Tag: security

Questions Related to security

In which of the following exploits does an attacker insert malicious coding into a link that appears to be from a trustworthy source?
technology security

  1. Cross site scripting

  2. Command injection

  3. Path traversal attacks

  4. Buffer overflow

Show answer
Correct Option: A

Name the attack: Technique used to access files and directories stored outside web root folder

technology security

  1. Insecure file upload

  2. Path Traversal

  3. Brute forcing

  4. Universal PDF XSS

Show answer
Correct Option: B

Cookie value gets submitted during POST submit of HTML FORM
technology security

  1. True

  2. False

  3. May be

  4. Never

Show answer
Correct Option: A

From application security perspective, when do we need to use CAPTCHA in an web page
technology security

  1. To prevent scripted attach

  2. to provide biometric authentication

  3. to check the color blindness of user

  4. more security

Show answer
Correct Option: A
Explanation:

From an application security perspective, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is commonly used for preventing scripted attacks. These attacks involve automated bots or scripts that try to exploit vulnerabilities in web applications. By using CAPTCHA, it becomes harder for automated bots to bypass security measures and perform malicious activities like spamming, credential stuffing, or brute-forcing.

So, the correct answer is A. To prevent scripted attacks.

Option B, "to provide biometric authentication," is not the primary purpose of CAPTCHA. Biometric authentication typically involves using unique physical or behavioral characteristics of an individual, such as fingerprints or facial recognition, to verify their identity.

Option C, "to check the color blindness of the user," is not the primary purpose of CAPTCHA either. CAPTCHA primarily focuses on distinguishing between humans and bots, and while it may include visual challenges, it is not specifically designed to check for color blindness.

Option D, "more security," is a vague statement and doesn't provide a specific reason for using CAPTCHA. While CAPTCHA does enhance security by preventing automated attacks, it is more accurate to say that it specifically targets preventing scripted attacks.

Therefore, the correct answer is A. To prevent scripted attacks.

A team member wrote a piece of code. IQA is being done by other team member in the same project. What type of testing does he do
technology security

  1. compliance testing

  2. functional testing

  3. unit testing

  4. black box testing

Show answer
Correct Option: C

When do we need to be performance testing
technology security

  1. After system testing and application security testing but before deployment to production

  2. After application security testing but before acceptance test by the client/end user

  3. just before deployment to production

  4. after system test

Show answer
Correct Option: B

When do we need to be penetration testing

technology security

  1. After integration testing but before acceptance testing by the client/end user

  2. after unit test

  3. after integration testing

  4. during system testing

Show answer
Correct Option: A

In threat modeling, what methodology used to perform risk analysis

technology security

  1. STRIDE

  2. DREAD

  3. OWASP

  4. DAR

Show answer
Correct Option: B

AI Explanation

To answer this question, you need to understand the different methodologies used in threat modeling and risk analysis.

Option A) STRIDE - This option is incorrect because STRIDE is a threat modeling framework that helps identify and categorize threats based on six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. It is not specifically a methodology for risk analysis.

Option B) DREAD - This option is correct because DREAD is a risk assessment methodology commonly used in threat modeling. DREAD stands for Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. It helps evaluate and prioritize risks based on these five factors.

Option C) OWASP - This option is incorrect because OWASP (Open Web Application Security Project) is an online community that provides resources and guidance for web application security. While OWASP provides valuable information related to threat modeling and risk analysis, it is not a specific methodology for risk analysis.

Option D) DAR - This option is incorrect because there is no widely recognized risk analysis methodology called DAR.

The correct answer is B) DREAD. This option is correct because DREAD is a risk assessment methodology commonly used in threat modeling. It helps evaluate and prioritize risks based on five factors: Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability.

