Test
nsf_03
Crea una cuenta gratis para terminar este test
Guarda tu progreso y consulta tu resultado final.
¿Ya tienes cuenta? Inicia sesión
Preguntas del test (30)
1HTML is a markup language that uses specific ____ embedded in brackets.
- Aa. blocks
- Bb. taps
- Cc. tags
- Dd. marks
2The default root directory of the Microsoft Internet Information Services (IIS) Web server is ____.
- Aa. /var/html
- Bb. /var/www
- Cc. C:\Inetpub\wwwroot
- Dd. /etc/var/www
3The SQL injection statement ____ finds specific users.
- Aa. whatever’ OR full_name IS ‘%Mia%’
- Bb. whatever’ OR full_name LIKE ‘%Mia%’
- Cc. whatever’ OR full_name = ‘%Mia%’
- Dd. whatever’ OR full_name equals ‘%Mia%’
4ARP poisoning is successful because there are few authentication procedures to verify ARP requests and replies.
- AVerdadero
- BFalso
5Web application attacks are considered ____ attacks.
- Aa. client-side
- Bb. relationship
- Cc. hybrid
- Dd. server-side
6When TCP/IP was developed, the host table concept was expanded to a hierarchical name system for matching computer names and numbers known as the ____.
- Aa. DNS
- Bb. URNS
- Cc. HTTP
- Dd. NSDB
7____ is a language used to view and manipulate data that is stored in a relational database.
- Aa. SQL
- Bb. DQL
- Cc. ISL
- Dd. C
8Although traditional network security devices can block traditional network attacks, they cannot always block Web application attacks.
- AVerdadero
- BFalso
9A client-side attack that results in a user’s computer becoming compromised just by viewing a Web page and not even clicking any content is known as a ____.
- Aa. denial of service
- Bb. drive-by-download
- Cc. stack underflow
- Dd. buffer overflow
10____ is for the transport and storage of data, with the focus on what the data is.
- Aa. XML
- Bb. SGML
- Cc. HTML
- Dd. SML
11Which of these is NOT a reason why securing server-side web applications is difficult.
- Aa. Although traditional network security devices can block traditional network attacks, they cannot always block web application attacks.
- Bb. The processors on clients are smaller than on web servers an thus they are easier to defend.
- Cc. Many web application attacks exploit previously unknown vulnerabilities.
- Dd. By design dynamic server-side web applications accept user input that can contain malicious code.
12Which of these is not an HTTP header attack?
- Aa. Accept-Language
- Bb. Referer
- Cc. Response splitting
- Dd. Content-length
13What is another name for a locally share object (LSO)?
- Aa. Flash cookie
- Bb. session cookie
- Cc. RAM cookie
- Dd. secure cookie
14Browser plug-ins ____.
- Aa. only function on web servers.
- Bb. can be embedded inside a webpage but add-ons cannot.
- Cc. have additional functionality to the entire browser.
- Dd. have been replaced by browser extensions.
15An attacker who manipulates the maximum size of an integer type would be performing what kind of attack?
- Aa. buffer overflow
- Bb. real number
- Cc. heap size
- Dd. integer overflow
16What kind of attack is performed by an attacker who takes advantage of the inadvertent and unauthorized access built through three succeeding systems that all trust one another?
- Aa. privilege rights
- Bb. heap spray
- Cc. transitive
- Dd. vertical escalation
17Which statement is correct regarding why traditional network security devices cannot be used to block web application attacks?
- Aa. Traditional network security devices ignore the content of HTTP traffic, which is the vehicle of web application attacks.
- Bb. Web application attacks use web browsers that cannot be controlled on a local computer.
- Cc. Network security devices cannot prevent attacks from web resources.
- Dd. The complex nature of TCP/IP allows for too man ping sweeps to be blocked.
18What do attackers use buffer overflows to do?
- Aa. erase buffer overflow signature files
- Bb. corrupt the kernel so the computer cannot reboot
- Cc. point to another area in data memory that contains the attacker's malware code
- Dd. place a virus into the kernel
19What is unique about a cross-site scripting (XSS) attack compared to other injection attacks?
- Aa. SQL code is used in an XSS attack.
- Bb. XSS requires the use of a browser.
- Cc. XSS does not attack the web application server to steal or corrupt its information.
- Dd. XSS attacks are rarely used anymore compared to other injection attacks.
20What is a cookie that was not created by the website being viewed called?
- Aa. first-party cookie
- Bb. second-party cookie
- Cc. third-party cookie
- Dd. fourth-party cookie
21What is the basis of an SQL injection attack?
- Aa. to have the SQL server attack client web browsers
- Bb. to inject SQL statements through unfiltered user input
- Cc. to expose SQL code so that it can be examined
- Dd. to link SQL servers into a botnet
22Which action cannot be performed through a successful SQL injection attack?
- Aa. reformat the web application server's hard drive
- Bb. display a list of customer telephone numbers
- Cc. discover the names of different fields in a table
- Dd. erase a database table
23Which markup language is designed to carry data?
- Aa. ICMP
- Bb. HTTP
- Cc. HTML
- Dd. XML
24What type of attack involves an attacker accessing files in directories other than the root directory?
- Aa. SQL injection
- Bb. command injection
- Cc. XML injection
- Dd. directory traversal
25Which type of attack modifies the fields that contain the different characteristics of the data that is being transmitted?
- Aa. XML manipulation
- Bb. HTML packet
- Cc. SQL injection
- Dd. HTTP header
26What is a session token?
- Aa. XML code used in an XML injection attack
- Bb. a random string assigned by a web server
- Cc. another name for a third-party cookie
- Dd. a unique identifier that includes the user's email address
27Which of these is NOT a DoS attack?
- Aa. SYN flood
- Bb. ping flood
- Cc. smurf
- Dd. push flood
28What type of attack intercepts legitimate communication and forges a fictitious response to the sender?
- Aa. SIDS
- Bb. interceptor
- Cc. man-in-the-middle
- Dd. SQL intrusion
29A replay attack ____.
- Aa. is considered to be a type of DoS attack
- Bb. makes a copy of the transmission for use at a later time
- Cc. can be prevented by patching the web browser
- Dd. replays the attack over and over to flood the server
30DNS poisoning ____.
- Aa. floods a DNS server with requestes until it can no longer respond
- Bb. is rarely found today due to the use of host tables
- Cc. substitutes DNS addresses so that the computer is automatically redirected to another device
- Dd. is the same as ARP poisoning
Información
- Descripción
- application and networking-based attacks
- Autor
- 865 538
- Idioma
- English
- Visitas
- 172
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test