypted network
  4. Theft of the session cookie through injected client-side script Correct answer.

Explanation

Without HttpOnly, the cookie is readable by JavaScript, so a cross-site scripting flaw can exfiltrate the session identifier. HttpOnly removes that access path but does not address transport or randomness concerns.

Question 15Web Application Security Fundamentals and Threat Modeling

Which threat modeling question best tests whether an elevation-of-privilege threat exists?

  1. Are audit logs retained for one year?
  2. Can a user in one role perform actions reserved for a higher role? Correct answer.
  3. Does the application support multiple languages?
  4. Is the login page served over HTTPS?

Explanation

Elevation of privilege means gaining access or capabilities beyond one's authorization level, so the relevant question is whether role restrictions can be bypassed. This maps directly to the STRIDE category for privilege escalation.

Question 16Web Application Security Fundamentals and Threat Modeling

A web application accepts a filename parameter and builds a file path by concatenating it with a base directory. Which defense most reliably prevents traversal outside that directory?

  1. Storing uploaded files in a database blob column
  2. Canonicalizing the resolved path and verifying it remains within the base directory Correct answer.
  3. Rejecting filenames longer than 255 characters
  4. Blocking requests that contain a period character

Explanation

Canonicalization resolves encodings and relative segments, after which the application can confirm the final path still lies under the intended directory. This defeats traversal variants that simple character filtering misses.

Question 17Web Application Security Fundamentals and Threat Modeling

Which scenario best illustrates a server-side request forgery risk?

  1. A static image served from a content delivery network
  2. A feature that fetches a user-supplied URL from the server without restricting destinations Correct answer.
  3. A login page that sets a Secure session cookie
  4. A form that submits data to the same origin over HTTPS

Explanation

Server-side request forgery occurs when the server fetches a destination chosen by the user, allowing access to internal services or metadata endpoints. Restricting allowed schemes and hosts, and blocking private address ranges, mitigates it.

Question 18Web Application Security Fundamentals and Threat Modeling

Which measure best mitigates clickjacking against a sensitive page?

  1. Adding the HttpOnly attribute to cookies
  2. Enabling HTTP Strict Transport Security
  3. Requiring a password change every 90 days
  4. Sending frame-ancestors in CSP or X-Frame-Options to restrict embedding Correct answer.

Explanation

Clickjacking relies on rendering the target page inside an attacker-controlled frame, so directives that restrict which origins may embed the page prevent the overlay technique. Frame-ancestors in CSP is the modern control.

Question 19Web Application Security Fundamentals and Threat Modeling

A team is prioritizing remediation and needs to combine likelihood and impact into a single risk rating. Which approach fits this need?

  1. Deferring all remediation until the next audit
  2. Assigning qualitative or semi-quantitative scores to likelihood and impact and multiplying them Correct answer.
  3. Listing every threat alphabetically and fixing them in order
  4. Fixing only threats reported by external researchers

Explanation

Risk is commonly expressed as a function of likelihood and impact, so scoring both and combining them yields a comparable rating that supports prioritization. This allows limited effort to target the highest combined exposure.

Question 20Web Application Security Fundamentals and Threat Modeling

An application uses a predictable sequential session identifier and does not regenerate it after authentication. Which combination of threats does this most directly create?

  1. SQL injection and command injection
  2. Directory traversal and file inclusion
  3. Session prediction and session fixation Correct answer.
  4. Cross-site scripting and open redirect

Explanation

Predictable identifiers allow an attacker to guess valid sessions, while failing to regenerate on login permits fixation of a known identifier. Both flaws undermine the integrity of authenticated session state.

Question 21Web Application Security Fundamentals and Threat Modeling

A single-page application stores a long-lived bearer token in localStorage. Which analysis best captures the primary risk?

