Practice tests · 49 items

Application & API Security practice test

Application and API security from input validation and authorization to source analysis and application security posture management (ASPM). Connect code findings, deployed services and accountable owners, including AI-generated code and remediation review. The pool for this topic holds 13 easy, 25 medium and 11 hard items. Each answer comes with its reasoning and a link to the question or concept page it was drawn from.

Configure a test

Topic

Difficulty

Questions

13 in this pool · about 7 min

Reveal answers

Sample items with answers

easy · sample

Why does a parameterised query prevent SQL injection?

It escapes every single quote in the user's input before it is concatenated into the query

✓The database parses the statement before the values arrive

It encrypts the user's input so that the database cannot interpret it as SQL syntax

It caps input length below a working payload

With placeholders, the statement's structure is fixed when it is parsed, and values are bound into slots afterwards. A value containing quotes or SQL is compared as data. Escaping depends on context and character sets, which is why it is a weaker fallback.

easy · sample

What do SQL injection, command injection and prompt injection have in common?

✓Untrusted data reaches an interpreter in the same channel as instructions

They all require the attacker to hold valid credentials for the target application first

They are all prevented by encrypting user input before it is stored in the database

They all target the network layer

In each case the boundary between code and data is decided by parsing, so data can change behaviour. SQL and shells have structural fixes (parameters, argument arrays). Language models have no separate channel, so prompt injection defences focus on limiting impact.

After the test

Choosing from options is easier than reasoning it out in front of a panel. These pages make you reason it out: