security Online Quiz - 43

Stack traces expose implementation details, file paths, framework versions, and variable states - all valuable intelligence for attackers. Unlike generic error messages, stack traces provide a roadmap of your application's internal structure.

Track the page parameter because each value represents a distinct application page that needs testing. Ignore the productid parameter because it's just a filter within pages - testing one productid value per page is sufficient, testing all values creates redundant tests.

Visited URLs shows what AppScan actually tested. Broken links reveal URLs AppScan couldn't access (gaps in coverage). Javascripts indicates client-side coverage - modern apps load content dynamically via JS, so seeing what JS was processed helps confirm comprehensive coverage.

AppScan visits URLs by crawling the application. If it cannot authenticate (login), it only sees public pages, drastically reducing accessible URLs. Additionally, if additional servers or domains hosting parts of the application aren't properly configured in AppScan's scope, the scanner won't discover or visit those URLs. The 'redundant path limit' and 'link limit' options are distractors - these are technical crawl settings that wouldn't cause the specific 55/500 pattern described.

Security scanners like AppScan actively test applications by submitting payloads and manipulating inputs - this can corrupt databases or disrupt functionality. Running in production risks data loss and affects real users. The preproduction/staging environment mirrors production without these consequences. The 'inform application owner' and 'reduce network traffic' options are incorrect - testing always requires notification, and scanning actually increases traffic.

Before testing, you must communicate (notify users and administrators so they're aware of potential disruptions), protect data (backup the database to enable recovery if the test causes issues), and document (though not listed here, documentation is also critical). SMTP servers should remain running unless specifically testing email handling. The question tests standard test preparation protocols.

The ASAP (Accelerated Systems Analysis and Planning) process works best when applied continuously across all development phases, from initial requirements analysis through rollout. This ensures security and quality considerations are integrated early rather than being added as afterthoughts, reducing costly rework and vulnerabilities.

During the ASAP requirements analysis phase, the primary activity is capturing and updating both User Requirements Specification (URS) and Software Requirements Specification (SRS) documents with security requirements. This ensures security is baked into the foundation rather than added later, while basic customer requirements gathering happens but isn't the phase's main security focus.

Security vulnerabilities are defects in code that must be fixed by the team that owns the codebase. The Development Team writes and maintains the application code, so they bear responsibility for implementing remediation. Testing teams (including specialized security teams like ASAP) identify issues but do not fix them.

ASAP offers different engagement models to suit varying project needs and timelines. Full-Fledged provides comprehensive coverage, Staggered allows phased assessment across iterations, and Fast Track accelerates the process for time-sensitive projects. The other options list generic contracting terms (pricing models) or delivery location models, not ASAP-specific engagement structures.

During the design and build phases, the application code is available but may not be fully deployed or executable in runtime environments. Static code analysis examines source code for vulnerabilities without needing to execute the application. Dynamic analysis requires a running application to interact with and observe behavior, which typically happens in later testing phases.

During the testing and rollout phase, the ASAP team conducts penetration testing to identify exploitable vulnerabilities in the running application. Penetration testing simulates real-world attacks by attempting to actively exploit security flaws. Unit testing is done by developers during coding, system and integration testing are QA activities - penetration testing is the specialized security testing performed by the ASAP team.

During the analysis phase, ASAP provides Security URS (User Requirements Specification) and Security SRS (Software Requirements Specification) documents to guide security requirements gathering and analysis. These artifacts help identify what security controls need to be designed. Security Design Guidelines would typically come later in the design phase, not during initial analysis.

The ASAP Team specializes in application security and is responsible for reviewing the security elements of project artifacts at each phase gate. The development team creates artifacts but lacks the specialized security expertise to validate security elements. The Project Manager coordinates activities but doesn't perform technical security reviews. Testing teams focus on functional quality.

TCS ASAP is a security framework that provides a structured methodology for integrating security throughout the application development lifecycle. While it is TCS proprietary (option A) and involves security testing activities (option C), neither captures the full scope - it's an overarching framework providing structure, processes, and guidance, not just a testing service or product.

SANS Institute is globally recognized as the largest and most trusted source for information security training and certifications, including the widely-recognized GIAC certifications. OWASP is a community focused on web application security resources, MITRE maintains security standards like ATT&CK and CWE, and WASC focuses on web application security consensus - but none provide comprehensive training and certification at SANS's scale.

OWASP (Open Web Application Security Project) maintains and periodically updates the OWASP Top 10 document, which represents a broad consensus about the most critical web application security risks. This document is widely referenced across the industry. WASC, NIST, and other organizations maintain their own security standards and resources, but do not produce the OWASP Top 10.

WASC (Web Application Security Consortium) maintains the Web Hacking Incident Database (WHID), which tracks media-reported security incidents that can be associated with web application security vulnerabilities. The Common Weakness Enumeration (CWE) and Common Vulnerabilities and Exposures (CVE) databases are maintained by MITRE, not WASC.

Bugtraq is the full disclosure mailing list maintained by SecurityFocus for detailed discussion and announcement of computer security vulnerabilities. BugZilla is a bug-tracking system, VirusList is not related to vulnerability disclosure.