Tag: security

Questions Related to security

A Buffer over flow occurs when …
technology security

  1. The application does not have enough memory allocated to handle the large amount of input

  2. The Operating System does not have enough RAM to handle large amount of input

  3. The client does not have enough memory allocated to handle the large amount of input

  4. A variable in the program does not have enough memory allocated to handle the amount of input

Show answer
Correct Option: D

An intruder manipulates the URL which causes the web server to either execute a file or reveal the contents of a file which could be lying anywhere in the file system even out side the document root directory. What type of attack is this?
technology security

  1. Cross-Site Scripting

  2. SQL injection

  3. Command injection

  4. Directory traversal

Show answer
Correct Option: D

Web server will log which part of a GET request?
technology security

  1. Hidden tags

  2. Query Strings

  3. Header

  4. Cookies

Show answer
Correct Option: B

How can we prevent dictionary attacks on password hashes ?
technology security

  1. Hashing the password twice

  2. Encrypting the password using the private key

  3. Use an encryption algorithm you wrote your self so no one knows how it works

  4. Salting the hash

Show answer
Correct Option: D

Implementing Access Control based on a hard coded IP address
technology security

  1. Can be done as it as an internal IP

  2. Can be done for internet facing servers as there are no chances of IP conflicts

  3. Is a good security practice

  4. Is a bad security practice

Show answer
Correct Option: D
Explanation:

To solve this question, the user needs to have a basic understanding of access control and network security.

Option A: Can be done as it is an internal IP

  • This option is partially correct. Implementing access control based on a hard-coded IP address can be done for internal IPs, since they are less likely to change or conflict with other IPs on the network. However, this alone does not guarantee security, and other measures such as firewalls and intrusion detection systems should also be in place.

Option B: Can be done for internet-facing servers as there are no chances of IP conflicts

  • This option is incorrect. Even for internet-facing servers, there are chances of IP conflicts, especially if the server is part of a larger network. Relying solely on hard-coded IP addresses for access control is not a good security practice.

Option C: Is a good security practice

  • This option is incorrect. While hard-coding IP addresses for access control can be part of a larger security strategy, it is not a good practice to rely solely on this method. Attackers can spoof IP addresses or gain access to a trusted IP address through various means. A more comprehensive security approach is needed.

Option D: Is a bad security practice

  • This option is partially correct. Relying solely on hard-coded IP addresses for access control is not a good security practice, as it is vulnerable to spoofing and other attacks. However, this does not mean that the practice is completely bad. It can be used in conjunction with other security measures, but should not be the only method of access control.

Therefore, the correct answer is:

The Answer is: D. Is a bad security practice

Temporary files
technology security

  1. Should be placed securely in a folder called “temp” in the web root

  2. Can be placed anywhere in the web root as long as there are no links to them

  3. Should be completely removed from the server

  4. Can be placed anywhere after changing the extension

Show answer
Correct Option: C

What is the preferred medium for backing up log files ?
technology security

  1. Print the logs to a paper

  2. Create a copy of data in your laptop/desktop

  3. Copy the files to CD-R's

  4. None of the above

Show answer
Correct Option: C

What is the common cause of buffer over flows, cross-site scripting, SQL injection and format string attacks?
technology security

  1. Unvalidated input

  2. Lack of authentication

  3. Improper error handing

  4. Insecure configuration management

Show answer
Correct Option: A

Configuration Management Security principles apply to
technology security

  1. Commercial applications

  2. Custom built applications

  3. In house developed applications

  4. All of the above

Show answer
Correct Option: D

Which of the following can you reveal without compromising the security of the encrypted data
technology security

  1. Encrypted data itself

  2. Asymmetric private key

  3. Symmetric key

  4. Asymmetric public key

Show answer
Correct Option: D