Web Security & Secure Coding Practices Quiz

The security API provides four logging levels: Trace (most detailed), Warn (warning conditions), Error (error events), and Fatal (critical failures). This level progression allows developers to control log verbosity and focus on issues of varying severity. The option with six levels is incorrect - debug and info are not part of this API's logging hierarchy.

To prevent Cross-Site Scripting (XSS) attacks, TCS SAPI provides isSafeHTML() which validates HTML content for dangerous patterns, and encodeForHTML() which encodes special characters to prevent script execution. The isSafeHTML method checks if HTML input is safe for a given context, while encodeForHTML converts characters like < and > to safe HTML entities. Using both provides defense-in-depth against XSS vulnerabilities.

EnterpriseSecurityException is the base class for all security-related exceptions in the TCS security API. It provides a common ancestor for specific security exceptions like authorization failures, validation errors, and authentication issues. SecurityException alone might not capture the enterprise context, and EnterpriseException is too broad for security-specific failures.

The TCS SAPI hash function uses the accountName as the salt value to ensure unique hashes for each user even if they have the same password. Salting with accountName prevents pre-computed rainbow table attacks and ensures that two users with identical passwords have different hash values. Using a constant salt or no salt would make the hashes vulnerable to dictionary attacks.

Canonicalization is the process of reducing an encoded string to its simplest, unambiguous form by decoding all encoding layers. For security, this is crucial because attackers can use multiple encoding schemes (URL encoding, double encoding, mixed encoding) to hide malicious input. By canonicalizing input first, security checks can detect attacks regardless of the encoding used.

The sign() method creates a digital signature for the provided input data and returns it as a string. Digital signatures provide authentication and integrity verification - they prove the data came from a trusted source and hasn't been modified. Unlike encryption (which hides data) or hashing (one-way), signatures are verifiable: anyone can validate the signature using the signer's public key.

To prevent Path Traversal attacks, TCS SAPI provides isSafeDirectoryPath() and isSafeFileName() which validate that paths don't contain dangerous patterns like '../' or absolute paths. These methods check if the input is safe for the given context before allowing file system access. Path traversal attacks attempt to access files outside the intended directory, so validating both directory paths and filenames is essential defense.

OWASP WebScarab is a security analysis framework that intercepts and analyzes HTTP/HTTPS traffic between a browser and web application. Its most common usage is as an intercepting proxy that allows security testers to inspect, modify, and replay requests to identify vulnerabilities. It is not an insecure application, static analyzer, or dedicated penetration testing tool - it's a traffic analysis framework.

LiveHTTPHeaders is a Firefox browser extension that allows users to view and modify HTTP request and response headers in real-time. As an HTTP tampering tool, it enables security testing by letting users intercept, inspect, and modify HTTP traffic before it reaches the server. Sqlninja, Bobcat, and WebGoat are not Firefox-based HTTP tampering tools - they serve different security testing purposes.

PMD is a well-known open source static code analysis tool for Java that checks for common programming flaws and unused code. It uses a ruleset-based approach to identify potential problems like unused variables, empty catch blocks, or inefficient object creation. Ounce and Fortify are commercial static analysis tools, while DevInspect is not a recognized static analyzer.

FxCop (FxCop.exe) is Microsoft's free static code analysis tool that analyzes .NET assemblies against Microsoft's .NET Framework Design Guidelines. It checks for naming conventions, library design, security, and performance best practices. Visual Studio is an IDE, not a static analysis tool, while Ounce and WebGoat are unrelated to Microsoft's design guidelines.

Nikto is an open source web server scanner licensed under GPL that performs comprehensive vulnerability scanning. It checks for outdated server versions, dangerous files/programs, and configuration issues. Sqlmap is for SQL injection testing, O2 is a security tool framework, and GreaseMonkey is a userscript manager for browsers.

Burp Suite is an interactive HTTP/S proxy server widely used for attacking and testing web applications. It sits between the browser and target server, allowing interception, modification, and analysis of HTTP/S traffic. WebGoat is a vulnerable application for practice, BeEF is for browser exploitation, and Ounce is a static analyzer.

AntiSamy is the OWASP project that provides an API for ensuring user-supplied HTML/CSS content complies with application rules. It sanitizes input to prevent XSS attacks while allowing safe HTML. WebScarab is a proxy tool, WebGoat is a vulnerable app, and ESAPI is a broader security framework.

Ounce (Ounce Labs) is a commercial static code analyzer that identifies security vulnerabilities in source code before deployment. It analyzes code paths to find potential security issues. WebInspect is a dynamic analysis tool, IBM RAD is an IDE, making Ounce the correct static analyzer choice.

AppScan (IBM Security AppScan) is a commercial penetration testing tool that dynamically tests web applications for security vulnerabilities. It automates the process of finding security flaws. Ounce and DevInspect are static tools, while FxCop is for .NET static analysis.

OWASP WebGoat is a deliberately insecure J2EE web application designed to teach developers about common application security vulnerabilities. It provides hands-on practice with flaws like SQL injection, XSS, and authentication bypass. It's not a proxy or scanner - it's a learning platform.

The principle of least privilege means users should have only the minimum permissions necessary to perform their job functions. Option C correctly implements this by defining allowable actions for each role and denying everything else. Group-based access (A) is a method but doesn't define the principle, consistent checking (B) is about authorization implementation, and logging (D) is about audit trails.

The three essential steps of patch management are: Acquiring (obtaining the patch), Testing (verifying it doesn't break systems), and Installing (deployment). This sequence ensures patches work correctly before production deployment. Other options miss the critical testing phase or add unnecessary steps like peer review.

The correct HTML attribute to disable browser autocomplete for forms is autocomplete="Off". This prevents browsers from automatically filling sensitive form fields like passwords or credit card numbers. Values like "0", "no-store", or other strings don't properly disable the feature across all browsers.