Test
Quiz 10
Preguntas del test (25)
1One reason why an organization would consider a distributed application is:
- ASome components are easier to operate
- BDistributed applications have a simpler architecture than other types of applications
- CSome application components are owned and operated by other organizations
- DDistributed applications are easier to secure
2All of the following are advantages of using self-signed SSL certificates EXCEPT:
- AServer authentication
- BLower cost
- CEasier to create
- DMore difficult to crack
3The best defense against a NOP sled attack is:
- AFirewall
- BAnti-virus
- CThe strcpy() function
- DInput boundary checking
4The instructions contained with an object are known as its:
A)- AClass
- BFirmware
- CCode
- DMethod
5The purpose for putting a “canary” value in the stack is:
- ATo detect a dictionary attack
- BTo detect a stack smashing attack
- CTo detect parameter tampering
- DTo detect script injection
6“Safe languages” and “safe libraries” are so-called because:
- AThey automatically detect some forms of input attacks
- BThey automatically detect parameter tampering
- CThey automatically detect script injection
- DThey automatically detect malware attacks
7The following are characteristics of a computer virus EXCEPT:
- APolymorphic
- BDownloadable
- CSelf propagating
- DEmbedded in spam
8Rootkits can be difficult to detect because:
- AThey are encrypted
- BThey are polymorphic
- CThey reside in ROM instead of the hard drive
- DThey use techniques to hide themselves
9An attack on a DNS server to implant forged “A” records is characteristic of a:
- APharming attack
- BPhishing attack
- CWhaling attack
- DSpim attack
10The purpose of digitally signing a Browser Helper Object (BHO) is:
- ATo prove its origin
- BTo prove hhat it is not malicious
- CTo prove that it can be trusted
- DTo prove that it was downloaded properly
11An organization wants to prevent SQL and script injection attacks on its Internet web application. The organization should implement a/an:
- AIntrusion detection system
- BFirewall
- CApplication firewall
- DSSL certificate
12A defense in depth strategy for anti-malware is recommended because:
- AThere are many malware attack vectors
- BAnti-virus software is often troublesome on end user workstations
- CMalware can hide in SSL transmissions
- DUsers can defeat anti-malware on their workstations
13The primary advantage of the use of workstation-based anti-virus is:
- AVirus signature updates can be performed less often
- BVirus signature updates can be performed more often
- CThe user can control its configuration
- DThis approach can defend against most, if not all, attack vectors
14The primary purpose of a firewall is:
- ATo protect a server from malicious traffic
- BTo block malicious code
- CTo control traffic between networks
- DTo create a DMZ network
15The following are valid reasons to reduce the level of privilege for workstation users EXCEPT:
- ADecreased support costs because users are unable to change system configurations
- BEliminates the need for whole disk encryption
- CDecreased impact from malware
- DIncreased security because users are unable to tamper with security controls
16A system administrator needs to harden a server. The most effective approach is:
- AInstall security patches and install a firewall
- BRemove unneeded services, remove unneeded accounts, and configure a firewall
- CRemove unneeded services, disable unused ports, and remove unneeded accounts
- DInstall security patches and remove unneeded services
17The most effective countermeasures against input attacks are:
- AInput field filtering, application firewall, application vulnerability scanning, and developer training
- BInput field filtering, application firewall, and intrusion prevention system
- CInput field filtering, application firewall, intrusion detection system, and ethical hacking
- DApplication firewall, intrusion detection system, and developer training
18The term “object reuse” refers to:
- AA method used by malware to exploit weaknesses in running processes
- BThe use of residual computing resources for other purposes
- CThe ability to reuse application code
- DProcesses that can discover and use residual data associated with other processes
19A security assessment discovered back doors in an application, and the security manager needs to develop a plan for detecting and removing back doors in the future. The most effective countermeasures that should be chosen are:
- AApplication firewalls
- BSource code control
- COutside code reviews
- DPeer code reviews
20The best time to introduce security into an application is:
- AImplementation
- BDesign
- CDevelopment
- DTesting
21A user, Bill, has posted a link on a web site that causes unsuspecting users to transfer money to Bill if they click the link. The link will only work for users who happen to be authenticated to the bank that is the target of the link. This is known as:
- ACross site request forgery
- BCross-site scripting
- CBroken authentication
- DReplay attack
22What is the most effective countermeasure against script injection attacks?
- AStateful inspection firewall
- BDisallow server side scripting in the end user’s browser configuration
- CFilter scripting characters in all input fields
- DDisallow client side scripting in the end user’s browser configuration
23A database administrator (DBA) is responsible for carrying out security policy, which includes controlling which users have access to which data. The DBA has been asked to make just certain fields in some database tables visible to some new users. What is the best course of action for the DBA to take?
- AImplement column-based access controls
- BExport the table to a data warehouse, including only the fields that the users are permitted to see
- CClone the table, including only the fields that the users are permitted to see
- DCreate a view that contains only the fields that the users are permitted to see
24The purpose of Data Control Language is:
- ADefine which users are able to view and manipulate data in a database
- BDefine data structures in a relational database
- CDefine data structures in an object-oriented database
- DRetrieve, insert, delete and update data in a relational database
25A list of all of the significant events that occur in an application is known as:
- AAudit log
- BReplay log
- CExport file
- DData dump
Información
- Descripción
- 1 CSI270 Test sobre Quiz 10, creado por Joshua Villy el 09/05/2013.
- Autor
- Joshua Villy
- Idioma
- English
- Visitas
- 756
- Etiquetas
- Valoración
- Aún sin valoraciones Valora este test