Tag: security

Quizzes (70) Questions (1339)

Questions Related to security

Multiple choice technology security

Choose the correct answer:

  1. HTTP PUT & DELETE method can be disabled in web.xml from the below code: <Web-resource-collection> <web-resource-name>Disallowed Location</web-resource-name> <url-pattern>/*</url-pattern> <http-method>PUT</http-m

  2. HTTP PUT & DELETE methods are disabled by default

  3. HTTP PUT & DELETE methods should not be disabled

  4. HTTP PUT & DELETE methods cannot be disabled
Reveal answer Fill a bubble to check yourself
A Correct answer
Full explanation
Multiple choice technology security 
public void dummyFunction(String var1,String var2){ 
    try{ 
        Connection con=getConnection(); 
        String query=”select * from table1 where col1=”+var1 +”and col2=”+var2; 
        Statement st=conn.createStatement(); 
        ResultSet rs=st.executeQuery(query); 
        …… ….. 
    } catch(Exception e) { } 

}

var1 and var2 are inputs from user directly passed to this functions. This code is

  1. Vulnerable to SQL Injection

  2. Vulnerable to DoS

  3. Both a & b

  4. None of the above
Reveal answer Fill a bubble to check yourself
C Correct answer
Multiple choice technology security

Below function is used to read file from a directory on the filesystem. This code runs with read only OS level privilege on this directory. fileName is parameter from user directly passed to this function

public void dummyFunction(String fileName){             
    FileInputStream fis = new FileInputStream(fileName); // code to read file content only, no write modify or delete 
}

  1. Security is handled at OS level by giving only read level privilege so no need to put an extra check here.

  2. Only problem here is that fileName may not be syntactically incorrect so it should be validated before using it in the function.

  3. This code can lead to information disclosure attack

  4. Java provides enough security by default for IO operations so this code is not vulnerable.
Reveal answer Fill a bubble to check yourself
C Correct answer
Full explanation
Multiple choice technology security

Please select which of the following statements are NOT true regarding the AccessController class?

  1. Can be used to mark code as being "privileged", thus affecting subsequent access determinations

  2. Can be to decide whether an access to a critical system resource is to be allowed or denied, based on the security policy currently in effect

  3. Can be used to obtain a "snapshot" of the current calling context

  4. Can be used to compute a cryptographically secure hash
Reveal answer Fill a bubble to check yourself
D Correct answer
Full explanation
Multiple choice technology security

The following code is part of a system daemon that is run with elevated privileges. It opens a temp file in /tmp directory as a cache. Is there an issue in this code sample? Please assume that filling up /tmp is not an issue here. 

int outfile = fopen(“/tmp/cache_data”, O_WRONLY | O_CREAT | O_TRUNC, 0600);

  1. Since the file name is hard coded, fopen() will fail if the file already exists.

  2. 0600 is not a secure option. The parameter 0600 should be changed to 0666

  3. Attackers can exploit by creating a symboling link /tmp/cache_data that points to a system file.

  4. Attackers can exploit the application's cache by writing directly to /tmp/cache_data
Reveal answer Fill a bubble to check yourself
C Correct answer
Full explanation
Multiple choice technology security

Is writing to an already freed memory a vulnerability?

x = malloc(200); /* do something with x */ 
free (x); /* do something else */  
strcpy(x, “somedata”);

  1. Overwriting freed memory is a security vulnerability

  2. Depends on the application and how important “somedata” is

  3. This will result in a buffer overflow since the freed memory location cannot handle 8 characters of data “somedata”

  4. strcpy() will fail as it cannot write to already freed memory, and the application will crash.
Reveal answer Fill a bubble to check yourself
A Correct answer
Full explanation