Security Best Practices

← All exam tracks

Application Security · OWASP

Security Best Practices

Practice original scenario-based Security Best Practices questions. Take a timed mock, focus on a topic, and learn from detailed explanations. These are independent practice materials, not official exam questions or a guarantee of certification readiness.

16 questions · 24 minutes · 70% practice target

Create an account to practice Already a member? Sign in

Topics you will practice

  • Identity & Authorization
  • Input & Browser Security
  • APIs & Supply Chain
  • Operations & Verification

Try a sample

Think through each question, then reveal the explanation. Full attempts save your answers and scores to your account.

An authenticated user changes /invoices/123 to /invoices/124 and can read another customer’s invoice. Which control is missing?

  1. Server-side authorization for the specific invoice
  2. A less predictable CSS class
  3. An extra password length check at registration
  4. A hidden navigation link
Show answer and explanation

Correct answer: Server-side authorization for the specific invoice

Authentication identifies the caller but does not grant access to every object. Enforce ownership or other applicable policy for each invoice; hiding links or changing presentation cannot enforce it.

A new administrative endpoint has no explicit authorization rule. Which default policy is safer?

  1. Allow every logged-in user automatically
  2. Allow access if the URL is long
  3. Trust a role name submitted in JSON
  4. Deny access until an appropriate rule permits it
Show answer and explanation

Correct answer: Deny access until an appropriate rule permits it

Deny-by-default avoids accidental permission grants when a rule is missing. Login alone, URL obscurity, and client-supplied roles are not a substitute for a server-side policy.

An application preserves the same session identifier before and after login. Which change mitigates session fixation?

  1. Publish the session ID in the profile URL
  2. Remove the login audit trail
  3. Rotate the session identifier on authentication and invalidate the old one appropriately
  4. Use the username as the session ID
Show answer and explanation

Correct answer: Rotate the session identifier on authentication and invalidate the old one appropriately

Rotation prevents a pre-established identifier from remaining a valid authenticated session. Usernames are predictable, URLs can leak tokens, and logging changes do not fix session fixation.

Study references