GSSP-Java: GIAC Secure Software Programmer-Java Java Practice Questions

A Java application is vulnerable to a SQL Injection attack. What should be the first step taken to mitigate this risk?

• AA. Use dynamic SQL.
• BB. Increase database privileges.
• CC. Use prepared statements.
• DD. Disable input validation.

Your team is developing a secure API in Java. How can you ensure sensitive data is not exposed in logs?

• AA. Use verbose logging.
• BB. Mask data in logs.
• CC. Disable logging completely.
• DD. Store logs in plaintext.

An organization requires cryptographically secure random numbers in Java applications. What class should be used?

• AA. ThreadLocalRandom
• BB. SecureRandom
• CC. Random
• DD. Math.random()

A Java application uses an outdated library that contains a known vulnerability. What should the developers do?

• AA. Ignore updates.
• BB. Perform a security review.
• CC. Switch to a different language.
• DD. Update to the latest version.

What is one of the main reasons to avoid using serialization in Java?

• AA. Complexity in implementation.
• BB. Compatibility issues.
• CC. Performance overhead.
• DD. Data loss in transmission.

In which scenario would you use Java's SecurityManager?

• AA. To implement user authentication.
• BB. To restrict application permissions.
• CC. To serialize objects.
• DD. To encrypt sensitive data.

How would you mitigate XML external entity (XXE) attacks in a Java application?

• AA. Disable DTD processing.
• BB. Use JAXB for parsing XML.
• CC. Allow external entities.
• DD. Use a database for XML.

What is the purpose of the 'transient' keyword in Java?

• AA. To create a constant variable.
• BB. To prevent serialization of a field.
• CC. To optimize performance.
• DD. To declare a final variable.