Which OWASP Top 10 2021 category specifically replaced 'Sensitive Data Exposure' from the 2017 list to broaden the scope of cryptography-related risks?
Appsec Threats And Attacks
Question · Easy
In STRIDE threat modeling, which threat category maps to the security property 'Non-Repudiation'?
An attacker submits the input ' OR '1'='1' -- into a login form and bypasses authentication. Which OWASP Top 10 2021 category does this BEST illustrate?
Tech Exam Prep Podcast
Listen on Spotify
Podcast
Which threat-modeling deliverable is BEST used to systematically describe how an attacker might misuse a feature, rather than how a normal user uses it?
An application reflects user input into the HTML body of a response without encoding. Which attack class is MOST directly enabled?
DREAD risk rating uses Damage, Reproducibility, Exploitability, Affected users, and which fifth dimension?
Question · Medium
Which OWASP Top 10 2021 category was newly introduced to highlight gaps that arise BEFORE coding even begins, such as missing threat models?
An e-commerce site allows callers to fetch arbitrary internal URLs through a 'preview link' feature. An attacker uses it to read 169.254.169.254 metadata on AWS. Which OWASP Top 10 2021 category captures this issue?
Question · Hard
Which attack pattern is characterized by an attacker inducing the application to deserialize attacker-controlled data, leading to remote code execution?
Which threat-modeling tool is published by Microsoft and natively maps DFD elements to STRIDE categories?
Which OWASP Top 10 2021 category covers untrusted CI/CD pipelines and unsigned auto-update mechanisms?
Which threat-modeling methodology is asset-centric and uses a seven-step process focused on simulating real attackers?
A tester finds that an authenticated user can change the URL ID parameter from /orders/123 to /orders/124 and view another customer's order. This vulnerability is an example of:
Which 'attack tree' concept is BEST used to break a high-level attacker goal into refined sub-goals and concrete techniques?
Which security requirements catalog is published by NIST and commonly mapped to enterprise application security baselines under the FISMA/RMF process?
Security Requirements Gathering
Which ISO standard provides requirements for an Information Security Management System (ISMS) and is commonly required for B2B procurement?
Under PCI DSS v4.0, which type of application is a merchant required to subject to either an annual code review by qualified personnel or to deploy behind a Web Application Firewall?
OWASP ASVS levels are intended for what purpose during requirements gathering?
Which framework is published by NIST specifically for integrating security considerations into the Software Development Life Cycle?
Which artifact maps a feature to its corresponding security requirements and abuse cases so they remain traceable through testing?
GDPR Article 25 codifies which secure-design concept that should be embedded in application security requirements?
Which secure design principle states that a system should fail to a deny/closed state when an error occurs in a security check?
Secure Design And Architecture
Which design principle is BEST applied by ensuring that a microservice can only call the specific downstream APIs it needs, with scoped tokens, rather than holding a master credential?
Saltzer and Schroeder's principle of 'Complete Mediation' tells designers to:
Which architecture pattern places shared services (auth, logging, rate limiting) in a sidecar/proxy layer so each application service inherits security controls without code changes?
When applying defense in depth to a public-facing web app, which combination BEST demonstrates layered, independent controls?
Which architectural pattern enforces that even traffic from inside the corporate network must authenticate, authorize, and verify device posture before reaching application services?
An architect proposes secrets be checked into a Git repo encrypted with AES so that 'only the app key can decrypt them.' Which principle does this violate?
Which secure design pattern interposes a checkpoint between every external interface and the business logic to perform AuthN/Z, input filtering, and logging?
In a Java Spring Boot application, which is the MOST effective way to prevent SQL injection on a parameterized query against a customer table?
Secure Coding Input Validation
In .NET, which approach correctly parameterizes a query against SQL Server using ADO.NET?
Which input-validation strategy is recommended by OWASP as the strongest first line of defense?
When rendering user-supplied data inside an HTML attribute (e.g., title="..."), which encoder should a Java application use?
In ASP.NET Core, which built-in encoder should be used to safely write user input to a JavaScript context inside a Razor page?
Which pair of XML parser settings disables XXE in Java's standard DocumentBuilderFactory?
Which Java framework's HtmlUtils.htmlEscape() method is commonly used to encode user input rendered in Spring MVC views?
A .NET Web API receives a JSON DTO and binds extra properties (e.g., 'IsAdmin') the developer never intended. Which vulnerability is this?
Which is the SAFEST way to build an OS command in Java when an external tool name and argument must be invoked?
Which approach BEST prevents path traversal when a Java application returns user-requested files?
Which BCrypt parameter is specifically intended to make password hashing more expensive over time as hardware improves?
Secure Coding Authn Authz
Which OWASP-recommended algorithm should be the FIRST choice for hashing user passwords in 2026 when no constraints prevent it?
In Spring Security 6, which class is typically configured to encode passwords using BCrypt?
ASP.NET Core's Microsoft.AspNetCore.Identity stores password hashes by default using which algorithm?
Which OAuth 2.0 flow is currently recommended for Single Page Applications and native mobile clients?
Which JWT vulnerability allows an attacker to forge tokens by setting alg to 'none' in the header?
Which JWT verification rule MUST be enforced on the server even when using strong signing?
Which OpenID Connect concept ties the ID Token to the specific authorization request and prevents token-substitution attacks?
Loading more…