Difficulty: Hard
In OWASP Top 10:2025, what is category A01?
A Broken Access Control
B Security Misconfiguration
C Injection
D Cryptographic Failures
Answer: A. Broken Access Control. OWASP Top 10:2025 lists Broken Access Control as A01.
In OWASP Top 10:2025, which category is A02?
A Insecure Design
B Authentication Failures
C Security Misconfiguration
D Injection
Answer: C. Security Misconfiguration. Security Misconfiguration is listed as OWASP category A02:2025.
At A03:2025, which risk concerns compromised dependencies?
A Broken Access Control
B Software Supply Chain Failures
C Cryptographic Failures
D Logging Failures
Answer: B. Software Supply Chain Failures. A03:2025 covers failures in software supply chains.
What does OWASP A04:2025 cover?
A Security Misconfiguration
B Injection
C Insecure Design
D Cryptographic Failures
Answer: D. Cryptographic Failures. A04:2025 addresses cryptographic failures.
When a query concatenates input, which OWASP category is illustrated?
A Injection
B Authentication Failures
C Insecure Design
D Logging Failures
Answer: A. Injection. A05:2025 is the Injection category.
The 2025 Top 10 assigns missing abuse-case analysis to which category?
A Injection
B Supply Chain Failures
C Broken Access Control
D Insecure Design
Answer: D. Insecure Design. A06:2025 highlights insecure design.
Credential stuffing belongs most closely to which OWASP 2025 category?
A Cryptographic Failures
B Security Misconfiguration
C Authentication Failures
D Exceptional Conditions
Answer: C. Authentication Failures. A07:2025 covers authentication failures.
Accepting unsigned software updates raises which OWASP 2025 risk?
A Broken Access Control
B Software or Data Integrity Failures
C Injection
D Logging Failures
Answer: B. Software or Data Integrity Failures. A08:2025 addresses software or data integrity failures.
Failures to detect security events are listed under which category?
A Insecure Design
B Cryptographic Failures
C Supply Chain Failures
D Security Logging and Alerting Failures
Answer: D. Security Logging and Alerting Failures. A09:2025 covers security logging and alerting failures.
Improper error handling fits which OWASP Top 10:2025 category?
A Mishandling of Exceptional Conditions
B Authentication Failures
C Injection
D Broken Access Control
Answer: A. Mishandling of Exceptional Conditions. A10:2025 is Mishandling of Exceptional Conditions.
How many core functions are in NIST CSF 2.0?
A Four
B Five
C Six
D Seven
Answer: C. Six. NIST CSF 2.0 has Govern, Identify, Protect, Detect, Respond, and Recover.
Which function was added to the NIST CSF 2.0 function set?
A Prepare
B Govern
C Assess
D Contain
Answer: B. Govern. Govern is the function newly added in CSF 2.0.
Under OWASP guidance, which password hash is recommended first?
A Plain SHA-256
B MD5
C Base64
D Argon2id
Answer: D. Argon2id. OWASP recommends Argon2id as the first choice for password storage.
What should a password-reset link use to limit replay?
A Single-use token
B Permanent URL
C Shared password
D Public nonce
Answer: A. Single-use token. A single-use reset token can be invalidated after use to prevent replay.
Why must session IDs be regenerated after privilege changes?
A Enable browser caching
B Prevent fixation and reuse
C Improve DNSSEC
D Shorten TLS handshakes
Answer: B. Prevent fixation and reuse. Regenerating IDs after permission changes reduces fixation and reuse risks.
What does HSTS tell a browser to do?
A Allow inline scripts
B Cache passwords permanently
C Use HTTPS for future visits
D Permit cross-origin cookies
Answer: C. Use HTTPS for future visits. HSTS tells browsers to use HTTPS for later connections to the site.
For Content-Security-Policy nonces, what should each response use?
A Fixed public nonce
B Username as nonce
C URL fragment nonce
D Fresh unpredictable nonce
Answer: D. Fresh unpredictable nonce. Nonces should be unique and unpredictable for each response.
When a private signing key is compromised, what action is appropriate?
A Revoke and replace it
B Publish it publicly
C Keep signing normally
D Reuse it elsewhere
Answer: A. Revoke and replace it. A compromised signing key should be revoked and replaced.
Why keep incident evidence with a chain of custody?
A Improve login speed
B Reduce packet loss
C Preserve integrity and provenance
D Rotate keys automatically
Answer: C. Preserve integrity and provenance. Chain of custody documents evidence handling and helps preserve its integrity.
When a CORS response reflects Origin, what cache header helps separate variants?
A Cache-Control: public
B Vary: Origin
C Content-Length
D Accept-Ranges
Answer: B. Vary: Origin. Vary: Origin tells caches that the response depends on the request’s Origin.
Which TLS feature helps stop passive reading on a network?
A Compression
B URL rewriting
C Cookie partitioning
D Encryption
Answer: D. Encryption. TLS encryption protects transmitted content from passive observers.
How should application secrets be supplied to production services?
A Source repository
B URL fragment
C Managed secret store
D Client-side bundle
Answer: C. Managed secret store. A managed secret store keeps production secrets outside source code and client bundles.
Why synchronize clocks across security logs?
A Reduce password reuse
B Correlate event timelines
C Encrypt database backups
D Hide network origins
Answer: B. Correlate event timelines. Synchronized clocks make it easier to correlate events across systems.
How should access checks be applied to object IDs in APIs?
A Authorize each requested object
B Trust hidden form fields
C Check only at login
D Use unguessable IDs alone
Answer: A. Authorize each requested object. Authorization checks should be performed for every requested object.
During active ransomware spread, what response can limit damage?
A Restore every device
B Delete security logs
C Publish credentials
D Isolate affected systems
Answer: D. Isolate affected systems. Isolating affected devices can limit ransomware spread during containment.