Quiz
Secure Software Implementation/Coding
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (45)
1An attack that uses the user interface to manipulate data structures behind the application is called:
- AConfiguration Attack
- BBuffer Overflow
- CCommand Injection
- DSQL Injection
2Which of the following is not a common cryptographic failure?
- AAES seed manipulation
- BFailure to encrypt sensitive data
- CHard-coding of cryptographic keys
- DCustom cryptographic algorithms
3A structure form of attack used when errors are suppressed is referred to as:
- ABlind
- BBlack Box Testing
- CPolymorphic
- DMitigation Avoidance Methodology
4Input strings similar to %2e%2e%2f are indicative of what type of attack?
- ADirectory Traversal
- BCommand Injection
- CSQL Injection
- DBuffer Overflow
5To attack a web application and attempt to get a copy of the configuration file on a server could use a(n):
- AXSS Attack
- BCSRF Attack
- CArithmetic Overflow Attack
- DConfused Deputy Problem
6A known weakness of hashing is duplicate values for identical inputs. To solve this, one uses what technique?
- AThis cannot be solved; it is the nature of hashing
- BMultiple hash rounds, either double or triple hashing
- CNew hash fuinctions like SHA-256
- DSalting of the hash
7Screening of code for use of disallowed functions is best performed by:
- ACode Walkthroughs
- BStatic Testing
- CCompany Policy
- DMisuse Cases
8An attack against old data in memory is referred to as a(n) ___________ attack.
- AASLR
- BData Remanence
- CSQL Injection
- DBuffer Overflow
9Embedded devices are frequently attacked in order to achieve:
- ACryptographic Tokens
- BEnterprise Access
- CStreet Credentials
- DInformation Disclosure
10A common language to describe and exchange information about the causes of software vulnerabilities is:
- ACVS
- BCVE
- CCSSLP
- DCNSS
11The "HashRows()" function of the following can lead to what type of failure in use?
string query = String.Format( "SELECT COUNT(*) FROM Users WHERE " +
"username='{0}' AND password='{1}'", txtUser.Text, txtPassword.Text );
SqlCommand cmd = new SqlCommand(query, conn);
conn.Open();
SqlDataReader reader = cmd.ExecutableReader();
try {
if ( reader.HasRows() ) {
IssueAuthenticationTicket();
} else {
TryAgain();
}
}- ADefense-In-Depth Failure
- BSecurity Through Obscurity
- COutput Validation
- DReliance on untrusted inputs for a security decision
12Sending the following input: %./a.out \`./script\` to this code snippet is an example of what type of attack?
int main (int argc, char *argv[], char **envp)
{
char buf[100];
buff[0] = '\0';
snprintf(buff, sizeof(buff), "grep %s text", argv[1]);
system(buff);
exit(0);
}- ACommand Injection
- BSQL Injection
- CBuffer Overflow
- DInput Validation
13Manipulation of stored values to create a more permanent effect is an example of a:
- ADOM-based XSS Attack
- BPersistent XSS Attack
- CPersistent CSRF Attack
- DReflected XSS Attack
14When validating input before use, one needs to be aware of the following except:
- ASession Management
- BEncoding Methods
- CCanonical Form
- DLanguage-Based Character Sets
15Historically, the most damaging and still significant threat is the __________ attack.
- AUser Impersonation
- BCross-Site Scripting
- CSQL Injection
- DBuffer Overflow
16A widespread source of entry points into software comes from:
- AManaged Code
- BAPIs
- CCryptographic Agility
- DHandling Configuration Parameters
17Placing the security attributes into metadata is an example of:
- APervasive Syntax Security
- BCryptographic Agility
- CImperitive Syntax Security
- DDeclaritive Syntax Security
18The benefits of managed code include all of the following except:
- AFaster Execution
- BType-Safe Code
- CImproved Memory Management
- DLifetime Object Control
19To deal with international distribution issues associated with cryptography, a clean method is via:
- AVersioning
- BUser of international cryptography for all versions
- CUse of approved cryptographic libraries only
- DUse of cryptographic agility
20Address Space Layout Randomization (ASLR) is a specific memory management technique used to defend against:
- ALocality Attacks
- BStack Overflows
- CCryptographically Agile Attacks
- DBuffer Overflows
21What mechanism can be employed to handle data issues that lead to out-of-range calculations?
