Question 1

When you developing an application both secured and not secured web pages, what is the reason for the need to have the login page SSL enabled

technology security

MITM proxy can be used to change the URL to a non secured one
If the login page is not SSL enabled, the credentials will be transmitted in plain text to the web server and Attacker can sniff the credentials supplied by the user
Firewall logs will have the credentials in plain text
proxy logs will have the credentials in plain text

Answer

Correct Option: B

Question 2

In a multi-staged login in an application, what is that to be ensured for application security by the developer

technology security

During multi-staged login, the application should validate the credentials supplied at each stage only
Hidden variables should be used to remember the previous stage values and current stage supplier credentials to be validated at server end
During multi-staged login, the application should validate the credentials supplied at each stage and previous stages
Credentials supplied at the prevoius stage should be saved in cookie and current stage supplier credentials to be validated at server end

Answer

Correct Option: C

Question 3

Which of the following is an attack technique that forces a web site to echo client-supplied data, which execute in a user’s web browser

technology security

XSS
Reflection Attack
Mirror Attack
XSLT

Answer

Correct Option: A

Question 4

Which of the following is an attack technique used to exploit "dynamic file include" mechanisms in web applications

technology security

Dynamic File Attack
Remote File Inclusion
Dynamic Data Attack
Data Dynamics

Answer

Correct Option: B

Question 5

What is Static Analysis

technology security

Static Code Analysis is the analysis of software code by actually executing the binaries resulting from this code
Static Code Analysis is the analysis of software code without actually executing the binaries resulting from this code
Static Code Analysis is the analysis of executables resulting from this code
None of the above

Answer

Correct Option: B

Question 6

The process of addressing a security vulnerability by blocking an attack vector that could exploit it is known as

technology security

Anti Patching
Anti Attack
Virtual Patching
Patch Attack

Answer

Correct Option: C

Question 7

AppSensor is a popular

technology security

Web Applictation Firewall
Application Based Intrusion Detection
Database Monitoring
Virtual Private Lan

Answer

Correct Option: B

Question 8

ModSecurity is a popular

technology security

Web Applictation Firewall
Application Based Intrusion Detection
Database Monitoring
Virtual Private Lan

Answer

Correct Option: A

Question 9

Any attack which is based on information gained from physical implementation of a crypto system,rather than brute force or algorithm weakness is known as

technology security

Back Attack
Unknown Attack
Reverse Attack
Side Channel Attack

Answer

Correct Option: D

Question 10

Which of the following is not a function of Database Activity Monitor

technology security

Previlged User Monitoring
Application Activity Monitoring
Cyberattack Protection
Database Recovery

Answer

Correct Option: D

Question 11

Which of the following is a valid method of classifying computer security threats

technology security

DREAD
FEAR
SAFE
DEAF

Answer

Correct Option: A

Question 12

Which of the following is a valid threat modelling methodology

technology security

STRIDE
PRIDE
BRIDE
RIDE

Answer

Correct Option: A

Question 13

If an attacker submit multiple input parameters (query string, post data, cookies,etc.) of the same name, the application may react in unexpected ways and open up new avenues of server-side and client-side exploitation.This is the premise of

technology security

HTTP Parameter Pollution
Session Splitting
Parameter Damage
Parameter Busting

Answer

Correct Option: A

Question 14

What is a an Evercookie?

technology security

Evercookie is a javascript API available that produces extremely persistent cookies in a browser
Evercookie is a cookie anonymysing tool
Evercookie is a FireFox Plugin
Evercookie is a cookie pollution tool

Answer

Correct Option: A

Question 15

Which of the following is a valid crypto graphic attack

technology security

Padding Oracle Attack
Padding CBC Attack
Oracle Lockback
Padding Filter

Answer

Correct Option: A

Question 16

Strcpy(), strcat(), strncpy(), sprint(), gets() are all included in

technology security

Safe APIs
Banned APIs
String APIs
CAPIs

Answer

Correct Option: B

Question 17

_________is a free static code analysis tool from Microsoft that checks .NET managed code assemblies for conformance to Microsoft's .NET Framework Design Guidelines

technology security

MsCop
FxCop
RsCop
DxCop

Answer

Correct Option: B

Question 18

Ollydbg is a popular

technology security

Compiler
Reverse Engineering tool
Database Monitoring tool
Macro Analyzer

Answer

Correct Option: B

Question 19

NOP sled technique is a popular

technology security

Reverse Engineering Technique
Buffer Overflow Attack Technique
Log Analysing Technique
Data Analysis Technique

Answer

Correct Option: B

Description: Application threat modeling, Security, Security tools and best practices
Number of Questions: 19
Created by: Aliensbrain Bot
Tags: security technology

Application threat modeling Quiz - 1

Find more quizzes from top tags