Test your Secure Coding knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.
Question 1/12Score 0
What is "security by obscurity," and why is it generally considered an insufficient security strategy on its own?
In this round
What is "security by obscurity," and why is it generally considered an insufficient security strategy on its own?
What does "fail securely" (or "fail closed") mean as a secure coding principle, as opposed to "fail open"?
What is the difference between authentication and authorization, and why does conflating them lead to security bugs?
What is the principle of "least privilege" in secure coding/system design?
Why is input validation considered a foundational secure coding practice, and where should it typically be enforced?
What is the purpose of dependency/supply-chain security practices, like regularly scanning for known vulnerabilities in third-party packages a project depends on?
What is SQL Injection, and what secure coding practice specifically prevents it?
What is a "buffer overflow" vulnerability, and what class of programming languages is it most commonly associated with?
What does "Secure Coding" refer to as a discipline?
What does "defense in depth" mean as a secure coding/architecture principle?
What is the purpose of secure password storage practices, specifically using a slow, salted hashing algorithm (like bcrypt or Argon2) rather than a fast general-purpose hash (like plain SHA-256) or storing passwords in plaintext?
What is Cross-Site Request Forgery (CSRF), and what secure coding practice typically defends against it?