Test
Java Mix Test 42p
Preguntas del test (42)
1Defines interfaces and classes to help in internet communications authentication:
- AJava.security
- BJava SASL API
- CJCE
- DJAAS
- ENone of the above
2It is not part of the Java Cryptography Architecture:
- ARSA
- BTriple DES
- CStandard Algorithms
- DClass Loader
- ESandbox
3Java protects the user from hostile applications that hamper security through the concept:
- ASecurity Manager
- BSandbox
- CIntermediate fikes
- DJava Complier
- ENone of the above
4Is an open source program that uses static analysis to identify hundreds of different potential types of errores in Java programs:
- AFxCop
- BFindErrors
- CFxBugs
- DFindBugs
- ENone of the above
5It is not a functionality of FindBugs:
- AEliminate security mistakes found.
- BFind security mistakes.
- CReduce development time.
- DAll of the above
- ENone of the above
6Which of the following stages of the life cycle, has the lowest relative cost to fix a software defect?
- AIn service
- BDesign
- CRequirements Definition
- DCustomer Testing
- EProgramming
7It is a feature of a secured software:
- ATrustworthiness
- BModularity
- CReliability
- DAvailability
- EAll of the above
8Following questions help analyze and improve the security of a software
- A1) What area the various types od defects that cause security vulnerabilities?
- B2) Which tools can be used for measuring the defects?
- C3)How many lines to have the source code?
- D4) 1 and 2
- E5) 2 and 3
9"This method helps to split the complex and large problems into smaller ones resulting in quick and effcicent problem solving rather than dealing with the whole". This concept belongs to:
- AAbstraction
- BDecomposition
- CDesign
- DComplexity
- ENone of the above options
10Threat modeling. Which of the following is not a security technique?
- AThreat Mitigation
- BThreat trees
- CPrivilege boundaries
- DEntry point identification
- ENone of the above options
11Threat modeling. Which of the following is not a correct approach?
- AHybrid Centric
- BSoftware/Design Centric
- CAttack Centric
- DThreat Centric
- EAsset Centric
12What method is used to identify the following threats?
spoofing, tampering, DoS, information disclosure and elevation of privileges- AAttack Tree Structures
- BStride
- CInformation Gathering
- DASF
- ENone of the above options
13Tool helps engineers analyze the security of their systems to find and address design issues early in the software lifecycle:
- AADSL Threat modeling
- BSDL Threat modeling
- CAnalyze Model
- DAnalyze and generate model
- ENone of the above options
14How will you implement secure file handling to prevent malicious file inclusion and DoS attacks?
- AFindbugs
- BSecureFilehandling
- CFxCop
- DSecureFile
- ENone of the above options
15The SecureFilehandling application only accepts the following file extensions:
- A.xlsx
- B.class
- C.obj
- D.exe
- EAccepts all file extensions
16What are the types of streams in Java?
- ACharacter and Byte Stream
- BByte and Compact Stream
- CCharacter and Encode Stream
- DAll of the above
- ENone of the above options
17It is not a proper access privileges:
- AThe owner grants permission to the users to access the content available in the systems
- BAll the files are created with access permissions so that unauthorized access can be denied
- CMulti user systems are generally owned by a particular user for instance system admin etc.
- DThere ara various classes in java that handle characters streams and byte streams separately
- ENone of the above options
18Which of the following instructions ensures proper File Cleanup when a program terminates?
- ARuntime.getRuntime().exit(1);
- Bexit();
- Cterminate();
- Dout.exit();
- Eout.close();
19"It prevents untrusted code from modifying the class internal layout". In Security Manager Checks, this concept corresponds to:
- APrevents extracting any data
- BCheck Constructor
- CPrevents modification
- DPrevents handling
- ENone of the above options
20The project InputValidation not control one of the following statements?
- AUser login
- BUser Password
- CSize password
- DUser size
- ENone of the above options
- AUser login
21On which side it is recommended to apply input validation?
- Aclient-side
- Bserver-side
- Cboth
- DNone of the above
22Which of the following types of input parameters is the most used in SQL vulnerabilities?
- AStructured text
- Bnumber
- Cboolean
- Dfreetext
- Elist of structured text
23Which of the following types of input parameters is the least used in XSS vulnerabilities?
- AList of free text
- Bstructured text
- Cnumber
- Dboolean
- Eenumeration
24What is the exact description of the regular expression "(a-z A-Z)(a-z A-Z 0-9_$)"?
