The close of module 8 made it clear: after applying every OWASP standard and tool to BazarNube -remediating the Top Ten, verifying with ASVS, guiding with SAMM, scanning with ZAP and stitching it all together with DevSecOps- the next step is to demonstrate that the knowledge has stuck. This lesson is that demonstration. It introduces no new concepts: it tests you in an integrative way over everything covered. You will find a bank of multiple-choice questions with reasoned answers that sweeps across the Top Ten 2021, ASVS, SAMM, ZAP and good practices, and a final practical case on BazarNube in which you will have to identify vulnerabilities, propose controls and map them to OWASP, with a self-assessment rubric to measure your command honestly. Treat it as the exam you grade yourself: if something is off, you will know exactly which lesson to return to.

1. How to use this assessment
2. Bank of multiple-choice questions (with answers and explanation)
3. Final practical case: express audit of BazarNube
4. Self-assessment rubric
5. Interpreting your result
6. Common mistakes and tips
7. Exercises
8. Conclusion

For the score to mean something, do it under exam conditions:

• Answer first, correct later. Cover the solutions and answer the whole test before reading any explanation.
• No notes on the test. The question bank measures what you remember; the practical case does allow consulting the documentation (that is how it works in reality).
• Write your answers to the practical case before looking at the rubric: self-assessing from memory inflates the score.
• Note which module each mistake belongs to. The goal is not the figure, but detecting your gaps and returning to the specific lesson.

The assessment is structured in two blocks: 20 multiple-choice questions (knowledge) and one practical case (application). The ## Exercises section at the end contains the full exam with its solutions.

Below is the bank by area. The answers and explanations are at the end, in the solutions section, so you can do it blind. Each question indicates in brackets the area it evaluates.

Q1. [A01] A BazarNube user changes the id in the URL /orders/1024 to /orders/1025 and sees someone else's order. Which Top Ten 2021 category applies and what is the pattern called? a) A03 Injection — SQLi b) A01 Broken Access Control — IDOR c) A07 Identification Failures — session fixation d) A05 Security Misconfiguration

Q2. [A02] Which of these practices corresponds to A02 Cryptographic Failures? a) Validating the search input with parameterized queries b) Storing passwords with a slow, salted hash (e.g. bcrypt/Argon2) c) Adding the X-Frame-Options header d) Rate-limiting requests per user

Q3. [A03] The search query "SELECT * FROM products WHERE name LIKE '%" + q + "%'" in BazarNube is vulnerable. Which is the recommended primary control? a) Escaping quotes manually b) A WAF that filters SQL keywords c) Parameterized queries / prepared statements d) Hiding the database error messages

Q4. [A05/A06] BazarNube exposes an admin panel accessible without authentication and with the framework's default password. Which two Top Ten categories best describe the problem? a) A05 Misconfiguration and A07 Identification/Authentication Failures b) A02 Cryptographic Failures and A03 Injection c) A08 Integrity Failures and A09 Logging and Monitoring d) A04 Insecure Design and A10 SSRF

Q5. [A10] BazarNube's "import catalog from URL" feature lets you supply http://169.254.169.254/... and returns internal cloud provider metadata. What is this? a) XXE b) SSRF (A10) c) Open Redirect d) Insecure deserialization

Q6. [A08] Which control mitigates A08 Software and Data Integrity Failures? a) Verifying signatures/hashes of dependencies and artifacts (e.g. SCA + supply-chain integrity) b) Rotating TLS keys every 90 days c) Applying Content-Security-Policy d) Using JWT tokens with short expiry

Q7. [ASVS] Which statement about the ASVS levels is correct? a) L1 is the most demanding and L3 the minimum b) L1 is a black-box verifiable minimum; L2 is the standard for most apps; L3 is for critical applications c) The levels measure the maturity of the team, not the product d) ASVS only applies to REST APIs

Q8. [ASVS] BazarNube handles payments and personal data. In 07-05 it was decided to aim for ASVS L2. Which best represents the role of ASVS in the project? a) A dynamic scanning tool b) A catalog of verifiable requirements used as acceptance criteria c) An organizational maturity model by domain d) A threat modeling methodology

Q9. [SAMM] Which question does OWASP SAMM answer that ASVS does not? a) Is this specific endpoint secure? b) Which CWE does this vulnerability have? c) How mature is our security program and how do we improve it? d) Which payload exploits this injection?

Q10. [SAMM] SAMM organizes the security practice into five business functions. Which of these is one of them? a) Governance b) Firewalling c) Pentesting d) Encryption

Q11. [ZAP] In BazarNube's pipeline, ZAP was used in baseline mode. What characterizes that mode? a) It performs intrusive active attacks against the application b) It is a passive/fast analysis meant not to break the build and to detect regressions c) It only works in desktop mode with manual intervention d) It fully replaces manual penetration testing

Q12. [ZAP] What is the difference between ZAP's passive and active scan? a) The passive one modifies the requests; the active one only observes b) The passive one observes traffic without sending attacks; the active one sends malicious requests to provoke vulnerabilities c) They are synonyms d) The active one is safer to run in production

Q13. [ZAP] To test areas of BazarNube that require login, ZAP needs: a) Nothing special, it scans everything by default b) To configure a context with authentication and session/user management c) To disable HTTPS d) To always run as baseline

Q14. [S-SDLC] Why is it cheaper to fix a security flaw in the design phase than after an incident? a) Because designers are paid less b) Because the cost of fixing grows as the lifecycle advances; in production it means re-engineering, incident response and reputational damage c) Because in design you do not have to write code d) It is not cheaper, it is a myth

