What is a dependency?

Correct! A dependency is reusable code found in a library, package, or module. It’s often used to add features and functionality to a software application that currently don’t exist. It eliminates the need to write the feature or functionality code from scratch, thus saving time and money.

You must store an API encryption key in your code. What can you do to protect it?

Correct! Passwords, certificates, and API encryption keys should be secured against possible attacks. Store these assets using a secrets management solution to manage and integrate with your applications and databases. A tool like Vault, developed by Hashicorp, can help. It is a token-based storage solution for managing secrets.

You are assigned a task to review an extremely large codebase in a short period of time. You are also required to be able to make any necessary changes immediately. What is the best way to achieve this?

Correct! If you have a large number of files and lengthy codes, an automated code review is the best choice of action. Large codebases are evaluated quickly and efficiently. When used while writing code, changes can be made right away.

Your company’s database was the target of a SQL injection attack. You’re not sure how it happened since you were hired long after it was put into production. What steps can you take to secure your web application?

Correct! Protect your application against SQL injection attacks by using server-side validation to identify untrusted data inputs.

You wrote the code for a web application. No vulnerabilities were found before it went live last month. Is it safe to assume that your application is still free of vulnerabilities today?

Correct! Code that was secure last month could be vulnerable today. Implement security early in the software development lifecycle. Use vulnerability analysis tools during testing before your app goes live. Perform regular vulnerability scans after the go-live date. Keep informed of the latest vulnerabilities by checking vulnerability reports which are published daily.

You are tasked with keeping your data safe from unauthorized changes by outside forces with malicious intent. What process can you use to achieve that goal?

Correct! Data integrity is the process of ensuring stored data hasn’t been changed by an authenticated source. It means you can trust the data you’re reading.

You are working on a software application and need to find a way to analyze your code to check its correctness. Which method will help you accomplish this task?

Correct! Static analysis is a debugging method that automatically checks your source or object code, or runtime binaries for correctness without executing the code. It covers more avenues of code execution, verifies the code as you work on the build, and indicates where possible problems may exist in your code.

You have been given access to an application that needs to be checked for flaws, memory issues, and crashes – as the application is executing. Choose the appropriate analysis method for this task.

Correct! Dynamic analysis is the process of testing and evaluating an application as it is executing. Use it to analyze fully-built applications in production. Scan to diagnose and fix flaws, memory issues, and crashes.

Cross-site scripting attacks are listed as one of the OWASP top 10 most critical types of security risks for web applications. What action can you take to prevent them?

Correct! Escaping suspect lists, keywords, and blocking special characters can help prevent cross-site scripting attacks. Looking for suspicious HTTP requests or keywords, disabling HTTP TRACE support on web servers, and avoiding the use of unsafe sinks by refactoring or using textContent or values can also help.

At what point in the Software Development Life Cycle should threat modeling be implemented?

Correct! The best time to implement threat modeling is during the design phase. By developing threat models early, you can lessen the potential for software vulnerabilities and eliminate weaknesses in the application.

Your organization has experienced several issues with performance, outages, and is starting to see some loss in revenue. You have been tasked with finding a solution to help identify and resolve issues quickly and minimize downtime. What type of solution should you look for?

Correct! Application monitoring helps you detect, prevent, and resolve problems more quickly. Receive alerts as problems arise and gain valuable insight into application performance from real-time metrics gathered. Reduce downtime to save money and maintain a positive user experience.

Your company is looking for a way to gain a deeper insight into their business systems to understand how they perform and how customers are utilizing their web apps. Vast amounts of data are being collected from business systems but how can they make sense of it all?

Correct! Visualization is the graphical representation of information or data collected from your business infrastructure that helps you understand and maintain your application’s performance. Charts, graphs, and maps provide an accessible way to see and understand trends, outliers, and patterns in data that can help drive business decisions.

Your organization is experiencing rapid growth with several new systems and applications deployed. Your staff and budget haven’t expanded and it’s becoming increasingly difficult to stay on top of issues and cumbersome trying to identify root causes of problems. What solution can you implement to help you become more proactive and less reactive in this situation?

Correct! An open-source monitoring and alerting system, such as Prometheus, could do a lot of the heavy lifting for you. Monitor servers, virtual machines, applications, and databases. It analyzes, tracks and reports on system health, application behavior, prediction, and performance. It provides detailed, actionable metrics and is a reliable, go-to system for quick diagnosis of outages or problems.

When looking into monitoring systems for your organization, what is an essential component that your monitoring solution should provide?

Correct! Metrics, observation, and alerting are essential components that form the basis of a monitoring system. Metrics represent resource usage or behavior observed and collected from your systems. Observability helps you recognize and understand, and understand patterns between data collected, and aggregated information, across resources and services.

Your monitoring system notifies you of a latency issue with your web application. Instead of searching through hundreds of possible causes, what can help you quickly speed up the process?

Correct! Four Golden signals are the standard for monitoring applications. They are Latency, Traffic, Errors, and Saturation. Focus on your application's most critical performance indicators for proactive, actionable monitoring. Tracking these signals helps you identify and resolve issues, sometimes even before they become a problem.

Your organization currently monitors all of its systems. You are trying to make the case that simply monitoring systems isn’t enough. What is your justification for using more than just system monitoring to give your organization more insight into its systems and infrastructure?

Correct! There are many types of monitoring tools. One type or a combination of different types can give your organization maximum insight into your business systems. It’s important to be familiar with different types of monitoring tools to help you determine which are best for your organization.

Your company is currently using application monitoring to gather metrics about application performance and for alerting. Your director wants you to implement an evaluation solution, too. Why would your company think evaluation is necessary, isn’t monitoring sufficient?

Correct! Monitoring is essential for measuring app performance, visualization, and alerting. Evaluation, a business-level activity, helps determine if the app is aligned with outcomes and is profitable. It shows how well the app performs, its sustainability and that it works as designed. Monitoring and evaluation ensure that a healthy, valuable, and performant app is delivered to users.

You are designing the application logging for your company’s new app. Where should you begin?

Correct! Identifying what information should be collected and how it will be used is an important part of logging. You must define what, how, and when to log application information and data. Like applications, logs must be designed, implemented, and tested. Logging is important for diagnostics and auditing.

Your monitoring system has an alerting feature that you’ve configured to the best of your ability. It is working; however, it isn’t detecting some problems quickly enough. At other times, alarms are triggered by normal operations. What could be the cause?

Correct! Thresholds set too broadly prevent the monitoring system from detecting problems quickly enough. Affected systems or apps could experience higher levels of performance degradation, leading to downtime. Thresholds set too sensitively trigger false alarms. In both cases, re-evaluate the threshold baseline and adjust monitors to improve detectability of real issues.

Your company is using Prometheus, an open-source monitoring and alerting system. You also have a time-series database, multiple other data sources and need to be able to integrate all of it into a single, organized view. What could you use, in conjunction with Prometheus, to make that happen?

Correct! Grafana is a cross-platform, open-source data visualization and metrics analysis tool. It provides time-series analytics on time-series databases transforming them into insightful graphs and visualizations. It can integrate multiple data sources into a single view and is commonly used with Prometheus.