Question 1

When do we need to be penetration testing

technology security

After integration testing but before acceptance testing by the client/end user
after unit test
after integration testing
during system testing

Answer

Correct Option: A

Question 2

In threat modeling, what methodology used to perform risk analysis

technology security

STRIDE
DREAD
OWASP
DAR

Answer

Correct Option: B

Question 3

In DREAD methodology of risk analysis in threat analysis, how is the Risk score for each threat is calculated

technology security

Risk score = (Reproducibility * Exploitability * Discoverability) / (Damage potential * Affected users)
Risk score = (Reproducibility * Exploitability - Discoverability) ^ (Damage potential + Affected users)
Risk score = (Reproducibility + Exploitability + Discoverability) / (Damage potential + Affected users)
Risk score = (Reproducibility + Exploitability + Discoverability) * (Damage potential + Affected users)

Answer

Correct Option: D

Question 4

Select the correct choice for "Security Design Principle"

technology security

1) Keep it easy to understand 2) Secure default access 3) Defense in Depth 4) encapsulation 5) Highest privilege
1) Keep it easy to understand 2) Secure access 3) Defense in Depth 4) encapsulation 5) Highest privilege
1) Keep it simple and secure 2) Secure default access 3) Defense in Depth 4) Compartmentalization 5) Least privilege
1) Keep it easy to understand 2) Secure access 3) DMZ 4) encapsulation 5) Highest privilege

Answer

Correct Option: C

Question 5

The kind of testing in which activities are performed to find the active machines, open ports and available services, identifying the OS and mapping the network

technology security

Passive Scanning
Social Engineering
Scanning
Fuzzing

Answer

Correct Option: C

Question 6

What is the best approach to be used while providing access to SSO application in a portal

technology security

Mandatory access control
Role Based Access Control
Discretionary Access Control
Biometric access control

Answer

Correct Option: B

Question 7

Which tool can be used for system vulnerability test

technology security

Nessus
HP Web Inspect
TAM
SDL

Answer

Correct Option: A

Question 8

Name the query language for reading XML document

technology security

Xpath
XmlReader
SQL
xmlPlus

Answer

Correct Option: A

Question 9

Which one is not a counter measure for log tampering

technology security

Digitally signed and stamped logs
Log file Read/write privilege is controlled by System administrator
Separate logs for system events
Transaction log for all application events

Answer

Correct Option: B

Question 10

DMZ is a

technology security

DMZ is the place where customers servers are deployed.
DMZ is an area where all the protocols are allowed to pass through.
semi trusted network zone that separates the untrusted internet from the companys trusted internal network
DMZ is cyber warfare terminology

Answer

Correct Option: C

Question 11

Cookie value gets submitted during POST submit of HTML FORM

technology security

SQL Injection
Cross site request forgery
Session fixation
session hijack

Answer

Correct Option: C

Question 12

Password complexity check should be implemented where?

technology security

Client side only
server side only
Both client and server side
In the SQL procedure

Answer

Correct Option: B

Question 13

While using "Forgot Password" feature by user to recover the password, what should be checked first

technology security

whether the credentials provided are valid and correct
whether account is already disabled
whether account is locked
whether the CAPTCHA values entered by the user same as what is in the image

Answer

Correct Option: B

Question 14

Which tool can be used for Threat Modeling

technology security

HP Web Inspect
Nessus
Open Vas
TAM

Answer

Correct Option: D

Question 15

Which of the following is mandatory for the audit and access logs of the application to be valid in the court of law

technology security

log should have url accessed by user
Date and time logged in the logs should be in IST format
logs have to be in W3C format
System time is in sync with INDIA domain time and the logs should have uniquely identifiable information about the user

Answer

Correct Option: D

Question 16

When you are performing EQA of an application developed by another project, you are doing

technology security

white box testing
black box testing
security testing
vulnerability testing

Answer

Correct Option: A

Question 17

An application is developed and deployed in production. A bug was found and a CR was raised and modified code is ready for deployment after following SSA and SDLC. This interim release of the application is called

technology security

Release of CR
maintenance of application
release of patch
interim release of CR

Answer

Correct Option: C

Question 18

The application logs are backed up in a media and retained for years as required by law. One of the media found defective after a long period of time. What do we need to do with the media

technology security

Use it for overwriting current logs
Inform stakeholders and degauss the media
Keep it safely and securely in the fire proof safe
format the media

Answer

Correct Option: B

Question 19

You are asked to develop an application from scratch. When will you start performing Threat Modeling of the application

technology security

At the design stage
At the beginning of testing phase
During requirements collection phase
HP Webinspect performs the Threat Modeling, I do not need to do anything

Answer

Correct Option: C

Question 20

___________ is a malicious technique of tricking Web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages

technology security

Clickjacking
RoughJacking
CyberJacking
CrackJacking

Answer

Correct Option: A

Description: Application threat modeling Quiz
Number of Questions: 20
Created by: Aliensbrain Bot
Tags: security technology

Application threat modeling Quiz - 2

Find more quizzes from top tags