Flashcards
SCIA 472 Chapter 8
Cards in this deck (20)
- 1Which class of individuals is primarily concerned with the security of the Web server because it can provide an easy means of getting into the local network? a. Server administrator b. Network administrator c. End user d. Web attackera. Server administrator
- 2Which class of individuals works the most with the server and is primarily concerned with access to content and services? a. Server administrator b. Network administrator c. End user d. Web attackerc. End user
- 3Which category of risk inherent with Web servers includes risks such as the ability to steal information from a server, run scripts or executables remotely, enumerate servers, and carry out denial of service (DoS) attacks? a. Port-side risks b. Browser or client-side risks c. Browser- and network-based risks d. Defects and misconfiguration risksd. Defects and misconfiguration risks
- 4Which of the following is NOT considered a vulnerability of Web servers? a. Improper or poor Web design b. Poor end-user training c. Denial of service (DoS) and distributed denial of service (DDoS) attacks d. Buffer overflowb. Poor end-user training
- 5Common forms of distributed denial of service (DDoS) attacks include all of the following EXCEPT: a. Buffer overflows b. Ping flooding attack c. Smurf attack d. SYN floodinga. Buffer overflows
- 6Which of the following refers to a language used to interact with databases, making it possible to access, manipulate, and change data? a. Cross-site scripting (XSS) b. Banner language c. Structured Query Language (SQL) d. Buffer overflowc. Structured Query Language (SQL)
- 7Which of the following statements is NOT true regarding Structured Query Language (SQL) injections? a. They involve the attacker “injecting” SQL code into an input box or form with the goal of gaining unauthorized access or alter data. b. They can be used to inject SQL commands to exploit non-validated input vulnerabilities in a Web app database. c. They can be used to execute arbitrary SQL commands through a Web application. d. They are specific to only one vendor’s database and cannot force the application to reveal restricted information.d. They are specific to only one vendor’s database and cannot force the application to reveal restricted information.
- 8What type of attack relies on a variation of the input validation attack but has the goal of going after a user instead of the application or data. a. Web site defacing b. Buffer overflows c. Cross-site scripting (XSS) d. Structured Query Language (SQL)c. Cross-site scripting (XSS)
- 9Exploitative behaviors against Web applications include all of the following EXCEPT: a. man-in-the-middle attacks. b. domain Name Server (DNS) attacks. c. destruction of data. d. theft of information such as credit cards or other sensitive data.a. man-in-the-middle attacks.
- 10The categories of Web application vulnerabilities include all of the following EXCEPT: a. authentication issues. b. authorization configuration. c. session management issues. d. end-user education.d. end-user education.
- 11Web applications that require a user to log on prior to gaining access can track information relating to improper or incorrect logons; this information typically lists entries such as all of the following EXCEPT: a. entry of an invalid user ID with a valid password. b. entry of a valid user ID with an invalid password. c. entry of an invalid user ID and password. d. entry of a valid user ID and password.d. entry of a valid user ID and password.
- 12Which of the following refers to encryption using short keys or keys that are poorly designed and implemented that can allow an attacker to decrypt data easily and gain unauthorized access to the information? a. Weak ciphers or encoding algorithms b. Vulnerable software c. Absent or inadequate password change controls d. Insecure or weak session identifiersa. Weak ciphers or encoding algorithms
- 13Which of the following is a hierarchical, structured format for storing information for later retrieval, modification, management, and other purposes? a. Cipher b. Session c. Database d. Encryptionc. Database
- 14Typical categories of databases include all of the following EXCEPT: a. relational database. b. applied database. c. distributed database. d. object-oriented programming database.b. applied database.
- 15Common database vulnerabilities include all of the following EXCEPT: a. unused stored procedures. b. services account privilege issues. c. strong audit log settings. d. weak or poor authentication methods enabled.c. strong audit log settings.
- 16NGSSquirreL and AppDetective are: a. pieces of software for performing audits on databases. b. languages for communicating with databases. c. tools for locating rogue or unknown database installations. d. cloud computing software.a. pieces of software for performing audits on databases.
- 17SQLPing and SQLRecon are: a. pieces of software for performing audits on databases. b. languages for communicating with databases. c. tools for locating rogue or unknown database installations. d. cloud computing software.c. tools for locating rogue or unknown database installations.
- 18Which of the following statements is NOT true regarding the protection of databases? a.Databases can be protected by making sure their existence is not obvious. b. Tools are available to keep a database hidden from scans by attackers. c. Most Web servers, Web applications, and the databases hosted in the environment include some security features. d. Very few tools are available to locate, audit, and ultimately protect databases.d. Very few tools are available to locate, audit, and ultimately protect databases.
- 19Offloading services from the local intranet to the Internet itself can be done by the use of: a. SQL injections. b. buffer overflows. c. firewalls. d. cloud computing.d. cloud computing.
- 20Security issues that can arise in cloud computing that are above and beyond those with standard environments include all of the following EXCEPT: a. detectability. b. availability. c. reliability. d. loss of control.a. detectability.
Information
- Description
- SCIA 472 Flashcards on SCIA 472 Chapter 8, created by Tyler Rock on 07/04/2020.
- Created by
- Tyler Rock
- Views
- 0
- Rating