Quiz
Java Mix Test 42p
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (42)
1Defines interfaces and classes to help in internet communications authentication:
- AJava.security
- BJava SASL API
- CJCE
- DJAAS
- ENone of the above
2It is not part of the Java Cryptography Architecture:
- ARSA
- BTriple DES
- CStandard Algorithms
- DClass Loader
- ESandbox
3Java protects the user from hostile applications that hamper security through the concept:
- ASecurity Manager
- BSandbox
- CIntermediate fikes
- DJava Complier
- ENone of the above
4Is an open source program that uses static analysis to identify hundreds of different potential types of errores in Java programs:
- AFxCop
- BFindErrors
- CFxBugs
- DFindBugs
- ENone of the above
5It is not a functionality of FindBugs:
- AEliminate security mistakes found.
- BFind security mistakes.
- CReduce development time.
- DAll of the above
- ENone of the above
6Which of the following stages of the life cycle, has the lowest relative cost to fix a software defect?
- AIn service
- BDesign
- CRequirements Definition
- DCustomer Testing
- EProgramming
7It is a feature of a secured software:
- ATrustworthiness
- BModularity
- CReliability
- DAvailability
- EAll of the above
8Following questions help analyze and improve the security of a software
- A1) What area the various types od defects that cause security vulnerabilities?
- B2) Which tools can be used for measuring the defects?
- C3)How many lines to have the source code?
- D4) 1 and 2
- E5) 2 and 3
9"This method helps to split the complex and large problems into smaller ones resulting in quick and effcicent problem solving rather than dealing with the whole". This concept belongs to:
- AAbstraction
- BDecomposition
- CDesign
- DComplexity
- ENone of the above options
10Threat modeling. Which of the following is not a security technique?
- AThreat Mitigation
- BThreat trees
- CPrivilege boundaries
- DEntry point identification
- ENone of the above options
11Threat modeling. Which of the following is not a correct approach?
- AHybrid Centric
- BSoftware/Design Centric
- CAttack Centric
- DThreat Centric
- EAsset Centric
12What method is used to identify the following threats?
spoofing, tampering, DoS, information disclosure and elevation of privileges- AAttack Tree Structures
- BStride
- CInformation Gathering
- DASF
- ENone of the above options
13Tool helps engineers analyze the security of their systems to find and address design issues early in the software lifecycle:
- AADSL Threat modeling
- BSDL Threat modeling
- CAnalyze Model
- DAnalyze and generate model
- ENone of the above options
14How will you implement secure file handling to prevent malicious file inclusion and DoS attacks?
- AFindbugs
- BSecureFilehandling
- CFxCop
- DSecureFile
- ENone of the above options
15The SecureFilehandling application only accepts the following file extensions:
- A.xlsx
- B.class
- C.obj
- D.exe
- EAccepts all file extensions
16What are the types of streams in Java?
- ACharacter and Byte Stream
- BByte and Compact Stream
- CCharacter and Encode Stream
- DAll of the above
- ENone of the above options
17It is not a proper access privileges:
- AThe owner grants permission to the users to access the content available in the systems
- BAll the files are created with access permissions so that unauthorized access can be denied
- CMulti user systems are generally owned by a particular user for instance system admin etc.
- DThere ara various classes in java that handle characters streams and byte streams separately
- ENone of the above options
18Which of the following instructions ensures proper File Cleanup when a program terminates?
- ARuntime.getRuntime().exit(1);
- Bexit();
- Cterminate();
- Dout.exit();
- Eout.close();
19"It prevents untrusted code from modifying the class internal layout". In Security Manager Checks, this concept corresponds to:
- APrevents extracting any data
- BCheck Constructor
- CPrevents modification
- DPrevents handling
- ENone of the above options
20The project InputValidation not control one of the following statements?
- AUser login
- BUser Password
- CSize password
- DUser size
- ENone of the above options
- AUser login
21On which side it is recommended to apply input validation?
- Aclient-side
- Bserver-side
- Cboth
- DNone of the above
22Which of the following types of input parameters is the most used in SQL vulnerabilities?
- AStructured text
- Bnumber
- Cboolean
- Dfreetext
- Elist of structured text
23Which of the following types of input parameters is the least used in XSS vulnerabilities?
- AList of free text
- Bstructured text
- Cnumber
- Dboolean
- Eenumeration
24What is the exact description of the regular expression "(a-z A-Z)(a-z A-Z 0-9_$)"?
