35. A software developer wants to implement an application security technique that will provide assurance of the application's integrity. Which of the following techniques will achieve this goal?
Answer: D
Code signing provides assurance of an application's integrity.
Code signing is a technique that involves using cryptographic signatures to verify the authenticity and integrity of software. By signing the code, developers can ensure that it has not been altered or tampered with after being published.
A) Secure cookies
Secure cookies are used to enhance security in web applications by ensuring that cookies are only sent over secure HTTPS connections. While they improve session security, they do not provide assurance of the application's integrity itself.
B) Input validation
Input validation is a technique used to ensure that user inputs are correct and safe to process. While it helps prevent malicious data from affecting application behavior, it does not directly verify the integrity of the application code.
C) Static analysis
Static analysis refers to the examination of code without executing it, typically to find bugs or vulnerabilities. Although it can improve code quality, it does not provide a mechanism for verifying the integrity of the software after it has been developed.
D) Code signing
Code signing is the correct technique for providing assurance of an application's integrity. By using a digital signature, it confirms that the code comes from a verified source and has not been modified since it was signed.
Conclusion
Code signing is the definitive choice for ensuring application integrity, as it directly addresses the concern of unauthorized modifications. Other options may enhance security or quality in various ways but do not provide the necessary assurance of integrity like code signing does. Therefore, D is the correct and logical choice in this context.