Quix11 - D8 - 50Q

Question 1

Linda is reviewing posts to a user forum on her company’s website
and, when she browses a certain post, a message pops up in a
dialog box on her screen reading “Alert.” She reviews the source
code for the post and finds the following code snippet:
<script>alert(‘Alert’);</script>

Linda communicates with the vendor and determines that no patch is
available to correct this vulnerability. Which one of the following
devices would best help her defend the application against further
attack?

Accepted Answer

B. WAF

Answer

A. VPN

Answer

C. DLP

Answer

D. IDS

Question 2

Linda is reviewing posts to a user forum on her company’s website
and, when she browses a certain post, a message pops up in a
dialog box on her screen reading “Alert.” She reviews the source
code for the post and finds the following code snippet:
<script>alert(‘Alert’);</script>

Linda communicates with the vendor and determines that no patch is
available to correct this vulnerability. Which one of the following
devices would best help her defend the application against further
attack?

Accepted Answer

A. Reconnaissance

Answer

B. Theft of sensitive information

Answer

C. Credential stealing

Answer

D. Social engineering

Question 3

Linda is reviewing posts to a user forum on her company’s website
and, when she browses a certain post, a message pops up in a
dialog box on her screen reading “Alert.” She reviews the source
code for the post and finds the following code snippet:
<script>alert(‘Alert’);</script>

Linda communicates with the vendor and determines that no patch is
available to correct this vulnerability. Which one of the following
devices would best help her defend the application against further
attack?

Accepted Answer

C. Input validation

Answer

A. Bounds checking

Answer

B. Peer review

Answer

D. OS patching

Question 4

What property of relational databases ensures that once a database
transaction is committed to the database, it is preserved?

Accepted Answer

C. Durability

Answer

A. Atomicity

Answer

B. Consistency

Answer

D. Isolation

Question 5

Lauren wants to use software review process for the application she is
working on. Which of the following processes would work best if she
is a remote worker who works different hours from the rest of her
team?

Accepted Answer

A. Pass around

Answer

B. Pair programming

Answer

C. Team review

Answer

D. Fagan inspection

Question 6

Which one of the following is not a technique used by virus authors to
hide the existence of their virus from antimalware software?

Accepted Answer

B. Multipartitism

Answer

A. Stealth

Answer

C. Polymorphism

Answer

D. Encryption

Question 7

Which one of the following types of software testing usually occurs
last and is executed against test scenarios?

Accepted Answer

C. User acceptance testing

Answer

A. Unit testing

Answer

B. Integration testing

Answer

D. System testing

Question 8

What type of requirement specifies what software must do by
describing the inputs, behavior, and outputs of software?

Accepted Answer

D. Functional requirements

Answer

A. Derived requirements

Answer

B. Structural requirements

Answer

C. Behavioral requirements

Question 9

Which of the following organizations is widely considered as the
definitive source for information on web-based attack vectors?

Accepted Answer

C. OWASP

Answer

A. (ISC)2

Answer

B. ISACA

Answer

D. Mozilla Foundation

Question 10

If Chris is writing code for an application, what phase of the Agile
process is he in?

Accepted Answer

B. Sprints

Answer

A. Planning

Answer

C. Deployment

Answer

D. Development

Question 11

Lisa is attempting to prevent her network from being targeted by IP
spoofing attacks as well as preventing her network from being the
source of those attacks. Which one of the following rules is NOT a
best practice that Lisa can configure at her network border?

Accepted Answer

D. Block packets with public IP addresses from entering the network.

Answer

A. Block packets with internal source addresses from entering the
network.

Answer

B. Block packets with external source addresses from leaving the
network.

Answer

C. Block packets with private IP addresses from exiting the network.

Question 12

What type of attack is demonstrated in the following C programming
language example?
int myarray[10];
myarray[10] = 8;

Accepted Answer

B. Overflow

Answer

A. Mismatched data types

Answer

C. SQL injection

Answer

D. Covert channel

Question 13

Which one of the following database issues occurs when one
transaction writes a value to the database that overwrites a value that
was needed by transactions with earlier precedence?

Accepted Answer

C. Lost update

Answer

A. Dirty read

Answer

B. Incorrect summary

Answer

D. SQL injection

Question 14

Which one of the following is the most effective control against
session hijacking attacks?

Accepted Answer

A. TLS

Answer

B. Complex session cookies

Answer

C. SSL

Answer

D. Expiring cookies frequently

Question 15

Faith is looking at the /etc/passwd file on a system configured to use
shadowed passwords. When she examines a line in the file for a user
with interactive login permissions, what should she expect to see in
the password field?