  1. The token is encrypted at rest by the browser and unusable by script
  2. Any cross-site scripting flaw can read and exfiltrate the token, and it remains valid until expiry Correct answer.
  3. The token is automatically protected by the SameSite attribute
  4. The token cannot be sent to the API because localStorage blocks network access

Explanation

Data in localStorage is accessible to any script running in the origin, so a single cross-site scripting flaw exposes the token. Because the token is long-lived and not bound to a session cookie, revocation and scoping are harder.

Question 22Web Application Security Fundamentals and Threat Modeling

During design review, a team finds that a microservice accepts internal requests without authentication because it assumes the network perimeter is trusted. Which threat modeling conclusion is most accurate?

  1. The assumption is acceptable provided TLS is used between services
  2. The risk is limited to repudiation because requests are not logged
  3. The implicit trust assumption creates spoofing and elevation risks if an attacker gains any foothold in the network Correct answer.
  4. The design is sound because internal networks cannot be reached by attackers

Explanation

Assuming a trusted perimeter violates defense in depth, because any compromised host can impersonate callers and reach privileged functionality. Service-to-service authentication and authorization limit lateral movement and spoofing.

Question 23Web Application Security Fundamentals and Threat Modeling

An application validates uploaded file types by checking the Content-Type header supplied by the client. Which improvement most reduces the risk of malicious uploads?

  1. Increasing the maximum upload size
  2. Inspecting file content and enforcing an allowlist of permitted types Correct answer.
  3. Renaming files with random identifiers only
  4. Serving uploads from the same origin as the application

Explanation

The client-supplied Content-Type is trivially forged, so validation must inspect actual content and permit only expected formats. Storing uploads outside the web root and serving them with safe headers further limits execution.

Question 24Web Application Security Fundamentals and Threat Modeling

A security team wants to detect authorization flaws where users access records belonging to others. Which control most directly addresses this class of issue?

  1. Logging access to records without blocking unauthorized reads
  2. Enforcing object-level authorization checks on every request using the authenticated identity Correct answer.
  3. Adding a role check only on the menu that links to the record
  4. Relying on unguessable record identifiers as the sole protection

Explanation

Object-level authorization must verify on each request that the authenticated principal is permitted to act on the specific record. Hiding links or relying on identifier obscurity fails once a request is crafted directly.

Question 25Authentication, Authorization, and Session Management

Which mechanism allows a web application to maintain user state across multiple stateless HTTP requests?

  1. TLS resumption
  2. Content negotiation
  3. DNS caching
  4. Session cookies Correct answer.

Explanation

HTTP is stateless, so applications issue a cookie holding a session identifier that the browser returns on each request, letting the server associate requests with a stored session. The other mechanisms affect name resolution, transport setup, or response formatting and carry no per-user application state.

Question 26Authentication, Authorization, and Session Management

A security tester observes that a session identifier is generated with a predictable incrementing counter. What is the primary risk?

  1. Attackers can guess valid identifiers and hijack other users' sessions Correct answer.
  2. The cookie will exceed the browser size limit
  3. Users will be forced to re-authenticate on every request
  4. Session data will be lost when the server restarts

Explanation

Session identifiers must be unpredictable so that an attacker cannot derive another user's value. A sequential counter makes enumeration trivial, allowing an attacker to try neighboring values and take over active sessions.

Question 27Authentication, Authorization, and Session Management

Which cookie attribute instructs the browser to withhold the cookie from cross-site requests initiated by third-party pages?

  1. Path
  2. Secure
  3. HttpOnly
  4. SameSite Correct answer.

Explanation

The SameSite attribute controls whether cookies are attached to requests that originate from another site, mitigating cross-site request forgery. Secure restricts transport to HTTPS, HttpOnly blocks script access, and Path scopes the cookie to a URL prefix.

Question 28Authentication, Authorization, and Session Management

Which statement best describes the difference between authentication and authorization?

  1. Authentication verifies identity, while authorization determines which resources that identity may use Correct answer.
  2. Authentication applies only to humans, while authorization applies only to services
  3. Authentication is performed once, while authorization is never repeated
  4. Authentication controls permissions, while authorization verifies credentials

Explanation

Authentication establishes who the subject is, typically through credentials or assertions. Authorization then evaluates policy to decide what that verified subject is permitted to do, and it must be checked on each protected action.

