Application Security Fundamentals

The Java javax.servlet.http.Cookie class provides the setSecure(boolean flag) method to signal to the browser that the cookie should only be sent over secure protocols like HTTPS. Other options like setSSL, setCookieSSL, and setCookieSecure do not exist in the standard Servlet API.

Persistent cookies are stored as text files on the user's hard disk, making them readable by anyone with access to the machine or malware. This exposes session information to theft. Options A and B are incorrect - cookies are transmitted via HTTP headers and do expire based on their set expiration time, regardless of browser close. Option D is incorrect - persistent cookies do have security risks.

Audit logs must capture comprehensive event information for forensics and compliance. Option D includes all essential elements: user identity, timing, source, errors, and full HTTP request context (URL, method, protocol version, browser, referrer, response code). Options A, B, C are incomplete. Critically, passwords should NEVER be logged - options B and C incorrectly include password logging, which is a serious security violation.

Effort slippage is a general project management metric assessing schedule adherence, not a software security metric. The other options directly quantify vulnerabilities, risks, and exception issues.

OWASP stands for Open Web Application Security Project. It's a worldwide nonprofit organization focused on improving software security. Option B is correct. Options A, C, D are incorrect expansions.

Application security logging must capture authentication events (login, logout, failed attempts), policy violations, and critical transactions. Option B correctly adds 'Forgot password correct and wrong credentials' - this is crucial because it captures both successful and failed password reset attempts, which are sensitive authentication events. Options A, C, D are incorrect - C and D incorrectly include 'password sharing logs' and 'race condition logs' which are not standard application logging practices.

Black-box testing assumes zero prior knowledge of the application's internals. White-box has full access, grey-box has partial access, and 'redbox' is not a standard security testing category.

Cryptographically secure PRNGs (CSPRNGs) are specifically designed to be unpredictable under cryptographic attacks. Statistical and other simple PRNGs do not offer these security guarantees.

The term is 'Cross-Site Scripting' (XSS). 'Cross Side Scripting' is a misspelling and not a standard security term, whereas Blind SQLi, RFI, and CSRF are all valid attacks.

The Same-Origin Policy (SOP) restricts scripts on one page from accessing sensitive data on another unless they share the same scheme, host, and port. The other options are incorrect terms.

Cross-site scripting (XSS) attacks have three main types: Persistent (stored), Reflected (non-stored), and DOM-based. Option D 'Inflicted' is NOT a recognized XSS attack type - this is the correct 'not valid' answer. Options A, B, C are all valid XSS attack types, so they are incorrect answers to this negative-framed question.

Allowing bidders to see others' login IDs enables targeted account locking (denial of service) by submitting three incorrect logins for those IDs, exploiting the lockout mechanism.

Facebook and Twitter widely use OAuth 2.0 for API authorization and authentication delegation. OpenID, LiveID, and AES (a symmetric encryption standard) are incorrect.

Burp Suite, Paros, and WebScarab are all web application interception proxies. Wireshark is a general-purpose network packet analyzer, making it the odd one out.

The code directly executes a command with user input: cmd.exe /K \c:\util\rmanDB.bat . When user input is concatenated into a command string without validation or sanitization, attackers can inject additional commands. This is the classic Command Injection vulnerability. The privileged context (running as privileged user) makes this even more dangerous. Options B, C, D are incorrect - this is not buffer overflow, XSS, or CSRF.

A sandbox is a security mechanism that isolates running programs by providing a tightly-controlled set of resources. It restricts what the program can access (files, network, system resources). Option B is correct. Options A (Jailbreaker), C (Separator), D (Domain) are not standard security isolation mechanisms.

Fuzzing (or fuzz testing) involves creating malformed, unexpected, or random data inputs and feeding them to software to identify vulnerabilities, crashes, or unexpected behavior. This is exactly what Roy is doing. Option B is correct. Options A (Warping Tool), C (Randomizer), D (Code Injector) are not standard security testing tools for this purpose.

OWASP (Open Web Application Security Project) is an open community dedicated to improving the security of software, particularly web applications. Option C is correct. They produce resources like the OWASP Top 10, testing guides, and security standards. Options A (performance), B (SEO), D (GUI) are incorrect - these are not OWASP's focus.

STRIDE is a threat modeling methodology developed by Microsoft. It's an acronym for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege - categories of security threats. Option A is correct. Options B (HP for performance), C (Symantec for testing), D (Fortis for assessments) are incorrect.

Social engineering attacks manipulate people rather than technology. Intimidation (threatening or pressuring victims) and Impersonation (pretending to be someone else) are classic social engineering techniques. Option A is correct. Options B (SQL Injection), C (Man in the middle), D (Cookie poisoning) are technical attacks, not social engineering.