CSC Exam Prep Free practice test →

Free CSC Practice Questions

10 free, exam-style Cyber Secure Coder (CSC) practice questions with answers and explanations. No signup required. Work through them below, then take the full free CSC practice test to study every exam domain.

Question 1

A login routine builds its query with: "SELECT * FROM users WHERE name = '" + userInput + "'". A reviewer flags it as vulnerable to SQL injection. Which measure is the PRIMARY defense against this flaw?

  1. Encrypt the database so stored records are unreadable
  2. Use parameterized queries (prepared statements)
  3. Hide detailed database error messages from users
  4. Increase the database connection timeout value
Show answer & explanation

Correct answer: B - Use parameterized queries (prepared statements)

Question 2

A password-reset page replies "No account exists for that email" for unregistered addresses and "A reset link has been sent" for registered ones. A security tester marks this as a flaw. What is the weakness, and the BEST fix?

  1. Session fixation; regenerate the session ID after the reset completes
  2. Privilege escalation; require an administrator to approve every reset
  3. Account enumeration; return one identical response either way
  4. Weak hashing; raise the password hash iteration count significantly
Show answer & explanation

Correct answer: C - Account enumeration; return one identical response either way

Question 3

When storing user passwords, a unique salt is added to each password before hashing. What is the PRIMARY purpose of the salt?

  1. It lets the original password be recovered when needed
  2. It encrypts the password so attackers cannot read it
  3. It shortens the hash so it fits a fixed database column
  4. It defeats precomputed (rainbow-table) attacks
Show answer & explanation

Correct answer: D - It defeats precomputed (rainbow-table) attacks

Question 4

A developer wants to stop client-side scripts from reading the session cookie if the site is hit by cross-site scripting. Which cookie attribute MOST directly addresses this?

  1. Secure
  2. HttpOnly
  3. Domain
  4. Max-Age
Show answer & explanation

Correct answer: B - HttpOnly

Question 5

An input field must accept only a five-digit ZIP code. A teammate proposes rejecting any value containing '<' or '>'. Why is an allow-list approach (e.g., the pattern ^\d{5}$) generally preferred over this deny-list?

  1. An allow-list permits only known-good input by default
  2. A deny-list runs faster but cannot validate any numeric data at all
  3. A deny-list is automatically blocked by most modern web browsers today
  4. An allow-list removes any need to also validate the input on the server
Show answer & explanation

Correct answer: A - An allow-list permits only known-good input by default

Question 6

While threat modeling with STRIDE, the team identifies an attacker who forges another user's identity to gain access. Which STRIDE category is this, and which security property does it primarily threaten?

  1. Repudiation; it threatens non-repudiation
  2. Tampering; it threatens integrity
  3. Spoofing; it threatens authentication
  4. Elevation of privilege; it threatens authorization
Show answer & explanation

Correct answer: C - Spoofing; it threatens authentication

Question 7

A U.S.-based application stores and processes patients' protected health information (PHI). Which regulation MOST directly governs how that data must be protected?

  1. PCI DSS
  2. SOX (Sarbanes-Oxley)
  3. ISO 27001
  4. HIPAA
Show answer & explanation

Correct answer: D - HIPAA

Question 8

A risk analyst assigns each threat an estimated dollar loss and multiplies it by the probability of occurrence to prioritize remediation. Which type of risk assessment is being performed?

  1. Qualitative risk assessment
  2. Quantitative risk assessment
  3. DREAD-based risk scoring
  4. Architectural risk review
Show answer & explanation

Correct answer: B - Quantitative risk assessment

Question 9

A web application confirms a user's identity at login and then decides which records that user is allowed to view. Which pair correctly identifies these two steps?

  1. Authentication, then authorization
  2. Authorization, then authentication
  3. Accounting, then authentication
  4. Authorization, then accounting
Show answer & explanation

Correct answer: A - Authentication, then authorization

Question 10

A code reviewer runs a tool that inspects the application's source code for vulnerabilities WITHOUT executing the program. Which type of analysis is this?

  1. Dynamic analysis
  2. Penetration testing
  3. Static analysis
  4. Fuzz testing
Show answer & explanation

Correct answer: C - Static analysis

Ready for the real thing?

Practice hundreds more CSC questions with instant scoring, weak-area drills, and full exam simulations.

Start the free practice test See pricing