Deck 8: Application Security

Question 1

When a hacker is able to take over control of a host, nearly or completely, this indicates the hacker has ________.

A) super user privileges
B) system privileges
C) Session Initiation Protocol
D) Simple Network Management Protocol

Answer 1

super user privileges

Question 2

Among the most widespread vulnerabilities in application programs are ________ vulnerabilities.

A) operating system
B) buffer overflow
C) root
D) PHP

Answer 2

buffer overflow

Question 3

Temporary areas in RAM are known as ________.

A) stacks
B) stack entries
C) returns
D) buffers

Answer 3

buffers

Question 4

If an attacker enters more bytes into an area than it can accommodate, the extra is known as ________.

A) stack overflow
B) buffer overflow
C) overfiltering
D) a data buffer

Question 5

Microsoft's web-server software is the ________.

A) XSS
B) IIS
C) IPP
D) SQL

Question 6

What is BugTraq?

A) A vulnerability tracking service
B) A virus
C) An application that runs on Windows
D) An antivirus program

Question 7

In Microsoft Internet Explorer, the ________ allows users to begin to change their settings.

A) Tools menu
B) Action menu
C) Security tab of the Internet Options dialog box
D) Privacy tab of the Internet Options dialog box

Question 8

A danger of website programming is accidentally allowing ________.

A) IIS
B) IPP
C) XSS
D) SQL

Question 9

________ is when one user's input can appear on the page of another user.

A) Login screen bypass
B) Cross-site scripting
C) An SQL query
D) SQL injection

Question 10

________ is an attack that involves sending modified SQL statements to a web application that will, in turn, modify a database.

A) Login screen bypass
B) Cross-site scripting
C) An SQL query
D) SQL injection

Question 11

________ is a computer language used to access and manage databases.

A) C
B) IIS
C) Ajax
D) SQL

Question 12

________ uses multiple technologies to create dynamic client-side applications.

A) Ajax
B) C
C) IPP
D) SQL

Question 13

A common type of buffer overflow is the stack overflow.

Question 14

The mechanics of vulnerabilities, exploits, and patches are substantially different for operating systems and applications.

Question 15

There are some programs that must run with root privileges.

Question 16

It is recommended that cryptographic system protections should not be used between the user and the application.

Question 17

An SQL statement uses the SELECT clause.

Question 18

The dynamic nature of Ajax makes it susceptible to malicious code injection.

Question 19

In Microsoft Windows, the native webserver program is ________.

A) Ajax
B) ISS
C) C
D) IPP

Question 20

In Microsoft Windows, the native webserver program is ________.

A) Ajax
B) ISS
C) C
D) IPP

Question 21

Apache and nginx are the two most widely used webserver programs on ________.

A) Windows 10
B) Unix
C) Linux
D) Linux and Unix

Question 22

________ occurs when attackers take over a computer and produce false web pages.

A) Directory traversal attack
B) Mobile code
C) Cross-site scripting
D) Website defacement

Question 23

Typing URLs with ________ in them can give access to sensitive directories.

A) ..
B) \
C) :\\
D) ::

Question 24

With directory traversal, the path ________ would allow an attacker to download the passwd file in the etc directory (on a Unix computer).

A) /passwd
B) ../passwd
C) ../etc/passwd
D) ../root/passwd

Question 25

What are Nikto, Paros Proxy, and Acunetix?

A) Webserver-specific vulnerability assessment tools
B) Directory traversal attackers
C) Mobile code tools
D) Website defacement tools

Question 26

Numerous ________ errors indicate that a directory or file was not found.

A) 512
B) 500
C) 303
D) 404

Question 27

Server-side programs should be created on ________.

A) development servers
B) testing servers
C) production servers
D) authentication servers

Question 28

Firms with rigorous deployment policies use all of the following EXCEPT ________ for that purpose.

A) development servers
B) testing servers
C) production servers
D) authentication servers

Question 29

After program or application creation, a program is moved to a(n) ________.

A) development server
B) testing server
C) production server
D) authentication server

Question 30

Webserver programs often have components that come from different companies.

Question 31

Attackers are rarely able to exploit vulnerabilities in custom programs.

Question 32

The UNICODE coding system can represent non-English languages.

Question 33

Websites do not typically have the ability to log responses of various error messages.

