D329 Networks and Security Applications - Set 5 - Part 1

Correct Answer: Protecting against attacks targeting application logic and data handling

Application layer controls address threats such as injection and broken authentication that network-layer filtering cannot detect, since the traffic appears legitimate.

Correct Answer: A control inspecting HTTP traffic to block application layer attacks

A WAF inspects HTTP requests and responses, blocking patterns associated with attacks such as SQL injection and cross-site scripting that traditional firewalls miss.

Correct Answer: Inserting malicious SQL through application input to manipulate a database

SQL injection exploits applications that build queries from unvalidated input, letting attackers read, modify, or destroy data beyond their authorization.

Correct Answer: Parameterized queries that separate code from data

Parameterized queries send SQL structure and data separately, so user input is never interpreted as executable code, reliably preventing injection.

Correct Answer: Injecting malicious script that executes in another user's browser

XSS injects script into a page that the victim's browser executes in the context of the trusted site, enabling session theft and content manipulation.

Correct Answer: Encoding output and validating input

Properly encoding data when rendering it into HTML ensures the browser treats it as text rather than executable script, combined with strict input validation.

Correct Answer: Tricking an authenticated user's browser into submitting an unintended request

CSRF exploits a browser's automatic inclusion of session cookies, causing an authenticated user to unknowingly submit an attacker-crafted request.

Correct Answer: Using unpredictable anti-CSRF tokens tied to the session

An anti-CSRF token that the attacker cannot predict must accompany state-changing requests, so forged requests lacking the token are rejected.

Correct Answer: Taking over a user's authenticated session by stealing the session identifier

If an attacker obtains a valid session token, they can impersonate the user without knowing credentials, which is why tokens must be protected and rotated.

Correct Answer: Transmitting them only over TLS with secure cookie attributes

TLS prevents interception, while the Secure and HttpOnly cookie attributes prevent transmission over plaintext and access by client-side script.

Correct Answer: Preventing client-side scripts from reading the cookie

HttpOnly blocks JavaScript access to the cookie, limiting the damage an XSS vulnerability can do by preventing script from stealing session tokens.

Correct Answer: Verifying that supplied data conforms to expected format and constraints

Input validation checks that data matches expected type, length, format, and range before use, rejecting malformed input that could trigger vulnerabilities.

Correct Answer: An attacker can bypass the client entirely and send requests directly

Client-side checks improve user experience but are trivially bypassed by sending crafted requests directly, so validation must always be enforced server side.

Correct Answer: Writing data beyond an allocated memory boundary, corrupting adjacent memory

A buffer overflow writes past the end of allocated memory, potentially corrupting data or control structures and enabling arbitrary code execution.

Correct Answer: Bounds checking and using memory-safe language features

Validating that writes fit within allocated bounds, and using languages or libraries that enforce memory safety, eliminates the underlying condition.

Correct Answer: Software ships in its most secure configuration, requiring deliberate relaxation

Secure defaults ensure that systems are protected out of the box, since many deployments never change default settings.

Correct Answer: Verifying software authenticity and that it has not been tampered with

A digital signature over software lets users and systems verify it originates from the claimed publisher and has not been altered since signing.

Correct Answer: Compromising a trusted vendor or component to reach downstream targets

A supply chain attack compromises software, updates, or components from a trusted supplier so the malicious code is distributed to many downstream customers.

Correct Answer: Vulnerabilities in third-party libraries become vulnerabilities in your application

Applications inherit the vulnerabilities of every library they include, so dependencies must be inventoried, monitored for advisories, and kept updated.

Correct Answer: An inventory of components and dependencies within a software product

An SBOM lists all components and their versions, allowing rapid identification of affected systems when a vulnerability in a dependency is disclosed.