- AA valid java identifier consisting of alphanumeric characters, undercores and dolar signs with the first characer being an alphabet
- BA valid java identifier consisting of alphanumeric charecters and dollar signs with the first cgaracter bieng an alphabet
- CAny two-digit alphanumeric from 0-99 and a-z
- DMatches az, AZ and 9$
25Which of the following is not a recommendation of struts validation and securitiy?
- AThe absence of validation for a single field may allow attackers to exploit the application
- BStruts validation is done to prevent attacks caused through inchecked input
- CEach and every field included in the form should be validates in the correspondig validation form
- DInput validation through Servet filters in Java web applications is effecvtive due to minor modifications needed for input validation and servlet filets are centralized in nature
- ENone of the above
26Indicate that statement does not belong to the class RuntimeException:
- AArrayStoreException
- BNegativeArraySizeException
- CFileNotFoundException
- DNullPointerException
- ESecurityException
27Which of the following is an exceptional behavior erroneous?
- ANever catch NullPointerException
- BDisclosing sensitive information
- CNever throw undeclared checked exceptions
- DLogging sensitive data
- EAll of the above
28Examples of Java Logging Frameworks:
- AApache Commons Logging
- BLog4J
- CJava Logging API
- DSLF4J
- EAll of the above
29Which of the following is not a Secured Practices in Logging?
- ALog Debug messages inside isDebugEnabled()
- BMake use of good java logging frameworks like java.util.logging or log4j
- CLog messages consitently and the messages must be informative
- DEnsure to include the formar of the java loggind in the specified java logger
- EEnsure to remove temporary files before termination to avoid information leakage and resource exhaustion
30HTTP Basic Authentication:
- ARequest a protected resource - Request username password - Sends username password - returns requested resource
- BRequest username password - Sends username password - returns requested resource
- CRequest username password - Request a protected resource - Sends username password - returns requested resource
- DSends username password - Request username password - Request a protected resource - returns requested resource
- ENone of the above options
31Which of the following is not a measure of prevention for attacks weak password?
- AImpose a password againg policy
- BImpose web application accepts only user id credentials that contain all valid characters including special characters like !, @, #, $, etc.
- CIncorrect authentication failure messages should be avoided
- DImplement account lockout policy
- ENone of the above
32Which of the following statements does not describe RBAC?
- AIt functions on the concept of user roles and information accessibility
- BThis is the popular access control model
- CA user has access to resources based on the role assigned; roles are allocated depending on job function
- DThe access control policies are imposed on policy, specific to the user
- EAn organization has different departments, and roles are assigned based on requirements
33Which of the following is not a feature of JAAS?
- AIs implemented usign pure JAVA
- BSupports single sig-on for login authentication in J2EE appplications
- CProvides centralized rol based control that includes hierarchical roles
- DIs implemented usign JAVA and JavaScript
- EAuthentication of users is done through PAM Framework
34JAAS Configuration. The configurations file format consists of the following entries:
- ALoginEntry
- BModuleClass
- CFlag
- DOption="value"
- EAll options are correct
35In the architecture of a Java EE application. Which of the following is not a component of the Web level?
- AWeb Services Client
- BServlet
- CApp Flow Processor
- DView Manager
- ENone of the above
36Concurrency in Java. Which of the following is not a state of a thread?
- ASuspended
- BResumed
- CBlocked
- DDead
- EReset
37In ]ava, the following methods are vulnerable to race condition:
- A1) start()
- B2) stop()
- C3) init()
- D4) 1 and 3
- E5) 1, 2 and 3
38It is a countermeasure to session hijacking:
- ASee the session is not expired after users log out
- BRegularly clear the history and offline content
- CPrefer http than https in case of sensitive and confidential transactions
- DMake sure that cookies and sessions are stored from the browser
- ENone of the above
39Which of the following statements does not include the Java Criptography Arquitecture engine?
- AKey Store
- BKey pair Generator
- CKey Tools
- DCertStore
- EKey Factories
40javax.net and javax.net.ssl packages are the standard JSSE APIs that includes important classes such as:
- A1) SSLSocket
- B2) SocketFactory
- C3) ServerSocketFactory
- D4) All of the above
- E5) None of the above
41It is not a tool Java Cryptography:
- AJCryption
- BOptimus Java
- CPrimeInk JAva
- Djdnssec
- ECryptix
42Which of the following is not a countermeasure CRSF?
- AAppropriately use GET and Post requests
- BImplement OWASP CRFGuard Library
- CWeb applications should use weak authentications methods such as cookies, http authentication, etc
- DCheck the referrer such as HTTP "referer"
- ENone of the above
Information
- Description
- Mix Test 42p
- Author
- Carlos Veliz
- Language
- Español
- Views
- 89
- Tags
- Rating
- No ratings yet Rate this quiz