In DREAD methodology of risk analysis in threat analysis, how is the Risk score for each threat is calculated

technology security

  1. Risk score = (Reproducibility * Exploitability * Discoverability) / (Damage potential * Affected users)

  2. Risk score = (Reproducibility * Exploitability - Discoverability) ^ (Damage potential + Affected users)

  3. Risk score = (Reproducibility + Exploitability + Discoverability) / (Damage potential + Affected users)

  4. Risk score = (Reproducibility + Exploitability + Discoverability) * (Damage potential + Affected users)

Show answer
Correct Option: D
Explanation:

To understand how the Risk score for each threat is calculated in DREAD methodology, the user needs to know the components of the DREAD acronym, which stands for Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. In this method, each component is scored on a scale of 0 to 10, with 10 representing the highest possible value. The scores for each component are then used to calculate the overall risk score for each threat.

Now, let's go through each option and explain why it is right or wrong:

A. Risk score = (Reproducibility * Exploitability * Discoverability) / (Damage potential * Affected users) This option is incorrect. The formula is not correct as it is multiplying the Reproducibility, Exploitability, and Discoverability and dividing it by the Damage potential and Affected users. The correct formula involves adding up the scores for each of the five components, not multiplying and dividing them.

B. Risk score = (Reproducibility * Exploitability - Discoverability) ^ (Damage potential + Affected users) This option is incorrect. The formula is not correct as it is subtracting the Discoverability from the product of Reproducibility and Exploitability, and then taking the result to the power of the sum of Damage potential and Affected users. The correct formula involves adding up the scores for each of the five components, not subtracting and taking the power of them.

C. Risk score = (Reproducibility + Exploitability + Discoverability) / (Damage potential + Affected users) This option is incorrect. The formula is not correct as it is adding the Reproducibility, Exploitability, and Discoverability and then dividing it by the sum of Damage potential and Affected users. The correct formula involves adding up the scores for each of the five components, but not dividing them by anything.

D. Risk score = (Reproducibility + Exploitability + Discoverability) * (Damage potential + Affected users) This option is correct. The formula is correct as it is adding the Reproducibility, Exploitability, and Discoverability and then multiplying it by the sum of Damage potential and Affected users. The correct formula involves adding up the scores for each of the five components, and then multiplying them by each other.

Therefore, the answer is: D

Select the correct choice for "Security Design Principle"

technology security

  1. 1) Keep it easy to understand 2) Secure default access 3) Defense in Depth 4) encapsulation 5) Highest privilege

  2. 1) Keep it easy to understand 2) Secure access 3) Defense in Depth 4) encapsulation 5) Highest privilege

  3. 1) Keep it simple and secure 2) Secure default access 3) Defense in Depth 4) Compartmentalization 5) Least privilege

  4. 1) Keep it easy to understand 2) Secure access 3) DMZ 4) encapsulation 5) Highest privilege

Show answer
Correct Option: C
Explanation:

To select the correct choice for "Security Design Principle," the user needs to have knowledge about security design principles and their components.

Now, let's go through each option and explain why it is right or wrong:

A. 1) Keep it easy to understand 2) Secure default access 3) Defense in Depth 4) encapsulation 5) Highest privilege

This option is incorrect because it includes "highest privilege," which means giving users the maximum level of access, which is not a good security practice as it can lead to data breaches or unauthorized access. The other principles listed are correct.

B. 1) Keep it easy to understand 2) Secure access 3) Defense in Depth 4) encapsulation 5) Highest privilege

This option is incorrect because it lacks the principle of "least privilege," which is a fundamental security principle that means providing users with the minimum level of access they need to perform their tasks. This principle helps reduce the attack surface and minimize the damage in case of a breach.

C. 1) Keep it simple and secure 2) Secure default access 3) Defense in Depth 4) Compartmentalization 5) Least privilege

This option is correct. It includes all the essential security design principles, such as secure default access, defense in depth, compartmentalization, and least privilege. Moreover, it emphasizes keeping the design simple, which is always a good practice.

D. 1) Keep it easy to understand 2) Secure access 3) DMZ 4) encapsulation 5) Highest privilege

This option is incorrect because it includes "DMZ," which is not a design principle but a network architecture that separates the internal network from the external network. Also, it includes "highest privilege," which is not a good security practice.

Therefore, the correct answer is:

The Answer is: C