312-96 Certified Application Security Engineer (CASE) - Java Practice Questions

The script-src directive controls which sources are allowed for JavaScript. The 'self' keyword permits scripts from the same origin (domain). Adding https://apis.google.com explicitly whitelists that domain as an additional valid source. This configuration correctly and securely enforces the stated requirement without allowing dangerous practices like 'unsafe-inline'.

This is the core of the pattern. A unique, unpredictable token is generated per-session (or per-request) and tied to the user's session on the server. It is then sent to the client to be included in subsequent state-changing requests.

This is the validation step. The server must compare the token submitted by the client with the one it has stored for that user's session. If they match, the request is considered legitimate. If they don't match or the token is missing, the request is rejected.

This is the most comprehensive and recommended approach. Setting disallow-doctype-decl to true completely disables DOCTYPE declarations, which is the root cause of XXE. Additionally, explicitly disabling external general and parameter entities provides a strong defense-in-depth strategy, protecting the parser even if DOCTYPE declarations are allowed for other reasons.

OWASP Dependency-Check is a Software Composition Analysis (SCA) tool that specifically identifies project dependencies and checks if there are any known, publicly disclosed vulnerabilities (CVEs). It has a dedicated Maven plugin that can be configured to run during the build process and can even fail the build if vulnerabilities exceeding a certain severity are found.

The Principle of Least Privilege is a fundamental computer security concept that states that a user, program, or process should have only the minimum privileges necessary to perform its function. This minimizes the potential damage from a security breach or an accidental error.

Blacklist validation is fundamentally flawed because it is impossible to anticipate all possible malicious inputs. Attackers can use various techniques like case variations ( ), different encodings, or alternative vectors like to bypass simple string replacement. The correct approach is to use a combination of whitelist validation for input and context-aware output encoding.

A structured triage process is crucial for managing SAST findings. It allows the team to systematically review, classify, and suppress non-issues, making the results more relevant and actionable over time.

Focusing on new vulnerabilities (delta scanning) in pull requests makes the feedback immediate and relevant to the developer's current changes. This 'shift-left' approach prevents new technical debt and is less overwhelming than scanning the full codebase on every commit.

False. While using getCanonicalPath() and then validating that the result starts with the expected base directory is a key part of the defense, it is not sufficient on its own. An attacker could still use null byte injection (filename.zip%00.txt) in older versions of Java to bypass checks performed on the filename string after canonicalization. A robust solution requires multiple layers: validating the filename against a strict whitelist of characters, using getCanonicalPath(), and ensuring the resulting path is within the intended storage directory.

Log4j2's property substitution feature allows referencing external sources like environment variables. To prevent accidental logging of a secret, you can provide a default value (e.g., :-[REDACTED]) that will be used if the environment variable is not found. The most robust approach for redaction is using rewrite policies or filters, but based on the provided code snippet, the blank represents the mechanism for substituting properties. The correct syntax would be ${env:API_KEY:-[REDACTED]}. The option describes this mechanism.

In a distributed microservices architecture, using an asymmetric algorithm like RS256 is superior for security. The Auth Service is the single entity that holds the private key and can create (sign) tokens. All other services only need the public key to validate tokens. This adheres to the principle of least privilege, as a compromise of a downstream service (e.g., Product Service) will not lead to a compromise of the signing key. With HS256, every service that validates tokens must also possess the shared secret, increasing the attack surface and the risk of the secret key being leaked, which would allow an attacker to forge valid tokens.