Q15. [Threat modeling] STRIDE is a model for classifying threats. What does the "T" represent? a) Testing b) Tampering c) Trust d) Transport

Q16. [DevSecOps] Which type of tool detects secrets (keys, tokens) leaked in the repository? a) DAST (e.g. ZAP) b) SAST (e.g. Semgrep) c) Secret scanning (e.g. gitleaks) d) SCA (e.g. Dependency-Check)

Q17. [DevSecOps] Match the tool with its category: Dependency-Check. a) SAST — analyzes the source code b) SCA — analyzes third-party dependencies for known vulnerabilities c) DAST — attacks the running app d) Secret scanning

Q18. [Culture] What is the role of a Security Champion? a) To replace the security team b) To be the security point of reference within their development team and scale the knowledge c) To run only the scanners d) To approve deployments without review

Q19. [Gates] A security quality gate in CI/CD serves to: a) Speed up the build by ignoring findings b) Block (or alert) the pipeline when findings appear above a defined severity threshold c) Encrypt traffic between services d) Generate automatic documentation

Q20. [Integration] Which statement best summarizes the course philosophy applied to BazarNube? a) Security is a final phase before deploying b) Security is a continuous property of the process and the culture, integrated across the whole cycle c) An annual pentest is enough d) Security depends on buying enough tools

Read the following excerpt of a new BazarNube feature and answer in writing before looking at the rubric.

Context. BazarNube adds "Gifts": a user uploads an image from a URL, writes a dedication and sends the gift to another user by their user_id. The backend exposes:

• POST /gifts with body { "to_user_id": 88, "image_url": "http://...", "message": "<text>" }.
• The image is downloaded on the server from image_url to generate a thumbnail.
• The message is stored and shown as-is (HTML) on the recipient's page.
• To view a gift: GET /gifts/{id} — returns the gift without checking who requests it.
• User passwords are stored with MD5(password) without salt.
• There is no logging of this action.

Your task:

1. Identify at least four vulnerabilities.
2. For each one, propose a concrete control.
3. Map each vulnerability to its Top Ten 2021 category and to the relevant OWASP area (ASVS/other).

Write your answer now. The model solution and the rubric are below.

Score your answer to the practical case with this rubric (maximum 20 points):

Add up the five criteria (each up to 2 points = 10) and multiply the test block by its weight; see the interpretation below.

Combine both parts. The test contributes 20 points (1 per correct answer) and the practical case 10 (rubric), total 30.

Remember: the number orients, but what matters is which lesson each mistake sends you to. A 24 with all the errors concentrated in ZAP is fixed by reviewing M6; a scattered 24 calls for a broader review.

• Studying for the test and not for the case. Memorizing the 10 categories is not the same as spotting them in real code. The practical case is what measures true command; give it more weight.
• Confusing SAMM with ASVS. It is the most frequent conceptual error in the course: SAMM measures the maturity of the program; ASVS defines requirements of the product. If you missed Q8 or Q9, go back to 05-01 and 04-01.
• Naming the vulnerability without proposing a verifiable control. "It has SSRF" is not a complete answer; "validate the destination with an allow-list and block internal ranges like 169.254.0.0/16" is.
• Not prioritizing. In a real audit not everything weighs the same: an IDOR exploitable in production comes before a missing log. The rubric rewards justifying the order.
• Tip: repeat this assessment after one or two weeks. Real retention is measured with a delay, not right after reading the lesson.

The three exercises make up the complete exam. Do them in order and without looking at the solutions.

Exercise 1 — Test. Answer the 20 questions from the bank above (Q1 to Q20). Note your letter for each one.

Exercise 2 — Practical case. Solve the "express audit of BazarNube": identify vulnerabilities, propose controls and map them to OWASP. Score yourself with the rubric.

Exercise 3 — Review plan. From your mistakes in exercises 1 and 2, write a mini plan: list the modules to review ordered by number of errors, and one concrete action per module (a lesson to reread or a lab to do).

Solution 1 — Test answers:

Solution 2 — Practical case (model answer):

Reasoned prioritization: 1 and 3 first (directly exploitable and affect user data), 2 next (serious impact but requires abusing the import), 4 (critical but exploitable only if the DB leaks) and 5 cross-cutting (it enables the detection of the others). If you identified 4 of these 5 with their control and mapping, your grasp of the applied Top Ten is solid.

Solution 3 — Review plan. There is no single solution. A well-done example: "I missed Q11-Q13 (ZAP) and the SSRF control in the case -> M6 and 03/A10. Actions: reread 06-04 (automation) and set up Juice Shop to practice SSRF (see 09-03)." The right thing is for the plan to come from your real mistakes, prioritize by frequency and end in concrete, verifiable actions, not in good intentions.

This assessment has closed the circle module 8 opened: first you applied OWASP to BazarNube and now you have measured how much of it you truly command. If you did the test blind and the practical case in writing, you already have an honest map of your strengths and of the lessons worth returning to. That self-assessment is not a formality: it is exactly the criterion by which you will decide whether you are ready to take the next step, accrediting your knowledge to others. In the next lesson, 09-02 OWASP Certification, we will clarify what role OWASP plays in the ecosystem of application security certifications, which industry certifications fit what you have learned and how to choose the right one for your profile. You reach it with the essentials already demonstrated: not just knowing, but knowing how to apply it.