Test your Security Best Practices knowledge with a free interactive quiz — 20 questions with answers and explanations. No signup needed to play.
Question 1/5Score 0
Why is storing secrets (API keys, database passwords, private keys) directly in source code (committed to version control) considered a serious security risk?
Questions in this quiz
Why is storing secrets (API keys, database passwords, private keys) directly in source code (committed to version control) considered a serious security risk?
What is Cross-Site Scripting (XSS), and what is a primary defense against it?
Why is storing passwords as plain, unencrypted text in a database considered a severe security failure, and what is the standard alternative?
What is the purpose of HTTPS (TLS/SSL) for web traffic, from a security perspective?
What is the principle of "least privilege" in security design?
What is the security concern behind exposing overly verbose or unnecessary HTTP response headers (like a specific server software version), and what is a common mitigation?
What is the purpose of "salting" a password before hashing it?
What is the purpose of Content Security Policy (CSP), an HTTP response header?
What is the general security risk of exposing detailed error messages/stack traces directly to end users in a production application?
What is the security concern behind "insecure direct object references" (IDOR), a common web application vulnerability?
What is SQL injection, and what is the primary defense against it?
What is a "supply chain attack," in the context of software dependencies, and why has it become an increasingly cited concern?
Gaps to close?
Read the curated Security Best Practices notes — core concepts, patterns, interview prep.