1. What is Input validation ? Junior A. writing past the bounds of a buffer, corrupting adjacent memory and potentially executing attacker code B. verifying input conforms to expected type, length, format, and range before processing C. escaping data for its destination context (HTML, JS, URL) so it is rendered as data, not code D. reconstructing objects from untrusted serialized data, allowing tampering or remote code execution
2. Which term means: "verifying input conforms to expected type, length, format, and range before processing"? Junior A. Fail securely B. Secrets management C. Input validation D. Integer overflow
3. Which statement is correct? Junior A. Input validation — designing code so that errors default to a denied/safe state rather than granting access B. Input validation — precompiled SQL template with placeholders that separates query structure from user data C. Input validation — binding user input as parameters so the database treats it as data, never as SQL code D. Input validation — verifying input conforms to expected type, length, format, and range before processing
4. What is Output encoding ? Junior A. normalizing input to a single standard form before validation to prevent encoding bypasses B. reconstructing objects from untrusted serialized data, allowing tampering or remote code execution C. escaping data for its destination context (HTML, JS, URL) so it is rendered as data, not code D. storing credentials in a vault or secret store rather than hardcoding them in source code
5. Which term means: "escaping data for its destination context (HTML, JS, URL) so it is rendered as data, not code"? Junior A. Integer overflow B. Output encoding C. Software Composition Analysis (SCA) D. Allowlist validation
6. Which statement is correct? Junior A. Output encoding — writing past the bounds of a buffer, corrupting adjacent memory and potentially executing attacker code B. Output encoding — storing credentials in a vault or secret store rather than hardcoding them in source code C. Output encoding — scanning third-party and open-source dependencies for known vulnerabilities and license issues D. Output encoding — escaping data for its destination context (HTML, JS, URL) so it is rendered as data, not code
7. What is Parameterized queries ? Junior A. binding user input as parameters so the database treats it as data, never as SQL code B. accepting only known-good input values and rejecting everything else (preferred over denylisting) C. escaping data for its destination context (HTML, JS, URL) so it is rendered as data, not code D. time-of-check to time-of-use flaw where state changes between validation and use of a resource
8. Which term means: "binding user input as parameters so the database treats it as data, never as SQL code"? Junior A. Software Composition Analysis (SCA) B. Integer overflow C. Insecure deserialization D. Parameterized queries
9. Which statement is correct? Junior A. Parameterized queries — a formal inventory of all components and dependencies in a piece of software B. Parameterized queries — arithmetic result exceeding a type's max value, wrapping around to cause incorrect or unsafe behavior C. Parameterized queries — designing code so that errors default to a denied/safe state rather than granting access D. Parameterized queries — binding user input as parameters so the database treats it as data, never as SQL code
10. What is Allowlist validation ? Junior A. writing past the bounds of a buffer, corrupting adjacent memory and potentially executing attacker code B. accepting only known-good input values and rejecting everything else (preferred over denylisting) C. arithmetic result exceeding a type's max value, wrapping around to cause incorrect or unsafe behavior D. scanning third-party and open-source dependencies for known vulnerabilities and license issues
11. Which term means: "accepting only known-good input values and rejecting everything else (preferred over denylisting)"? Junior A. Insecure deserialization B. Output encoding C. Parameterized queries D. Allowlist validation
12. Which statement is correct? Junior A. Allowlist validation — writing past the bounds of a buffer, corrupting adjacent memory and potentially executing attacker code B. Allowlist validation — accepting only known-good input values and rejecting everything else (preferred over denylisting) C. Allowlist validation — scanning third-party and open-source dependencies for known vulnerabilities and license issues D. Allowlist validation — reconstructing objects from untrusted serialized data, allowing tampering or remote code execution
13. What is Fail securely ? Junior A. designing code so that errors default to a denied/safe state rather than granting access B. escaping data for its destination context (HTML, JS, URL) so it is rendered as data, not code C. verifying input conforms to expected type, length, format, and range before processing D. binding user input as parameters so the database treats it as data, never as SQL code
14. Which term means: "designing code so that errors default to a denied/safe state rather than granting access"? Junior A. Insecure deserialization B. Dynamic Application Security Testing (DAST) C. Software Composition Analysis (SCA) D. Fail securely
15. Which statement is correct? Junior A. Fail securely — storing credentials in a vault or secret store rather than hardcoding them in source code B. Fail securely — analyzing source code or binaries for vulnerabilities without executing the program C. Fail securely — designing code so that errors default to a denied/safe state rather than granting access D. Fail securely — a formal inventory of all components and dependencies in a piece of software