Accepted Answer

C. x

Answer

A. Plaintext password

Answer

B. Hashed password

Answer

D. *

Question 16

What type of vulnerability does a TOCTOU attack target?

Accepted Answer

B. Race condition

Answer

A. Lack of input validation

Answer

C. Injection flaw

Answer

D. Lack of encryption

Question 17

While evaluating a potential security incident, Harry comes across a
log entry from a web server request showing that a user entered the
following input into a form field:
CARROT’&1=1;--
What type of attack was attempted?

Accepted Answer

C. SQL injection

Answer

A. Buffer overflow

Answer

B. Cross-site scripting

Answer

D. Cross-site request forgery

Question 18

Which one of the following is not an effective control against SQL
injection attacks?

Accepted Answer

B. Client-side input validation

Answer

A. Escaping

Answer

C. Parameterization

Answer

D. Limiting database permissions

Question 19

What type of project management tool is shown in the figure?

Accepted Answer

B. PERT chart

Answer

A. WBS chart

Answer

C. Gantt chart

Answer

D. Wireframe diagram

Question 20

In what software testing technique does the evaluator retest a large
number of scenarios each time that the software changes to verify that
the results are consistent with a standard baseline?

Accepted Answer

D. Regression testing

Answer

A. Orthogonal array testing

Answer

B. Pattern testing

Answer

C. Matrix testing

Question 21

Which one of the following conditions may make an application most
vulnerable to a cross-site scripting (XSS) attack?

Accepted Answer

B. Reflected input

Answer

A. Input validation

Answer

C. Unpatched server

Answer

D. Promiscuous firewall rules

Question 22

Roger is conducting a software test for a tax preparation application
developed by his company. End users will access the application over
the Web, but Roger is conducting his test on the back end, evaluating
the source code on the web server. What type of test is Roger
conducting?

Accepted Answer

A. White box

Answer

B. Gray box

Answer

C. Blue box

Answer

D. Black box

Question 23

Which of the following statements is true about heuristic-based
antimalware software?

Accepted Answer

C. It has a higher likelihood of detecting zero-day exploits than
signature detection.

Answer

A. It has a lower false positive rate than signature detection.

Answer

B. It requires frequent definition updates to detect new malware.

Answer

D. It monitors systems for files with content known to be viruses.

Question 24

Martin is inspecting a system where the user reported unusual
activity, including disk activity when the system is idle and abnormal
CPU and network usage. He suspects that the machine is infected by a
virus but scans come up clean. What malware technique might be in
use here that would explain the clean scan results?

Accepted Answer

D. Stealth virus

Answer

A. File infector virus

Answer

B. MBR virus

Answer

C. Service injection virus

Question 25

Tomas discovers a line in his application log that appears to
correspond with an attempt to conduct a directory traversal attack.
He believes the attack was conducted using URL encoding. The line
reads:
%252E%252E%252F%252E%252E%252Fetc/passwd
What character is represented by the %252E value?

Accepted Answer

A. .

Answer

B. ,

Answer

C. ;

Answer

D. /

Question 26

An attacker posted a message to a public discussion forum that
contains an embedded malicious script that is not displayed to the
user but executes on the user’s system when read. What type of attack
is this?

Accepted Answer

C. Persistent XSS

Answer

A. Persistent XSRF

Answer

B. Nonpersistent XSRF

Answer

D. Nonpersistent XSS

Question 27

Which one of the following is not a principle of the Agile software
development process?

Accepted Answer

C. Clear documentation is the primary measure of progress.

Answer

A. Welcome changing requirements, even late in the development
process.

Answer

B. Maximizing the amount of work not done is essential.

Answer

D. Build projects around motivated individuals.

Question 28

What are the two components of an expert system?

Accepted Answer

D. Knowledge bank and inference engine

Answer

A. Decision support system and neural network

Answer

B. Inference engine and neural network

Answer

C. Neural network and knowledge bank

Question 29

Neal is working with a DynamoDB database. The database is not
structured like a relational database but allows Neal to store data
using a key-value store. What type of database is DynamoDB?

Accepted Answer

D. NoSQL database

Answer

A. Relational database

Answer

B. Graph database

Answer

C. Hierarchical database

Question 30

In the transaction shown here, what would happen if the database
failed in between the first and second update statements?

Accepted Answer

C. The database would roll back the transaction, ignoring the results
of both commands.

Answer

A. The database would credit the first account with $250 in funds but
then not reduce the balance of the second account.

Answer

B. The database would ignore the first command and only reduce the
balance of the second account by $250.

Answer

D. The database would successfully execute both commands.

Question 31

In the diagram shown here, which is an example of an attribute?

Accepted Answer

B. Owner

Answer

A. Account

Answer

C. AddFunds

Answer

D. None of the above

Question 32

Which one of the following statements is true about software testing?

