Web Application Security Fundamentals

ASLR randomizes memory address locations to make it harder for attackers to predict where code and data are stored, while DEP prevents code execution from certain memory regions like the stack and heap. Together they effectively mitigate buffer overflow attacks by making it difficult for attackers to predict where to jump to execute their shellcode and preventing execution in writable memory regions.

Without input validation, allowing users to define the duration a thread sleeps enables them to specify extremely large values. This can tie up active execution threads indefinitely, leading to system resource exhaustion and a Denial of Service, rather than injection or authentication issues.

Stored Cross-Site Scripting (XSS) occurs when an attacker uploads or injects a malicious script onto a target server (such as in a comment section). The script then executes inside the browser of any user who retrieves and reads that content, attacking the client side.

To solve this question, the user needs to know about caching and how to prevent sensitive data from being cached on clients or proxies.

Option A: "Cache-Control: do not-cache, do not save" - This option is not entirely correct. Although the "do not-cache" directive will prevent the client or proxy from caching the data, there is no "do not save" directive in the Cache-Control header field.

Option B: "Cache-Control: do not-save, do not store" - This option is incorrect. There is no "do not-save" or "do not store" directive in the Cache-Control header field.

Option C: "Cache-Control: no-cache, no store" - This option is correct. The "no-cache" directive indicates that the client or proxy should not use a cached copy of the data for subsequent requests, but it should revalidate the data with the origin server. The "no-store" directive indicates that the client or proxy should not store the data in any form of cache. Together, these directives ensure that sensitive data is not cached on the client or proxy.

Option D: "Cache-Control: do not cache" - This option is not entirely correct. The "do not cache" directive will prevent the client or proxy from caching the data, but it does not prevent the data from being stored in other forms of cache.

Therefore, the correct answer is:

The Answer is: C

All listed items, including FTP, common files, and BITS, are optional or default features that can be configured as component services under an IIS installation to support file transfer, background downloads, and standard web operations. Therefore, all choices are IIS components.

Services represent functional interface endpoints where clients interact with the application. Unlike error messages or response codes (which are outputs) or packaging (which is a deployment structure), services are direct entry channels through which external systems input data, making them key entry points.

Enforcing strict directory permissions prevents directory traversal attacks by blocking access to files outside the intended root. Restricting home page access or requiring logins fails to validate directory paths and does not stop authenticated users from attempting traversal.

Economy of mechanism advocates for simple, small designs to minimize attack surface. By custom building Apache to include only necessary features, complexity is reduced. Least privilege applies to user permissions, fail-safe defines default secure states, and leveraging components reuses code.

To solve this question, the user needs to know the different design principles used in system design.

The option that represents the design principle described in the question is:

B. Least Privilege

Explanation:

The principle of least privilege is a design principle in which users, agents, or processes are granted only the necessary permissions to perform their assigned tasks, and no more. This principle is important because it limits the potential damage of a security breach or other security incident. By applying the most restrictive set of operating system permissions to all application files, the system is designed to provide each application with the minimum level of access required to function properly, reducing the potential damage that could occur from a security breach.

Option A, Least common mechanism, is a separate design principle that states that the fewer mechanisms shared by users, the less likely those mechanisms are to be compromised.

Option C, Separation of duties, is a design principle that requires that more than one person be involved in a task to ensure that no single individual has complete control over a process.

Option D, Weakest link, is a design principle that states that security is only as strong as its weakest point. It emphasizes the need to identify and address vulnerabilities in a system to ensure that it is secure overall.

Therefore, the correct answer is:

The Answer is: B. Least Privilege

OSQL is a legacy command-line utility for SQL Server that uses ODBC APIs to run queries. PSQL and PostgreSQL are associated with PostgreSQL, and SQLCMD uses OLE DB or modern drivers rather than primarily targeting raw ODBC commands.

Data and Input Validation is the correct countermeasure because it ensures that incoming data conforms to expected size limits and formats before processing. This prevents attackers from submitting oversized input that could cause buffer overflows. Error handling (A) is a response mechanism, not a preventive measure. SQL Injection (B) and Buffer Overflow (D) are attack names, not countermeasures.

Using a firewall for content verification is a defensive security control, not a vulnerability. Invalidated input, cross-site scripting, and web server misconfigurations are software weaknesses or flaws that attackers can exploit to compromise the security of the application.

HTML source code commonly reveals directory structures through paths in script tags, link tags for stylesheets, image sources, and anchor hrefs. These expose the site's file organization. Physical security measures (B), alarm codes (C), and password policies (D) are operational security details not embedded in HTML.

SSL/TLS encrypts data in transit to ensure confidentiality and integrity between client and server. Plain HTTP 1.0 and HTTP 1.1 send data in cleartext without encryption, while HTTP Keep-Alive is a connection management feature rather than a security protocol.

The input id=' OR 1=1- manipulates the database query logic to bypass authentication, indicating a SQL injection attack. Cross-site scripting targets browser execution, buffer overflows exploit memory boundaries, and cross-site request forgery forces users to execute unwanted actions.

Dumpster diving is an attack technique where unauthorized individuals search trash for sensitive details, making it a threat rather than a security mechanism. Defense, deterrence, and detection are valid security mechanisms designed to protect, discourage, and identify unauthorized activities.