10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
These 10 free C)SWAE questions are organized by exam domain, so you can see how each part of the Certified Secure Web Application Engineer blueprint is tested. Reveal the answer and explanation under each question.
'That means a 94% chance of an attack,' says a product owner, pointing to a CVSS v4.0 Base Score of 9.4. Deployment reachability and compensating controls have not been assessed. What should the security engineer explain?
Correct answer: B - It indicates Critical severity; response priority also depends on deployment context.
Response header: Content-Security-Policy-Report-Only: script-src 'self' An injected inline event handler executes, and the browser console records a CSP violation. No enforcing CSP is present in another header or a meta element. The browser supports CSP. Both observations are expected because:
Correct answer: D - The browser reports policy violations but has not been given an enforcing policy.
A JWT access-token validator for billing-api reports: Signature: valid under the trusted issuer's key Issuer: expected identity provider Lifetime: valid Scope: read Audience: support-api The provider issues tokens for both billing-api and support-api. Billing's profile requires audience billing-api; both APIs use a scope named read. How should billing-api handle this token?
Correct answer: A - Reject it because billing-api is not among its intended recipients.
While signed in to a payment portal, a tester visits an unrelated website. A form on that site submits a POST that changes the tester's payout email. The browser attaches the portal's Secure, HttpOnly, SameSite=None session cookie. No attacker-controlled script runs in the portal's origin, and the attacker cannot read the cookie or response. The endpoint checks neither request origin nor a CSRF token. Which diagnosis and repair fit this evidence?
Correct answer: A - Cross-site request forgery; validate a session-bound anti-forgery token before changing the email.
A billing portal lets a signed-in billing viewer request a download URL for an invoice UUID. The URL is correctly signed and expires after 60 seconds. During testing, a viewer from Tenant North supplies a known invoice UUID belonging to Tenant South and receives a working download URL. Viewers are permitted to read invoices only within their own tenant. What must change at the URL-issuing endpoint?
Correct answer: B - Verify that the invoice belongs to the authenticated viewer's tenant before issuing the URL.
Support messages are stored using parameterized SQL and delivered as JSON. The browser's preview uses: preview.innerHTML = message.body; A stored test message executes JavaScript. Messages must remain plain text with all literal characters preserved, including angle brackets. Select the repair at the rendering step.
Correct answer: D - Replace the rendering statement with preview.textContent = message.body.
Two application workers encrypt records with the same AES-256-GCM key. Each worker constructs its 96-bit nonce from a local counter that starts at zero after every restart. The key remains unchanged across restarts, and both workers correctly generate and verify 128-bit authentication tags. Which design requirement is still unmet?
Correct answer: B - Nonces must remain unique across workers and across restarts using the same key.
An account-takeover detector generates 200 alerts in one week. Analysts confirm that 40 represent actual takeovers and that 160 represent legitimate activity. Nobody independently reviews activity that produced no alert. The service owner asks whether the detector catches most takeovers. Which assessment is supported by these results?
Correct answer: C - Precision is 20%; recall cannot be determined without information about takeovers that produced no alert.
A release controller verifies a container image's signature against the company's approved CI signing identity. That identity signs both development and production builds. Production approval names a particular source commit and release workflow, but the controller does not check either. Which additional evidence would establish that the image is the approved build, rather than merely a build signed by the company?
Correct answer: C - Verified provenance binding the image digest to the approved source commit and release workflow.
At 09:20, responders confirm a web shell and an ongoing unauthorized outbound transfer on one application replica. Other replicas can carry the workload. Central audit logs are already protected, but the affected replica's memory has not been collected. The incident lead has authorized network isolation that blocks production traffic while retaining a forensic management channel. Choose the first operational action.
Correct answer: C - Isolate the affected replica, keep it running, and collect volatile evidence through the forensic management channel.
The C)SWAE exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more C)SWAE questions with explanations.
Continue in the free practice test →
View plans