- ARegular Expressions
- BVetted Functions
- CLibrary Calls
- DException Handling
22To embody business rule-based security in the code, the most efficient mechanism is:
- ADeclarative Syntax Security
- BInternal Syntax Security
- CImperative Syntax Security
- DPervasive Syntax Security
23The tools used to mitigate API-based threats include all of the following except:
- AThreat Model
- BAttack Surface Analysis
- CCryptographic Agility
- DAuthentication
24The following are primary mitigation methods except:
- ALocking down the environment
- BInput validation
- CUse of deprecated libraries for legacy code
- DOutput validation
25The following are primary mitigation methods except:
- AAssume external components are untrusted.
- BCreate your own security controls unique to your environment.
- CApply a broad mix of methods to find weaknesses.
- DUse approved libraries.
26The level of security applied to configuration files depends upon:
- AThe location of the actual configuration file
- BThe number of data elements in the configuration file (scaling)
- CWhether configuration files are locked down in a read-only directory
- DThe risk introduced by bad configurations
27To manage replacement of deprecated cryptographic functions, one should employ:
- ACryptographic Agility
- BOnly custom cryptography so you can control when it gets deprecated
- COnly approved cryptographic library functions
- DOnly current cryptographic functions
28All of the following are concerns of memory management except:
- AGarbage Collection
- BBuffer Overflows
- CMemory Allocation
- DException Management
29Type-safe practices enable:
- AMemory management safety
- BSmaller programs
- CAvoidance of exception in managed code
- DEasier-to-maintain code
30Elements of defensive coding include all of the following except:
- ACustom cryptographic functions to avoid algorithm disclosure
- BException handling to avoid program termination
- CInterface coding efforts to avoid API-facing attacks
- DCryptographic agility to make cryptographic functions stronger
31Code signing cannot provide which of the following to the end user?
- AProof of integrity of the code
- BAuthentication of the source
- CAssurance that the code is free of vulnerabilities
- DAssurance that the code is authentic
32Verifying that code can perform in a particular manner under production conditions is a task managed by:
- AStatic Code Analysis
- BDynamic Code Analysis
- CProduction Testing
- DCode Walkthroughs
33To ensure that the end user is receiving valid code, which of the following methodologies is employed?
- ACode Signing
- BVersion Control
- CConfiguration Management
- DRevision Control
34The /GS compiler switch is used to:
- AManage Memory Leaks
- BPrevent Buffer Overflow
- CPrevent XSS attacks
- DControl for stack overflows through the use of a cookie
35Code walkthroughs are effective for checking for all of the following except?
- ADeprecated library calls
- BStack pointer overflows
- CNonapproved Cryptographic Functions
- DLogic Bombs
36At what level should code analysis be performed?
- AUnit level
- BSubsystem level
- CSystem level
- DAt all levels
37Static analysis can be used to check for:
- AApproved function/library calls, examining rules and semantics associated with logic, and thread performance management.
- BSyntax, approved function/library calls, and race conditions
- CSyntax approved function/library calls, and memory management.
- DSyntax, approved function/library calls, and examining rules and semantics associated with logic and calls.
38Automated testing has the following advantages over manual code review except:
- ADetection of unsafe or deprecated function calls.
- BIdentification of obfuscated routines
- CSpeed of analysis
- DIntegration into the IDE
39Compiler options should be:
- ANot relied upon, as they can provide errant information
- BLimited to key checks for efficiency
- CLeft to developer discretion to enable efficient production
- DPredefined as part of the SDL
40What are the major elements of code signing?
- AEncrypted source code
- BFile integrity checks
- CPublic key cryptography and hash functions
- DControlled distribution channels such as SSL
41Managing the versions and changes associated with all these individual pieces of a software project is referred to as:
- AVersion Control
- BSecure Development Process
- CConfiguration Management
- DSource Code Repository
42Version control is best performed by:
- AA manual, structured process with checks
- BAn automated, transparent process
- CEach developer taking responsibility
- DThe project manager or lead developer to ensure consistency
43The use of only approved libraries of functions enables:
- AFaster development
- BUse of lower skilled developers
- CLower error rates from unknown issues
- DCheaper development
44Libraries of safe function calls are used to address the following issues except:
- AStack overflow
- BXSS attack
- CBuffer overflows
- DInjection attacks
45Code reviews are performed using:
- AStatic analysis tools
- BDynamic analysis tools
- CCompiler with special flag options
- DHuman examination of code.
Information
- Description
- Quiz on Secure Software Implementation/Coding, created by Ashton Norton on 13/03/2017.
- Author
- Ashton Norton
- Language
- English
- Views
- 22
- Tags
- Rating
- No ratings yet Rate this quiz