Quiz  10

Question 1 of 25

Medal-premium 1

One reason why an organization would consider a distributed application is:

Select one of the following:

  • Some components are easier to operate

  • Distributed applications have a simpler architecture than other types of applications

  • Some application components are owned and operated by other organizations

  • Distributed applications are easier to secure

Question 2 of 25

Medal-premium 1

All of the following are advantages of using self-signed SSL certificates EXCEPT:

Select one of the following:

  • Server authentication

  • Lower cost

  • Easier to create

  • More difficult to crack

Question 3 of 25

Medal-premium 1

The best defense against a NOP sled attack is:

Select one of the following:

  • Firewall

  • Anti-virus

  • The strcpy() function

  • Input boundary checking

Question 4 of 25

Medal-premium 1

The instructions contained with an object are known as its:
A)

Select one of the following:

  • Class

  • Firmware

  • Code

  • Method

Question 5 of 25

Medal-premium 1

The purpose for putting a “canary” value in the stack is:

Select one of the following:

  • To detect a dictionary attack

  • To detect a stack smashing attack

  • To detect parameter tampering

  • To detect script injection

Question 6 of 25

Medal-premium 1

“Safe languages” and “safe libraries” are so-called because:

Select one of the following:

  • They automatically detect some forms of input attacks

  • They automatically detect parameter tampering

  • They automatically detect script injection

  • They automatically detect malware attacks

Question 7 of 25

Medal-premium 1

The following are characteristics of a computer virus EXCEPT:

Select one of the following:

  • Polymorphic

  • Downloadable

  • Self propagating

  • Embedded in spam

Question 8 of 25

Medal-premium 1

Rootkits can be difficult to detect because:

Select one of the following:

  • They are encrypted

  • They are polymorphic

  • They reside in ROM instead of the hard drive

  • They use techniques to hide themselves

Question 9 of 25

Medal-premium 1

An attack on a DNS server to implant forged “A” records is characteristic of a:

Select one of the following:

  • Pharming attack

  • Phishing attack

  • Whaling attack

  • Spim attack

Question 10 of 25

Medal-premium 1

The purpose of digitally signing a Browser Helper Object (BHO) is:

Select one of the following:

  • To prove its origin

  • To prove hhat it is not malicious

  • To prove that it can be trusted

  • To prove that it was downloaded properly

Question 11 of 25

Medal-premium 1

An organization wants to prevent SQL and script injection attacks on its Internet web application. The organization should implement a/an:

Select one of the following:

  • Intrusion detection system

  • Firewall

  • Application firewall

  • SSL certificate

Question 12 of 25

Medal-premium 1

A defense in depth strategy for anti-malware is recommended because:

Select one of the following:

  • There are many malware attack vectors

  • Anti-virus software is often troublesome on end user workstations

  • Malware can hide in SSL transmissions

  • Users can defeat anti-malware on their workstations

Question 13 of 25

Medal-premium 1

The primary advantage of the use of workstation-based anti-virus is:

Select one of the following:

  • Virus signature updates can be performed less often

  • Virus signature updates can be performed more often

  • The user can control its configuration

  • This approach can defend against most, if not all, attack vectors

Question 14 of 25

Medal-premium 1

The primary purpose of a firewall is:

Select one of the following:

  • To protect a server from malicious traffic

  • To block malicious code

  • To control traffic between networks

  • To create a DMZ network

Question 15 of 25

Medal-premium 1

The following are valid reasons to reduce the level of privilege for workstation users EXCEPT:

Select one of the following:

  • Decreased support costs because users are unable to change system configurations

  • Eliminates the need for whole disk encryption

  • Decreased impact from malware

  • Increased security because users are unable to tamper with security controls

Question 16 of 25

Medal-premium 1

A system administrator needs to harden a server. The most effective approach is:

Select one of the following:

  • Install security patches and install a firewall

  • Remove unneeded services, remove unneeded accounts, and configure a firewall

  • Remove unneeded services, disable unused ports, and remove unneeded accounts

  • Install security patches and remove unneeded services

Question 17 of 25

Medal-premium 1

The most effective countermeasures against input attacks are:

Select one of the following:

  • Input field filtering, application firewall, application vulnerability scanning, and developer training

  • Input field filtering, application firewall, and intrusion prevention system

  • Input field filtering, application firewall, intrusion detection system, and ethical hacking

  • Application firewall, intrusion detection system, and developer training

Question 18 of 25

Medal-premium 1

The term “object reuse” refers to:

Select one of the following:

  • A method used by malware to exploit weaknesses in running processes

  • The use of residual computing resources for other purposes

  • The ability to reuse application code

  • Processes that can discover and use residual data associated with other processes

Question 19 of 25

Medal-premium 1

A security assessment discovered back doors in an application, and the security manager needs to develop a plan for detecting and removing back doors in the future. The most effective countermeasures that should be chosen are:

Select one of the following:

  • Application firewalls

  • Source code control

  • Outside code reviews

  • Peer code reviews

Question 20 of 25

Medal-premium 1

The best time to introduce security into an application is:

Select one of the following:

  • Implementation

  • Design

  • Development

  • Testing

Question 21 of 25

Medal-premium 1

A user, Bill, has posted a link on a web site that causes unsuspecting users to transfer money to Bill if they click the link. The link will only work for users who happen to be authenticated to the bank that is the target of the link. This is known as:

Select one of the following:

  • Cross site request forgery

  • Cross-site scripting

  • Broken authentication

  • Replay attack

Question 22 of 25

Medal-premium 1

What is the most effective countermeasure against script injection attacks?

Select one of the following:

  • Stateful inspection firewall

  • Disallow server side scripting in the end user’s browser configuration

  • Filter scripting characters in all input fields

  • Disallow client side scripting in the end user’s browser configuration

Question 23 of 25

Medal-premium 1

A database administrator (DBA) is responsible for carrying out security policy, which includes controlling which users have access to which data. The DBA has been asked to make just certain fields in some database tables visible to some new users. What is the best course of action for the DBA to take?

Select one of the following:

  • Implement column-based access controls

  • Export the table to a data warehouse, including only the fields that the users are permitted to see

  • Clone the table, including only the fields that the users are permitted to see

  • Create a view that contains only the fields that the users are permitted to see

Question 24 of 25

Medal-premium 1

The purpose of Data Control Language is:

Select one of the following:

  • Define which users are able to view and manipulate data in a database

  • Define data structures in a relational database

  • Define data structures in an object-oriented database

  • Retrieve, insert, delete and update data in a relational database

Question 25 of 25

Medal-premium 1

A list of all of the significant events that occur in an application is known as:

Select one of the following:

  • Audit log

  • Replay log

  • Export file

  • Data dump

Icon_fullscreen
Joshua Villy
Quiz by , created over 3 years ago

1 CSI270 Quiz on Quiz  10, created by Joshua Villy on 09/05/2013.

Eye 414
Pin 0
Balloon-left 0
Tags
Joshua Villy
Created by Joshua Villy over 3 years ago
Close