Test
Questões - Web Application Security
Crea una cuenta gratis para terminar este test
Guarda tu progreso y consulta tu resultado final.
¿Ya tienes cuenta? Inicia sesión
Preguntas del test (15)
1How do we write the code to allow unauthenticated access for users of all rules?
- A< auth-constraint >
< role-name >*< /role-name >
< /auth-constraint > - B< auth-constraint >
< role-name >Guest< /role-name >
< /auth-constraint > - C< security-constraint >
< auth-constraint / >
< / security-constraint > - DNone of the Options
- A< auth-constraint >
2How do we write the code to allow authenticated access for users of all rules?
- A< auth-constraint >
< role-name >*< / role-name>
< /auth-constraint> - B< auth-constraint >
< role-name >Guest< / role-name>
< /auth-constraint> - C< security-constraint >
...
< web-resource-collection >
...
< /web-resource-collection >
< /security-constraint > - DNone of the Options
- A< auth-constraint >
3What is the result of this code?
< security-constraint >
< auth-constraint / >
< / security-constraint>- AAllows authenticated access to all users.
- BAllows unauthenticated access to all users.
- CAllows authenticated access only for the default "Guest" role.
- DThe Container will not allow access to constrained resources for any roles.
4How many values can be declared for the < transport-guarantee > element of the < user-data-constraint > ?
- A1
- B2
- C3
- D4
5Confidentiality is:
- ASecuring data in transit.
- BIdentifying the user by means of name and password.
- CMaking sure that data is not tampered during transit.
- DDeciding on the resources to access based on the role of the user.
6If data in transit should not be tampered, it is:
- AData Integrity
- BAuthentication
- CConfidentiality
- DAuthorization
7Before assigning users to roles according to each JavaEE server, what should be done?
- ASpecify the users in the deployment descriptor.
- BDeclare all roles specified in the application in the Deployment Descriptor.
- CNothing needs to be done.
- DNone of the options.
8There can be more than one < web-resource-name > element per collection.
- AVerdadero
- BFalso
9What is the meaning of the above deployment descriptor?
<web-app>
.........
< security-constraint >
< web-resource-collection >
< web-resource-name > Whizlabs < / web-resource-name >
< url-pattern > /whizlabs/* < / url-pattern >
< / web-resource-collection>
< auth-constraint >
< role-name> Member < / role-name >
< / auth-constraint >
< / security-constraint >- ABy default only the GET method is protected.
- BNone of the methods are protected.
- CThe POST method is protected.
- DAll the methods are protected.
10What is wrong with the above code?
<web-app>
......
< security-constraint >
< web-resource-collection >
< web-resource-name >Whizlabs< / web-resource-name >
< web-resource-name >OCWCD< / web-resource-name >
< url-pattern >/whizlabs/*< / url-pattern >
< / web-resource-collection >
< auth-constraint >
< role-name > Guest < / role-name >
< / auth-constraint >
< / security-constraint >
< / web-app >- ANothing is wrong with this code.
- BThe < url-pattern > must be specified befor the < web-resource-name > element.
- CThere can be only one < web-resource-name > element.
- DThe < role-name > is not a valid element of < auth-constraint >
11Can we multiple security-constraint elements for a web application?
- AVerdadero
- BFalso
12What is the result of the following code?
< web-app >
...........
< security-constraint >
< web-resource-collection >
< web-resource-name >Listener < / web-resource-name >
< url-pattern > chapter01/Listener/* < / url-pattern >
< http-method > GET < / http-method >
< / web-resource-collection >
< auth-constraint >
< role-name > Guest < / role-name >
< role-name > Admin < / role-name >
< / auth-constraint >
< / security-constraint >
< security-constraint >
< web-resource-collection >
< web-resource-name >Listener1< / web-resource-name >
< url-pattern >chapter01/Listener/*< / url-pattern >
< http-method >GET < / http-method >
< / web-resource-collection >
< auth-constraint >
< role-name >*< / role-name >
< / auth-constraint >
< / security-constraint >
< / web-app >- AOnly Guest and Admin have access to the chapter01/Listener/* resources.
- BAll roles have access to the chapter01/Listener/* resources.
- CNone of the roles have access to the chapter01/Listener/* resources.
- DOnly Guest has access to the rosources.
13What are the two least secure authentication mechanisms?
- ABASIC and CLIENT-CERT
- BFORM and CLIENT-CERT
- CDIGEST and CLIENT-CERT
- DBASIC and FORM
14What is the default authentication when no type is specified?
- ABASIC
- BDIGEST
- CCLIENT-CERT
- DFORM
15Consider in the deployment descriptor:
< login-config >
< auth-method > FORM < / auth-method >
< form-login-config >
< form-login-page > /login.html < / form-login-page >
< form-error-page > /error.html < / form-error-page >
< / form-login-config >
< / login-config >
And this in the login.html page:
< form method="POST" action="check" >
< input type="text" name="j_username" >
< input type="password" name="j_password" >
< input type="submit" value="enter" >
< / form >
What is the result of the above code?- AAuthentication will proceed as normal.
- BAuthentication will proceed as normal but authorization not.
- CAuthentication will not proceed as normal.
- DAuthentication / Authorization both will proceed as normal.
Información
- Descripción
- Concursos Públicos (OCEJWCD 6 ONLINE COURSE) Desenvolvimento de Software Test sobre Questões - Web Application Security, creado por Luis Felipe Guariento el 22/02/2018.
- Idioma
- Português
- Visitas
- 0
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test