- AA valid java identifier consisting of alphanumeric characters, undercores and dolar signs with the first characer being an alphabet
- BA valid java identifier consisting of alphanumeric charecters and dollar signs with the first cgaracter bieng an alphabet
- CAny two-digit alphanumeric from 0-99 and a-z
- DMatches az, AZ and 9$
25Which of the following is not a recommendation of struts validation and securitiy?
- AThe absence of validation for a single field may allow attackers to exploit the application
- BStruts validation is done to prevent attacks caused through inchecked input
- CEach and every field included in the form should be validates in the correspondig validation form
- DInput validation through Servet filters in Java web applications is effecvtive due to minor modifications needed for input validation and servlet filets are centralized in nature
- ENone of the above
26Indicate that statement does not belong to the class RuntimeException:
- AArrayStoreException
- BNegativeArraySizeException
- CFileNotFoundException
- DNullPointerException
- ESecurityException
27Which of the following is an exceptional behavior erroneous?
- ANever catch NullPointerException
- BDisclosing sensitive information
- CNever throw undeclared checked exceptions
- DLogging sensitive data
- EAll of the above
28Examples of Java Logging Frameworks:
- AApache Commons Logging
- BLog4J
- CJava Logging API
- DSLF4J
- EAll of the above
29Which of the following is not a Secured Practices in Logging?
- ALog Debug messages inside isDebugEnabled()
- BMake use of good java logging frameworks like java.util.logging or log4j
- CLog messages consitently and the messages must be informative
- DEnsure to include the formar of the java loggind in the specified java logger
- EEnsure to remove temporary files before termination to avoid information leakage and resource exhaustion
30HTTP Basic Authentication:
- ARequest a protected resource - Request username password - Sends username password - returns requested resource
- BRequest username password - Sends username password - returns requested resource
- CRequest username password - Request a protected resource - Sends username password - returns requested resource
- DSends username password - Request username password - Request a protected resource - returns requested resource
- ENone of the above options
31Which of the following is not a measure of prevention for attacks weak password?
- AImpose a password againg policy
- BImpose web application accepts only user id credentials that contain all valid characters including special characters like !, @, #, $, etc.
- CIncorrect authentication failure messages should be avoided
- DImplement account lockout policy
- ENone of the above
32Which of the following statements does not describe RBAC?
- AIt functions on the concept of user roles and information accessibility
- BThis is the popular access control model
- CA user has access to resources based on the role assigned; roles are allocated depending on job function
- DThe access control policies are imposed on policy, specific to the user
- EAn organization has different departments, and roles are assigned based on requirements
33Which of the following is not a feature of JAAS?
- AIs implemented usign pure JAVA
- BSupports single sig-on for login authentication in J2EE appplications
- CProvides centralized rol based control that includes hierarchical roles
- DIs implemented usign JAVA and JavaScript
- EAuthentication of users is done through PAM Framework
34JAAS Configuration. The configurations file format consists of the following entries:
- ALoginEntry
- BModuleClass
- CFlag
- DOption="value"
- EAll options are correct
35In the architecture of a Java EE application. Which of the following is not a component of the Web level?
- AWeb Services Client
- BServlet
- CApp Flow Processor
- DView Manager
- ENone of the above
36Concurrency in Java. Which of the following is not a state of a thread?
- ASuspended
- BResumed
- CBlocked
- DDead
- EReset
37In ]ava, the following methods are vulnerable to race condition:
- A1) start()
- B2) stop()
- C3) init()
- D4) 1 and 3
- E5) 1, 2 and 3
38It is a countermeasure to session hijacking:
- ASee the session is not expired after users log out
- BRegularly clear the history and offline content
- CPrefer http than https in case of sensitive and confidential transactions
- DMake sure that cookies and sessions are stored from the browser
- ENone of the above
39Which of the following statements does not include the Java Criptography Arquitecture engine?
- AKey Store
- BKey pair Generator
- CKey Tools
- DCertStore
- EKey Factories
40javax.net and javax.net.ssl packages are the standard JSSE APIs that includes important classes such as:
- A1) SSLSocket
- B2) SocketFactory
- C3) ServerSocketFactory
- D4) All of the above
- E5) None of the above
41It is not a tool Java Cryptography:
- AJCryption
- BOptimus Java
- CPrimeInk JAva
- Djdnssec
- ECryptix
42Which of the following is not a countermeasure CRSF?
- AAppropriately use GET and Post requests
- BImplement OWASP CRFGuard Library
- CWeb applications should use weak authentications methods such as cookies, http authentication, etc
- DCheck the referrer such as HTTP "referer"
- ENone of the above
Información
- Descripción
- Mix Test 42p
- Autor
- Carlos Veliz
- Idioma
- Español
- Visitas
- 89
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test