Accepted Answer

B. Static testing performs code analysis.

Answer

A. Static testing works on runtime environments.

Answer

C. Dynamic testing uses automated tools, but static testing does not.

Answer

D. Static testing is a more important testing technique than dynamic
testing.

Question 33

David is working on developing a project schedule for a software
development effort, and he comes across the chart shown here. What
type of chart is this?

Accepted Answer

D. Gantt chart

Answer

A. Work breakdown structure

Answer

B. Functional requirements

Answer

C. PERT chart

Question 34

Barry is a software tester who is working with a new gaming
application developed by his company. He is playing the game on a
smartphone to conduct his testing in an environment that best
simulates a normal end user, but he is referencing the source code as
he conducts his test. What type of test is Barry conducting?

Accepted Answer

D. Gray box

Answer

A. White box

Answer

B. Black box

Answer

C. Blue box

Question 35

Miguel recently completed a penetration test of the applications that
his organization uses to handle sensitive information. During his
testing, he discovered a condition where an attacker can exploit a
timing condition to manipulate software into allowing him to perform
an unauthorized action. Which one of the following attack types fits
this scenario?

Accepted Answer

D. TOC/TOU

Answer

A. SQL injection

Answer

B. Cross-site scripting

Answer

C. Pass the hash

Question 36

What part of the security review process are the input parameters
shown in the diagram used for?

Accepted Answer

D. Attack surface identification

Answer

A. SQL injection review

Answer

B. Sprint review

Answer

C. Fagan inspection

Question 37

What application security process can be described in these three
major steps?
1. Decomposing the application
2. Determining and ranking threats
3. Determining countermeasures and mitigation

Accepted Answer

B. Threat modeling

Answer

A. Fagan inspection

Answer

C. Penetration testing

Answer

D. Code review

Question 38

Which one of the following approaches to failure management is the
most conservative from a security perspective?

Accepted Answer

D. Fail closed

Answer

A. Fail open

Answer

B. Fail mitigation

Answer

C. Fail clear

Question 39

What software development model is shown in the figure?

Accepted Answer

D. Spiral

Answer

A. Waterfall

Answer

B. Agile

Answer

C. Lean

Question 40

Which of the following database keys is used by an RDBMS to
uniquely identify each row in a database table?

Accepted Answer

B. Primary key

Answer

A. Foreign key

Answer

C. Candidate key

Answer

D. Referential key

Question 41

Which one of the following change management processes is initiated
by users rather than developers?

Accepted Answer

A. Request control

Answer

B. Change control

Answer

C. Release control

Answer

D. Design review

Question 42

Which one of the following techniques is an effective countermeasure
against some inference attacks?

Accepted Answer

C. Polyinstantiation

Answer

A. Input validation

Answer

B. Parameterization

Answer

D. Server-side validation

Question 43

Ursula is a government web developer who recently created a public
application that offers property records. She would like to make it
available for other developers to integrate into their applications.
What can Ursula create to make it easiest for developers to call her
code directly and integrate the output into their applications?

Accepted Answer

C. API

Answer

A. Object model

Answer

B. Data dictionary

Answer

D. Primary key

Question 44

During what phase of the IDEAL model do organizations develop a
specific plan of action for implementing change?

Accepted Answer

C. Establishing

Answer

A. Initiating

Answer

B. Diagnosing

Answer

D. Acting

Question 45

TJ is inspecting a system where the user reported a strange error
message and the inability to access files. He sees the window shown in
this figure. What type of malware should TJ suspect?

Accepted Answer

D. Ransomware

Answer

A. Service injection

Answer

B. Encrypted virus

Answer

C. SQL injection

Question 46

Charles is developing a mission-critical application that has a direct
impact on human safety. Time and cost are less important than
correctly functioning software. Which of the following software
development methodologies should he choose given these
requirements?

Accepted Answer

D. Waterfall

Answer

A. Agile

Answer

B. DevOps

Answer

C. Spiral

Question 47

Which one of the following types of artificial intelligence attempts to
use complex computations to replicate the partial function of the
human mind?

Accepted Answer

D. Neural networks

Answer

A. Decision support systems

Answer

B. Expert systems

Answer

C. Knowledge bank

Question 48

At which level of the Software Capability Maturity Model (SW-CMM)
does an organization introduce basic life-cycle management
processes?

Accepted Answer

B. Repeatable

Answer

A. Initial

Answer

C. Defined

Answer

D. Managed

Question 49

Lucas runs the accounting systems for his company. The morning
after a key employee was fired, systems began mysteriously losing
information. Lucas suspects that the fired employee tampered with
the systems prior to his departure. What type of attack should Lucas
suspect?