Application Security and Vulnerability Assessment

The Development Team owns the codebase and is responsible for implementing fixes for security vulnerabilities discovered during testing. While testing teams identify issues, remediation requires developers to modify the actual source code.

ASAP engagement models describe the intensity and phasing of security assessment activities. Full-Fledged represents comprehensive security assessment, Staggered indicates phased or incremental assessment, and Fast Track denotes accelerated security review timelines.

Static code analysis examines source code without executing it to identify security vulnerabilities during the design and build phases. This allows security issues to be caught early in the development lifecycle before runtime testing begins.

Penetration testing involves simulating real-world attacks to identify security weaknesses before deployment. This active testing approach is typically performed by security teams during the testing and rollout phase to validate defenses.

TCS Security API is the security library provided by TCS for remediation of security vulnerabilities. It offers standardized security functions and controls that development teams can integrate into their applications.

The analysis phase requires understanding requirements. Security URS (User Requirements Specification) captures security requirements, while Security SRS (Software Requirements Specification) details how those requirements will be implemented. Both artifacts guide the security assessment.

The ASAP Team specializes in security and reviews security elements of project artifacts at phase gates. This independent security validation ensures security requirements are properly addressed throughout the development lifecycle.

TCS ASAP is a proprietary security framework that provides structured methodology for application security assessment. It defines processes, engagement models, and best practices for integrating security into the software development lifecycle.

Virtual keyboards are NOT foolproof against keylogging. Hardware keyloggers capture keystrokes at the physical keyboard level before software virtual keyboards are involved. Kernel-level keyloggers intercept input at the OS level, capturing all input regardless of whether it comes from a physical or virtual keyboard. Both A and C correctly identify why virtual keyboards fail as protection.

MD5 has known cryptographic weaknesses and collision vulnerabilities that make it significantly easier to crack than NTLM, NTLMv2, or any strong modern hash. NTLM and NTLMv2 have stronger security properties, while an obscure hash would be more secure due to lack of known attacks.

netstat is the correct Windows command for displaying active network connections and listening ports. nbtstat scans NetBIOS names, tracert shows route hops, and route print displays routing table - none show open ports directly.

Man-in-the-Middle (MitM) attacks exploit certificate verification by intercepting communications between parties without their knowledge. An unverified digital certificate error indicates the certificate chain cannot be verified, which is a classic sign of an MitM attack where an attacker presents a fraudulent certificate.

AES (Advanced Encryption Standard) is the current US government standard for encryption and is significantly stronger than DES or Triple DES, which have known vulnerabilities. Whirlpool is a hash function, not an encryption algorithm. AES is approved for classified information and widely adopted.

HoneyMonkeys was Microsoft's research project that actively sought out malicious websites by using virtual machines to detect exploits. While honeypots passively wait for attacks, HoneyMonkeys aggressively hunted for malware. Honeybees, HoneyHoney, and HoneyFix are not real Microsoft projects.

A sandbox is a restricted environment that limits what programs can do, preventing them from accessing certain system resources or performing potentially harmful operations. It's used for security testing and untrusted code execution. Antivirus, worm, and backdoor are types of malware, not security environments.

Clickjacking attacks can trick users into granting permission for webcam and microphone access by invisibly layering malicious elements over visible buttons. This social engineering exploit manipulates user interactions without awareness.

Cross Site Printing (XSP) is a security vulnerability where malicious websites can trigger print commands on a victim's internal network printers. This occurs because browsers allow web pages to initiate print operations, which can be exploited to send unwanted print jobs to network-connected printers without user awareness. Options A and B are incorrect - this is a real attack, not a typo or Microsoft technology.

Call stack traces expose internal implementation details (file paths, method names, library versions, framework info). This helps attackers understand system architecture and identify vulnerabilities. Displaying user-specific info (A) or generic error messages (B) is less risky. 404 errors (D) are standard and safe.

AppScan gets locked out by repeatedly testing login/logout, triggering account lockout mechanisms. Configuring AppScan to skip login/logout pages prevents lockout while still testing the rest of the application. Changing thread count or timeout won't solve the account lockout issue.