Question 29Authentication, Authorization, and Session Management

What is the purpose of a nonce in an OpenID Connect ID token?

  1. To encrypt the token payload for confidentiality
  2. To identify the authorization server's signing key
  3. To bind the token to the client's original authentication request and prevent replay Correct answer.
  4. To specify the token's expiration time

Explanation

The client sends a nonce in the authentication request, and the provider echoes it inside the ID token. The client compares the returned value with its stored value, which detects replayed or injected tokens.

Question 30Authentication, Authorization, and Session Management

An application stores session identifiers in a cookie. Which flag combination best protects that cookie from theft via script injection and from transmission over plain HTTP?

  1. HttpOnly and Secure Correct answer.
  2. SameSite and Domain
  3. Max-Age and Version
  4. Path and Expires

Explanation

HttpOnly prevents client-side scripts from reading the cookie, reducing the impact of cross-site scripting, and Secure ensures the cookie is only sent over TLS. Together they limit two common exfiltration paths for session identifiers.

Question 31Authentication, Authorization, and Session Management

Which factor makes password-based authentication weaker than certificate-based client authentication for machine-to-machine traffic?

  1. Certificates are stored in plaintext by default
  2. Passwords are reusable shared secrets that can be captured and replayed Correct answer.
  3. Passwords cannot be transmitted over TLS
  4. Certificates never expire

Explanation

A password is a bearer secret: anyone who observes or guesses it can reuse it. Client certificates bind authentication to possession of a private key, and the TLS handshake proves that possession without transmitting the key.

Question 32Authentication, Authorization, and Session Management

A web application sets a session cookie without the Secure attribute while also serving pages over HTTP. Which attack becomes practical against that cookie?

  1. Offline brute forcing of the server's TLS private key
  2. Cross-site scripting that reads the cookie through document.cookie
  3. Passive network eavesdropping that captures the session identifier Correct answer.
  4. SQL injection against the session store

Explanation

Without Secure, the browser will attach the cookie to plaintext HTTP requests, so an attacker on the network path can read the identifier and reuse it. Marking the cookie Secure forces it onto TLS-protected requests only.

Question 33Authentication, Authorization, and Session Management

A SAML service provider receives an assertion. Which validation step most directly prevents an attacker from reusing an assertion that was already consumed?

  1. Ensuring the assertion includes an AttributeStatement
  2. Confirming the assertion's NotBefore time has passed
  3. Checking that the assertion ID has not been seen before Correct answer.
  4. Verifying the XML signature algorithm is SHA-256

Explanation

Replay protection requires the service provider to track consumed assertion IDs within the validity window and reject duplicates. Signature verification, time checks, and attribute presence are all necessary but do not by themselves stop reuse.

Question 34Authentication, Authorization, and Session Management

An OAuth 2.0 client accepts the authorization code and exchanges it at the token endpoint. Which control most reduces the impact of a stolen authorization code?

  1. Disabling the state parameter
  2. Requiring PKCE with a verifier bound to the original request Correct answer.
  3. Using the implicit grant instead
  4. Increasing the access token lifetime

Explanation

PKCE binds the code exchange to a secret verifier created by the client, so a stolen code is useless without that verifier. This is especially important for public clients that cannot protect a client secret.

Question 35Authentication, Authorization, and Session Management

Which statement about JSON Web Token validation by a resource server is correct?

  1. The token payload must be decrypted before the signature is checked
  2. The signature must be verified against a trusted key before any claim is used Correct answer.
  3. The alg header value should be trusted without consulting server policy
  4. Claims are only valid if the token is stored in a cookie

Explanation

A resource server must verify the signature with a key obtained from a trusted source and enforce an allowlist of algorithms before trusting claims. Accepting the alg header blindly enables algorithm-confusion attacks.

