Common Python Security Mistakes

Final Quiz

Connecting to LMS... Progress: in progress

Assessment

1. Why do many Python security mistakes happen at trust boundaries? A. Trust boundaries are only used in network diagrams. B. Data, identity, permissions, or assumptions change at those points. C. Python automatically validates all boundary data. D. Trust boundaries replace code review.

2. What should input validation check beyond simple presence? A. Only whether the input field exists. B. Only the length of the function name. C. Only whether the request came from a browser. D. Type, shape, range, format, and business intent.

3. What is risky about string-built SQL? A. It can mix untrusted data with query instructions if handled unsafely. B. It always improves readability. C. It removes the need for database permissions. D. It automatically parameterizes values.

4. What is a safer database access pattern? A. Hiding database errors only. B. Using longer table names. C. Using parameterized queries or safe ORM patterns. D. Trusting client-side validation.

5. Why are eval and exec risky with untrusted input? A. They automatically sanitize data. B. They enforce authorization. C. They can treat strings as executable Python code. D. They prevent injection.

6. What is a common command execution mistake? A. Avoiding operating system commands when safer libraries exist. B. Building shell commands from untrusted or poorly validated input. C. Passing controlled arguments through safer APIs. D. Logging process outcomes safely.

7. What is object-level authorization? A. Formatting object names consistently. B. Encrypting every object in memory. C. Replacing server-side checks with hidden buttons. D. Checking whether a caller can access a specific record, file, tenant, or resource.

8. Why are client-side checks not enough for authorization? A. Clients can be modified or bypassed, so sensitive checks must be enforced server-side. B. They improve performance. C. They make APIs unnecessary. D. They always prevent abuse.

9. Why should secrets not be hardcoded? A. Source code, repositories, images, logs, or shared artifacts may expose them beyond the intended environment. B. Hardcoded secrets are always encrypted automatically. C. Hardcoded secrets make rotation easier. D. Secrets are not security-sensitive.

10. Why is debug mode dangerous in production? A. It makes code harder to read. B. It automatically improves access control. C. It can expose internal details, unsafe behavior, or development-only assumptions. D. It prevents logging.

11. Why do dependencies create Python security risk? A. Dependencies cannot affect runtime behavior. B. Third-party and transitive packages can introduce vulnerabilities, malicious behavior, maintenance issues, or unexpected changes. C. Dependencies are always safer than first-party code. D. Dependencies replace testing.

12. What is unsafe about loading untrusted pickle data? A. Pickle is only a text format. B. Pickle always validates input safely. C. Pickle replaces authentication. D. Loading untrusted serialized objects can lead to dangerous behavior depending on context.

13. What is a file upload security mistake? A. Setting size limits. B. Separating uploads from executable paths. C. Reviewing downstream processing. D. Trusting filenames, content types, paths, or file contents without validation and controls.

14. What should safe logging avoid? A. Unnecessary secrets, tokens, regulated data, or sensitive personal information. B. Correlation IDs. C. Event timestamps. D. Error categories.

15. Why are negative tests useful? A. They only test the easiest path. B. They replace code review. C. They check how code behaves with invalid, unexpected, unauthorized, or boundary-condition input. D. They guarantee no vulnerabilities exist.

16. Which statement best summarizes common Python security mistakes? A. Python code is secure by default. B. Most mistakes come from misplaced trust, unsafe boundaries, weak authorization, exposed secrets, unmanaged dependencies, unsafe parsing, and missing validation. C. Security mistakes only happen in web applications. D. Scanners replace developer judgment.