Deck 11: Software Security

Question 1

Many computer security vulnerabilities result from poor programming
practices.

Answer 1

True

Question 2

There is a problem anticipating and testing for all potential types of
non-standard inputs that might be exploited by an attacker to subvert a program.

Answer 2

True

Question 3

"Improper Access Control (Authorization)" is in the _________ software error category.

A)Porous Defenses
B)Allocation of Resources
C)Risky Resource Management
D)Insecure Interaction Between Components

Answer 3

A

Question 4

A difference between defensive programming and normal practices is
that everything is assumed.

Question 5

To counter XSS attacks a defensive programmer needs to explicitly
identify any assumptions as to the form of input and to verify that any
input data conform to those assumptions before any use of the data.

Question 6

The correct implementation in the case of an atomic operation is to
test separately for the presence of the lockfile and to not always attempt to create it.

Question 7

Defensive programming requires a changed mindset to traditional
programming practices.

Question 8

_________ is a program flaw that occurs when program input data can accidentally or deliberately influence the flow of execution of the program.

A)PHP attack
B)Format string injection attack
C)XSS attack
D)Injection attack

Question 9

An ASCII character can be encoded as a 1 to 4 byte sequence using
the UTF-8 encoding.

Question 10

Incorrect handling of program _______ is one of the most common failings in software security.

A)lines
B)input
C)output
D)disciplines

Question 11

Security flaws occur as a consequence of sufficient checking and
validation of data and error codes in programs.

Question 12

Defensive programming is sometimes referred to as _________.

A)variable programming
B)secure programming
C)interpretive programming
D)chroot programming

Question 13

Programmers often make assumptions about the type of inputs a
program will receive.

Question 14

"Incorrect Calculation of Buffer Size" is in the __________ software error category.

A)Porous Defenses
B)Allocation of Resources
C)Risky Resource Management
D)Insecure Interaction Between Components

Question 15

Software security is closely related to software quality and reliability.

Question 16

Injection attacks variants can occur whenever one program invokes the
services of another program,service,or function and passes to it
externally sourced,potentially untrusted information without sufficient
inspection and validation of it.

Question 17

Cross-site scripting attacks attempt to bypass the browser's security
checks to gain elevated access privileges to sensitive data belonging to
another site.

Question 18

Without suitable synchronization of accesses it is possible that values
may be corrupted,or changes lost,due to over-lapping access,use,and replacement of shared values.

Question 19

Key issues from a software security perspective are whether the
implemented algorithm correctly solves the specified problem,whether the machine instructions executed correctly represent the high level algorithm specification,and whether the manipulation of data values in variables is valid and meaningful.

Question 20

To prevent XSS attacks any user supplied input should be examined
and any dangerous code removed or escaped to block its execution.

Question 21

A number of widely used standard C _________ compound the problem of buffer overflow by not providing any means of limiting the amount of data transferred to the space available in the buffer.

Question 22

__________ programming is a form of design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of the software.

Question 23

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.

A)shell scripting
B)fuzzing
C)canonicalization
D)deadlocking

Question 24

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

Question 25

Blocking assignment of form field values to global variables is one of the defenses available to prevent a __________ attack.

A)PHP remote code injection
B)mail injection
C)command injection
D)SQL injection

Question 26

A ________ is a pattern composed of a sequence of characters that describe allowable input variants.

A)canonicalization
B)race condition
C)regular expression
D)shell script

Question 27

The most common technique for using an appropriate synchronization mechanism to serialize the accesses to prevent errors is to acquire a _______ on the shared file,ensuring that each process has appropriate access in turn.

A)lock
B)code injection
C)chroot jail
D)privilege escalation

Question 28

A variant where the attacker includes malicious script content in data supplied to a site is the __________ vulnerability.

Question 29

The major advantage of ________ is its simplicity and its freedom from assumptions about the expected input to any program,service,or function.

Question 30

In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.

Question 31

_________ are a collection of string values inherited by each process from its parent that can affect the way a running process behaves.

A)Deadlocks
B)Privileges
C)Environment variables
D)Race conditions

Question 32

"Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

Question 33

Program input data may be broadly classified as textual or ______.

Question 34

A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.

Question 35

The process of transforming input data that involves replacing alternate,equivalent encodings by one common value is called _________.

Question 36

Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

Question 37

A _______ attack is where the input includes code that is then executed by the attacked system.

A)SQL injection
B)cross-site scripting
C)code injection
D)interpreter injection

Question 38

A _________ attack occurs when the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server.

A)command injection
B)SQL injection
C)code injection
D)PHP remote code injection

Question 39

A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.

A)fuzzing
B)deadlock
C)memory injection
D)memory leak

Question 40

_________ attacks are most commonly seen in scripted Web applications.

Question 41

The principle of ________ strongly suggests that programs should execute with the least amount of privileges needed to complete their function.

Question 42

UNIX related systems provide the chroot system function to limit a program's view of the file system to just one carefully configured section that is known as a ________.

Question 43

If privileges are greater than those already available to the attacker the result is a _________.