Question 36Authentication, Authorization, and Session Management

A company wants single sign-on across SaaS applications while keeping credentials at the identity provider. Which protocol pattern directly supports this?

  1. Federated identity using SAML or OpenID Connect Correct answer.
  2. Local password databases per application
  3. Shared service accounts distributed to staff
  4. Static API keys embedded in each application

Explanation

Federation lets each application trust assertions from a central identity provider, so users authenticate once and credentials never leave the provider. Shared accounts and embedded keys remove individual accountability and central control.

Question 37Authentication, Authorization, and Session Management

An application issues session identifiers but never regenerates them after login. Which attack does this most enable?

  1. Session fixation Correct answer.
  2. Reflected cross-site scripting
  3. Cross-site request forgery
  4. Directory traversal

Explanation

If the identifier is unchanged after authentication, an attacker who planted a known identifier in the victim's browser can reuse it once the victim logs in. Regenerating the session ID at privilege changes defeats this.

Question 38Authentication, Authorization, and Session Management

Which approach best implements role-based access control for a large application?

  1. Hard-coding user names into each function
  2. Relying on client-side menu hiding as the only control
  3. Assigning permissions to roles and roles to users, then checking permissions centrally Correct answer.
  4. Granting all authenticated users administrative rights

Explanation

RBAC separates subjects from permissions through roles, so policy changes happen in one place and checks are consistent. Enforcement must occur server-side, because client-side hiding is cosmetic and easily bypassed.

Question 39Authentication, Authorization, and Session Management

A mobile application stores a long-lived refresh token on the device. Which practice best limits the damage if the device is compromised?

  1. Rotate refresh tokens on each use and revoke the token family on detected reuse Correct answer.
  2. Store the token in a world-readable file for easy access
  3. Extend the refresh token lifetime to several years
  4. Send the refresh token with every API call

Explanation

Refresh token rotation issues a new token each time and invalidates the prior one. If an old token is presented again, the authorization server can treat it as theft and revoke the whole family, cutting off the attacker.

Question 40Authentication, Authorization, and Session Management

Which control most directly mitigates session hijacking caused by an attacker observing traffic on an untrusted wireless network?

  1. Storing session state in the URL query string
  2. Increasing the session timeout to eight hours
  3. Requiring TLS for all authenticated traffic and marking cookies Secure Correct answer.
  4. Disabling HttpOnly on the session cookie

Explanation

Encrypting all authenticated traffic prevents on-path observers from reading session identifiers, and the Secure attribute keeps cookies off plaintext requests. Longer timeouts and URL-based state increase exposure instead of reducing it.

Question 41Authentication, Authorization, and Session Management

An API receives a bearer access token. Which property of bearer tokens must architects account for?

  1. Anyone who possesses the token can use it, so it must be protected like a password Correct answer.
  2. They are bound to the client's private key and cannot be replayed
  3. They are only valid inside the issuing browser
  4. They cannot be revoked under any circumstances

Explanation

Bearer tokens grant access to whoever presents them, with no proof of possession required. They must therefore travel only over TLS, be stored securely, and have short lifetimes with revocation support.

Question 42Authentication, Authorization, and Session Management

A team wants to enforce least privilege for a microservice calling another service. Which design best fits?

  1. Embed a permanent API key in the container image
  2. Reuse a broad administrator credential shared across services
  3. Issue a narrowly scoped, short-lived token for the specific downstream operation Correct answer.
  4. Allow the service to impersonate any user without restriction

Explanation

Scoped, short-lived credentials limit what a compromised service can do and reduce the value of a leaked token. Broad shared credentials and embedded keys violate least privilege and complicate rotation.

Question 43Authentication, Authorization, and Session Management

Which weakness is most characteristic of a session identifier placed in the URL query string?

