What is OWASP WebGoat?
Web Proxy
XSS Scanner
An insecure J2EE web application
None of the above
Which of the following best describes the difference between white-box testing and black-box testing?
White-box testing is performed by an independent programmer team
Black-box testing uses the bottom-up approach
Black-box testing involves the business units
White-box testing examines the program internal logical structures
Scanning underlying source code with a database of regular expressions to quickly identify suspicious code, application inputs, outputs etc primarily relates to ..
Grey-box testing
Black-box testing
White-box testing
None of these
What is the difference between network vulnerability assessment and a penetration test?
A penetration test enumerates resources, and a vulnerability assessment enumerates vulnerabilities
They are one and the same
A penetration test identifies running services, and vulnerability assessments provide a more in-depth understanding of vulnerabilities
A penetration test exploits vulnerabilities, and a vulnerability assessment finds vulnerabilities
The three steps to successful patch management are …
Acquiring, Testing, Installing
Testing, Remediation, Peer Review
Determine needs, Acquire resources, Install the patch
Both A & B
The correct way to disable autocomplete in the browser for certain forms is to ….
Set autocomplete to “0”
Set autocomplete to “Off”
Set autocomplete to some other value
Set autocomplete to “no-store”
Credit card numbers should be logged into the log file during exception
No. Because leads to insecure storage of private information of the customer
Yes. Because it is a good logging practice to log all relevant information during an exception
Yes. Because it will help in troubleshooting specific customer problems
No. Because its an additional over head
Web Service interfaces are prone to which of the following standard web application attacks ?
SQL Injection
Denial of Service
XML Injection
All of the above
A race condition in a web server can cause …
Resources to become unavailable to legitimate users
Cross Site Tracing
Server Instability
Both A and B
It is a leading practice to suppress detailed errors in the following places:
Web Server configuration files
Application configuration files
Application error handlers