Question 34

After a program has been fully tested, it should be moved to a production server.

Question 35

An application proxy firewall sits between a webserver and the rest of a network.

Question 36

________ are small programs and are probably the safest because many attack-related actions are disabled.

A) Ajaxes
B) Java applets
C) Cookies
D) Stack entries

Question 37

________ can be used to track users at a website.

A) Stacks
B) Stack entries
C) Buffers
D) Cookies

Question 38

Which of the following is considered quite powerful and can do almost anything on the client machine?

A) JavaScript
B) Java
C) Active-X
D) VBScript

Question 39

Compared to full programming languages, scripts ________.

A) are more difficult to use than programming languages like Active-X
B) are easier to use than full programming languages
C) have similar protections to Java
D) are more difficult to use than programming languages like Java

Question 40

Which of the following was developed by Microsoft and was said to be safe due to cryptographically signed by the developer?

A) JavaScript
B) Active-X
C) Java
D) VBScript

Question 41

Which of the following is FALSE about cookies?

A) Some websites use cookies.
B) Antispyware programs cannot identify dangerous cookies.
C) They allow a website to track what pages you have visited.
D) Cookies can remember your login name and password to websites.

Question 42

In the Internet Options dialog box, the ________ tab lets you select security settings for general Internet websites.

A) Privacy
B) Advanced
C) Content
D) Security

Question 43

In the Internet Options dialog box, the ________ tab lets you control what information is released to websites.

A) Privacy
B) Advanced
C) Content
D) Security

Question 44

Under which of the following tabs in the Internet Options dialog box are cookies controlled?

A) Privacy
B) Advanced
C) Content
D) Security

Question 45

The more popular scripting languages for mobile code are VBScript and JavaScript.

Question 46

Many websites require users to have Active-X turned on.

Question 47

What is the problem with image spam?

A) It takes up more bandwidth than traditional text spam.
B) It isn't detectible.
C) It is smaller and less detectible than traditional text spam.
D) It consumes less bandwidth and often can get past traditional spam detectors.

Question 48

________ is considered unsolicited commercial e-mail.

A) A cookie
B) A virus
C) Spam
D) A buffer

Question 49

SSL/TLS provides security ________.

A) between an e-mail client and its mail server
B) between an authentication email and an e-mail client
C) only with suspicious e-mail
D) at the level of the PC

Question 50

Which of the following provides end-to-end e-mail security?

A) PKI
B) PGP
C) ISS
D) S/MIME

Question 51

Which of the following uses a circles of trust?

A) PKI
B) S/MIME
C) PGP
D) ISS

Question 52

Many firms filter incoming e-mail messages and some filter outgoing messages as well.

Question 53

PGP has had most success in person-to-person communication without corporate control.

Question 54

Which of the following make up for two of UDP's biggest weaknesses?

A) IP headers
B) UDP headers
C) RTP headers
D) Circles of trust

Question 55

VoIP is ________.

A) calling someone over a PSTN line
B) sending e-mail through the Internet
C) calling someone over the Internet
D) sending video over the Internet

Question 56

When someone speaks, a(n) ________ in the VoIP phone converts the voice into a stream of digital bytes.

A) codec
B) RTP header
C) buffer
D) TCP

Question 57

VoIP voice transmission uses ________ to carry the digital voice data.

A) UDP
B) codecs
C) buffers
D) TCP

Question 58

Which of the following is a signaling protocol?

A) VoIP
B) SIP
C) UDP
D) RTP

Question 59

SIP proxy servers are used primarily in ________.

A) RTP packets
B) signaling transmissions
C) transport transmissions
D) PSTN

Question 60

In VoIP, encryption may ________.

A) increase jitter
B) reduce throughput
C) make traffic unreadable
D) increase latency

Question 61

Spam over IP telephony is called ________.

A) RFC
B) SPIT
C) INVITE
D) VPN

Question 62

VoIP and the PSTN use different codecs.

Question 63

VoIP and the PSTN use different transport technology.

Question 64

A goal of VoIP is to provide convergence.

Question 65

Which of the following is NOT a supervisory protocol?

A) SNMP
B) ARP
C) OSPF
D) RTP

Question 66

Presence servers allow three or more parties to locate each other.

Question 67

Corporate IM systems should use a presence server rather than a relay server.