  1. It forces the server to be stateless
  2. It prevents the use of HTTPS
  3. It leaks through browser history, logs, and referrer headers Correct answer.
  4. It cannot be generated randomly

Explanation

Identifiers in URLs are recorded in browser history, proxy and server logs, and referrer headers sent to other sites, giving attackers many channels to obtain them. Cookies with appropriate attributes avoid these leaks.

Question 44Authentication, Authorization, and Session Management

A financial application requires two independent authentication factors. Which pair satisfies that requirement?

  1. A password plus a security question
  2. A hardware security key plus a memorized PIN Correct answer.
  3. A password plus a second password
  4. An email address plus a username

Explanation

Multi-factor authentication requires factors from different categories, such as possession of a hardware key and knowledge of a PIN. Two secrets of the same kind, or identifiers that are not secrets, do not provide independent factors.

Question 45Authentication, Authorization, and Session Management

An organization deploys an identity provider that signs assertions. Which configuration most reduces the risk of forged assertions?

  1. Accepting assertions over plain HTTP to simplify debugging
  2. Permitting the XML parser to resolve external entities
  3. Trusting only signatures validated against pinned identity provider certificates and rejecting unsigned assertions Correct answer.
  4. Allowing any certificate that chains to a public root

Explanation

Assertions must be signed and verified against the expected identity provider's certificate, with unsigned assertions rejected outright. Allowing arbitrary chains or plaintext transport opens the door to impersonation and interception.

Question 46Authentication, Authorization, and Session Management

A security review finds that an application authenticates users but checks object ownership only in the user interface. What is the most accurate assessment?

  1. The application is vulnerable only if TLS is disabled
  2. The application is secure if session cookies use HttpOnly
  3. The application is vulnerable to broken object-level authorization through direct API requests Correct answer.
  4. The application is secure because the interface hides other users' records

Explanation

Authorization must be enforced server-side for every object access. If ownership checks exist only in the presentation layer, an attacker can call the API directly and reach records belonging to other users.

Question 47Authentication, Authorization, and Session Management

An OAuth deployment lets the client specify an arbitrary redirect_uri that is matched by prefix. Which attack does this most enable?

  1. Session fixation through cookie planting
  2. Authorization code interception by redirecting the response to an attacker-controlled host Correct answer.
  3. Downgrade of TLS to an obsolete cipher suite
  4. Signature stripping from ID tokens

Explanation

Exact redirect URI matching is required because prefix matching allows an attacker to register a URL that begins with the legitimate value. The authorization server then delivers codes or tokens to the attacker's endpoint.

Question 48Authentication, Authorization, and Session Management

A system uses stateless signed tokens for authorization decisions. Which operational limitation should be planned for?

  1. Stateless tokens cannot be validated offline
  2. Signed tokens cannot carry expiration claims
  3. Revoking a single issued token before expiry requires additional state or introspection Correct answer.
  4. Signing keys cannot be rotated without downtime

Explanation

Because a self-contained token is validated without a central lookup, immediate revocation normally requires a denylist, token versioning, or introspection. Short lifetimes and key rotation reduce but do not eliminate this need.

Question 49Input Validation and Injection Flaws (SQLi, XSS, Command Injection)

Which practice most directly prevents SQL injection in a login form?

  1. Using parameterized queries with bound placeholders Correct answer.
  2. Storing passwords in plaintext for faster checks
  3. Concatenating user input into the query string
  4. Escaping single quotes only in the username field

Explanation

Parameterized queries separate SQL code from data, so user input is treated as a value and cannot alter query structure. This is the primary defense against SQL injection regardless of the characters supplied.

Question 50Input Validation and Injection Flaws (SQLi, XSS, Command Injection)

What is the defining characteristic of stored (persistent) XSS?

  1. The payload is blocked by the same-origin policy
  2. The payload is saved server-side and served to later visitors Correct answer.
  3. The payload is reflected from a request parameter
  4. The payload executes only inside the browser console

Explanation

Stored XSS occurs when malicious script is persisted by the application, such as in a comment or profile field, and later rendered to other users. Because it is served from the trusted origin, it can affect many victims without a crafted link.