Write secure coding quiz questions as short scenarios with a single decision, plausible wrong answers and a one paragraph explanation of why the right answer works. Test judgement, not vocabulary. Draw scenarios from your own code and recent findings so the questions feel like the job.
What a quiz is for
A quiz has three jobs: help people recall, show you where understanding is thin, and give learners quick feedback. It is not a gate to be passed at all costs. If people memorise answers to clear it, you have measured memory.
The template
- Scenario. Two or three sentences, set in a situation a developer would recognise.
- Question. One decision. What would you do, or what is wrong here?
- Options. Three or four. Each wrong option should be something a real person might choose.
- Explanation. Why the correct answer is right and why the tempting one fails.
A worked example
A developer adds an endpoint that returns an invoice by id. The handler loads the invoice from the database and returns it. Users must be logged in to call it. What is the main risk?
- A. Invoices should be encrypted in the database.
- B. A logged in user may be able to fetch another user's invoice by changing the id.
- C. The endpoint should use a longer id.
- D. The endpoint should be slower.
The right answer is B. The explanation: logging in proves who the caller is, not which invoices they may see. The handler needs to check ownership. Option C is tempting but only hides the problem.
Rules of thumb
| Do | Avoid |
|---|---|
| Use realistic scenarios | Definition recall |
| Make wrong answers plausible | Joke options |
| Explain every answer | Showing only a score |
| Keep it to five to ten questions | Long exams |
| Rotate questions | Reusing the same set forever |
| Use your own code shapes | Textbook toy cases |
Traps
- Trick questions. They punish careful readers and teach nothing.
- Giveaway wording. If the longest option is always right, people notice.
- Outdated advice. Re-read each question when guidance changes. A stale answer teaches the wrong lesson.
- Hidden assumptions. If the answer depends on the framework, say which one.
Using the results
Look at which questions many people miss. That is a topic gap, or a badly written question, so check both. Follow up with a short session on the weak topic rather than assigning the quiz again.
Where quizzes fit in a program
Quizzes work best as short retrieval practice after a session or alongside work, for example after a training exercise or as a weekly question. They work poorly as a once a year exam. Pair them with hands on exercises, since reading about a flaw is different from fixing one.
Where Safeguard fits
Real findings make strong questions. Safeguard's dependency scanning, SAST and policy views can give you a pool of anonymised examples from your own repositories. It does not offer training courses. Try a free scan at gold.safeguard.sh/scan.
Quick check
How many questions should a security quiz have?
Five to ten is enough for most sessions. Long quizzes tire people and weaken the signal.
Should there be a pass mark?
Only if it serves a clear purpose. A learning quiz works better as feedback than as a gate.
Last reviewed: 19 October 2026.