16. What is Secrets management ? Junior A. storing credentials in a vault or secret store rather than hardcoding them in source code B. precompiled SQL template with placeholders that separates query structure from user data C. verifying input conforms to expected type, length, format, and range before processing D. accepting only known-good input values and rejecting everything else (preferred over denylisting)
17. Which term means: "storing credentials in a vault or secret store rather than hardcoding them in source code"? Junior A. Input validation B. Fail securely C. Dynamic Application Security Testing (DAST) D. Secrets management
18. Which statement is correct? Junior A. Secrets management — arithmetic result exceeding a type's max value, wrapping around to cause incorrect or unsafe behavior B. Secrets management — verifying input conforms to expected type, length, format, and range before processing C. Secrets management — scanning third-party and open-source dependencies for known vulnerabilities and license issues D. Secrets management — storing credentials in a vault or secret store rather than hardcoding them in source code
19. What is Insecure deserialization ? Mid A. scanning third-party and open-source dependencies for known vulnerabilities and license issues B. verifying input conforms to expected type, length, format, and range before processing C. reconstructing objects from untrusted serialized data, allowing tampering or remote code execution D. a formal inventory of all components and dependencies in a piece of software
20. Which term means: "reconstructing objects from untrusted serialized data, allowing tampering or remote code execution"? Mid A. Input validation B. Buffer overflow C. Dynamic Application Security Testing (DAST) D. Insecure deserialization
21. Which statement is correct? Mid A. Insecure deserialization — a formal inventory of all components and dependencies in a piece of software B. Insecure deserialization — precompiled SQL template with placeholders that separates query structure from user data C. Insecure deserialization — analyzing source code or binaries for vulnerabilities without executing the program D. Insecure deserialization — reconstructing objects from untrusted serialized data, allowing tampering or remote code execution
22. What is Prepared statement ? Mid A. precompiled SQL template with placeholders that separates query structure from user data B. arithmetic result exceeding a type's max value, wrapping around to cause incorrect or unsafe behavior C. designing code so that errors default to a denied/safe state rather than granting access D. time-of-check to time-of-use flaw where state changes between validation and use of a resource
23. Which term means: "precompiled SQL template with placeholders that separates query structure from user data"? Mid A. Prepared statement B. Static Application Security Testing (SAST) C. Software Bill of Materials (SBOM) D. Input validation
24. Which statement is correct? Mid A. Prepared statement — precompiled SQL template with placeholders that separates query structure from user data B. Prepared statement — analyzing source code or binaries for vulnerabilities without executing the program C. Prepared statement — normalizing input to a single standard form before validation to prevent encoding bypasses D. Prepared statement — binding user input as parameters so the database treats it as data, never as SQL code
25. What is Canonicalization ? Mid A. normalizing input to a single standard form before validation to prevent encoding bypasses B. accepting only known-good input values and rejecting everything else (preferred over denylisting) C. storing credentials in a vault or secret store rather than hardcoding them in source code D. a formal inventory of all components and dependencies in a piece of software
26. Which term means: "normalizing input to a single standard form before validation to prevent encoding bypasses"? Mid A. Integer overflow B. Prepared statement C. Insecure deserialization D. Canonicalization
27. Which statement is correct? Mid A. Canonicalization — time-of-check to time-of-use flaw where state changes between validation and use of a resource B. Canonicalization — precompiled SQL template with placeholders that separates query structure from user data C. Canonicalization — binding user input as parameters so the database treats it as data, never as SQL code D. Canonicalization — normalizing input to a single standard form before validation to prevent encoding bypasses
28. What is Integer overflow ? Mid A. precompiled SQL template with placeholders that separates query structure from user data B. a formal inventory of all components and dependencies in a piece of software C. arithmetic result exceeding a type's max value, wrapping around to cause incorrect or unsafe behavior D. analyzing source code or binaries for vulnerabilities without executing the program
29. Which term means: "arithmetic result exceeding a type's max value, wrapping around to cause incorrect or unsafe behavior"? Mid A. Static Application Security Testing (SAST) B. Prepared statement C. Output encoding D. Integer overflow
30. Which statement is correct? Mid A. Integer overflow — writing past the bounds of a buffer, corrupting adjacent memory and potentially executing attacker code B. Integer overflow — arithmetic result exceeding a type's max value, wrapping around to cause incorrect or unsafe behavior C. Integer overflow — reconstructing objects from untrusted serialized data, allowing tampering or remote code execution D. Integer overflow — storing credentials in a vault or secret store rather than hardcoding them in source code Showing 30 of 48 Secure Coding questions — the full set, with answers, explanations and an AI tutor on every question, is inside.