Provyn Prep · Security Fundamentals competency
Application vulnerabilities in the Security Fundamentals assessment
Application vulnerabilities is one of the areas a Provyn Security Fundamentals credential scores separately, so a recruiter can see it on its own rather than averaged into one number. This guide explains what it covers, how it is tested and what to practice.
What it covers
Common web application vulnerabilities such as injection, XSS, CSRF, SSRF and open redirects, and how each is prevented.
Topics in the practice set for this area
- injection defense
- CSRF
- XSS
- OWASP
- open redirect
- SSRF
How it is tested
In the timed assessment, questions in this area use these formats: matching, multiple choice, short answer, written scenario. Each attempt draws its own set of questions, and this area gets its own sub-score on the credential when the attempt includes enough questions from it. The assessment questions themselves are never published; the practice set below is written separately for study.
What to practice
- For each OWASP Top 10 category, write one sentence on the root cause and one on the fix.
- Rewrite a string-built SQL query with parameters.
- Explain why output encoding depends on where the data is placed in a page.
Try a practice question
From the free practice set (6 questions in this area). Answers and explanations are in the practice set.
- Which is the primary defence against SQL injection?
- CSRF attack relies on:
- XSS vulnerability typically lets an attacker:
Practice before the real thing
Both are free and use practice questions only, never questions from the real assessment.
More Security Fundamentals study guides
Last reviewed 2026-10-06.