What does the CIA triad in security stand for?
Pces Fundamentals Category
Question · Easy
New hire access: Expectation vs Reality
Short
In the OWASP Top 10 (2021), which risk is at #1?
Question · Medium
Which Python function is the MOST dangerous to call on untrusted input because it executes arbitrary code?
Pces Secure Coding Category
Tech Exam Prep Podcast
Listen on Spotify
Podcast
Why should you AVOID `pickle.loads()` on untrusted data?
Which is the correct way to prevent SQL injection in Python with sqlite3?
Which Python module should you use to generate cryptographically secure random tokens?
Pces Crypto Category
Which secrets-module function generates a URL-safe token of N bytes encoded as Base64?
Which hash algorithm should you AVOID for new applications because of known collision attacks?
Which call computes the SHA-256 hex digest of a bytes value `data` using hashlib?
Why should you NEVER store user passwords with plain hashlib.sha256?
Which Python library is the recommended choice for password hashing in 2026?
Which Python function provides constant-time string comparison to prevent timing attacks?
Question · Hard
Which Python module computes HMAC (keyed-hash message authentication codes)?
Which is the easiest way to encrypt and decrypt data symmetrically in Python with safe defaults?
In the cryptography library, where do low-level primitives (AES-GCM, RSA, ECDSA) live?
What is the recommended AES mode for new applications because it provides authenticated encryption?
Which Python pattern is the RIGHT way to call a shell command with user input?
Which Python module is the modern, secure way to manipulate filesystem paths?
How do you safely confirm that a user-supplied path stays within an allowed base directory?
Which `re` module concept can lead to a denial-of-service attack on the regex engine?
Pces Input Validation Category
What does setting `verify=False` in a `requests` call do?
Pces Http Category
Where should secrets like API keys live in a Python application?
Which Django setting forces cookies to be sent only over HTTPS?
Pces Web Frameworks Category
Which Django setting enables HTTP Strict Transport Security (HSTS)?
How does Django protect against CSRF in form submissions?
Which Flask extension adds CSRF protection to forms?
Which Flask extension applies a strong default set of HTTP security headers (CSP, HSTS, X-Frame-Options)?
Which Python library is most commonly used for low-level packet crafting and sniffing in penetration testing?
Pces Pentest Category
Which Python library is commonly used for SSH automation in security operations?
Which Python library is an exploit-development toolkit popular in CTFs and binary exploitation?
Which Python library is widely used for crafting and parsing Microsoft network protocols (SMB, Kerberos, MSRPC) for pentesting?
Which open-source Python tool is commonly used for memory forensics?
Pces Forensics Category
Which Python library provides bindings for YARA, the malware-classification rule engine?
Which Python library parses pcap (packet capture) files at the dissection layer?
What does the principle of LEAST PRIVILEGE require?
Which OWASP Top 10 (2021) category covers issues like server-side request forgery (SSRF)?
What is STRIDE?
Which is the safest way to parse a JSON string from an untrusted source?
Which Python module safely parses a string containing only literals (numbers, lists, dicts, strings)?
Which Python web framework feature inherently mitigates SQL injection by default?
Which is a SAFE way to render user-supplied content in a Jinja2 (Flask) template?
Which Django setting MUST be set to a non-empty list in production to prevent HTTP host-header attacks?
Which is the BEST way to store a Django SECRET_KEY in production?
What is XSS (Cross-Site Scripting)?
Which HTTP header significantly mitigates XSS by restricting which sources can load scripts?
Which HTTP header prevents the page from being framed (clickjacking defense)?
Loading more…