Security - Fundamentals Quiz 1

Question 1

Administrative sessions

What is the recommended alternative to an administrative resource resolver?

Context: AEM security

Anonymous resolver Repository login without credentials Service resolver with subservice Request resolver reuse

Question 2

Keeping credentials out of code

Where should an application credential be stored instead of source code?

Context: AEM security

Client-side JavaScript Git repository Secret management service Page properties

Question 3

Preferred backend identity model

For custom backend code that needs repository access, what is the recommended security approach?

Context: Backend security

Use the admin session for simplicity Use a service user with the least required privileges Reuse any anonymous session Grant write access to everyone under /content

Question 4

Why prefer service users over administrative sessions in backend code?

What is the strongest reason to use a dedicated service user mapping for repository access in custom AEM services?

Context: Secure backend access

It follows least privilege and avoids broad administrative repository sessions It guarantees anonymous write access It skips OSGi component activation It disables CSRF protection

Question 5

Protecting cookie access

Which cookie flag prevents JavaScript from reading a cookie?

Context: Web security

Secure Max-Age SameSite HttpOnly

Question 6

Server-side validation

Where must untrusted form input be validated?

Context: AEM security

Only after publishing Only in the browser On the server Only by Dispatcher

Question 7

What risk does CSRF protection help reduce in AEM applications?

Cross-Site Request Forgery protection mainly helps defend against which kind of issue?

Context: Web application security

Oak index corruption Slow workflow models Attackers forcing a user’s browser to submit an unwanted authenticated action Broken image renditions

Question 8

Protecting authenticated form posts

Why are CSRF tokens important for authenticated browser requests that modify content in AEM?

Context: Web security

They replace authentication entirely They help ensure the modifying request originated from a trusted session context They speed up Dispatcher caching They enable GraphQL schema generation

Question 9

Sensitive OSGi configuration

How should sensitive OSGi configuration be supplied in Cloud Service?

Context: AEM security

Committed config values Content packages Clientlib properties Environment-specific secret variables

Question 10

HTL and XSS reduction

What security benefit does HTL provide by default when used correctly?

Context: Secure rendering

Automatic dispatcher deny rules Automatic context-aware output escaping Automatic repository encryption Automatic TLS certificate rotation

Question 11

Redirect target safety

How should a redirect URL supplied by a user be handled?

Context: Web security

Encode as a password Allowlist valid destinations Store in a clientlib Redirect without checks

Question 12

Authentication and authorization

What determines whether an authenticated user may perform an action?

Context: AEM security

Replication Caching Authentication Authorization

Question 13

Cookie cross-site policy

Which cookie attribute helps limit cross-site request sending?

Context: Web security

Domain SameSite Expires Path

Question 14

Dependency vulnerability response

What is the primary response to a confirmed vulnerable dependency?

Context: Application security

Copy its source into the app Suppress all alerts Upgrade to a fixed version Disable TLS

Question 15

Encrypted transport

Which protocol should protect authenticated traffic in transit?

Context: Web security

HTTP FTP Telnet HTTPS

Question 16

Script execution restrictions

Which response header restricts permitted script sources?

Context: Web security

Content-Security-Policy ETag Accept-Ranges Last-Modified

Question 17

Safe Dispatcher filter strategy

Which Dispatcher filter approach is generally safest for public sites?

Context: Edge hardening

Disable filters when CDN is present Allow everything except /system Mirror author access exactly on publish Start with deny-all and explicitly allow required paths and methods

Question 18

Sensitive logging

What should logs do with access tokens?

Context: Application security

Log them fully Redact them Add them to URLs Put them in page HTML

Question 19

Dispatcher filter posture

What is the safest baseline for Dispatcher request filters?

Context: AEM security

Filter only POST requests Allow author paths publicly Allow all paths Deny by default, allow required paths

Question 20

Safe file uploads

What should a server verify for an uploaded file?

Context: Web security

Content type and size Browser version Filename extension only User timezone

AEM CQ5 Tutorials

Security – Fundamentals Quiz 1

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Related