Quiz
Secure Software Implementation/Coding
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (45)
1An attack that uses the user interface to manipulate data structures behind the application is called:
- AConfiguration Attack
- BBuffer Overflow
- CCommand Injection
- DSQL Injection
2Which of the following is not a common cryptographic failure?
- AAES seed manipulation
- BFailure to encrypt sensitive data
- CHard-coding of cryptographic keys
- DCustom cryptographic algorithms
3A structure form of attack used when errors are suppressed is referred to as:
- ABlind
- BBlack Box Testing
- CPolymorphic
- DMitigation Avoidance Methodology
4Input strings similar to %2e%2e%2f are indicative of what type of attack?
- ADirectory Traversal
- BCommand Injection
- CSQL Injection
- DBuffer Overflow
5To attack a web application and attempt to get a copy of the configuration file on a server could use a(n):
- AXSS Attack
- BCSRF Attack
- CArithmetic Overflow Attack
- DConfused Deputy Problem
6A known weakness of hashing is duplicate values for identical inputs. To solve this, one uses what technique?
- AThis cannot be solved; it is the nature of hashing
- BMultiple hash rounds, either double or triple hashing
- CNew hash fuinctions like SHA-256
- DSalting of the hash
7Screening of code for use of disallowed functions is best performed by:
- ACode Walkthroughs
- BStatic Testing
- CCompany Policy
- DMisuse Cases
8An attack against old data in memory is referred to as a(n) ___________ attack.
- AASLR
- BData Remanence
- CSQL Injection
- DBuffer Overflow
9Embedded devices are frequently attacked in order to achieve:
- ACryptographic Tokens
- BEnterprise Access
- CStreet Credentials
- DInformation Disclosure
10A common language to describe and exchange information about the causes of software vulnerabilities is:
- ACVS
- BCVE
- CCSSLP
- DCNSS
11The "HashRows()" function of the following can lead to what type of failure in use?
string query = String.Format( "SELECT COUNT(*) FROM Users WHERE " +
"username='{0}' AND password='{1}'", txtUser.Text, txtPassword.Text );
SqlCommand cmd = new SqlCommand(query, conn);
conn.Open();
SqlDataReader reader = cmd.ExecutableReader();
try {
if ( reader.HasRows() ) {
IssueAuthenticationTicket();
} else {
TryAgain();
}
}- ADefense-In-Depth Failure
- BSecurity Through Obscurity
- COutput Validation
- DReliance on untrusted inputs for a security decision
12Sending the following input: %./a.out \`./script\` to this code snippet is an example of what type of attack?
int main (int argc, char *argv[], char **envp)
{
char buf[100];
buff[0] = '\0';
snprintf(buff, sizeof(buff), "grep %s text", argv[1]);
system(buff);
exit(0);
}- ACommand Injection
- BSQL Injection
- CBuffer Overflow
- DInput Validation
13Manipulation of stored values to create a more permanent effect is an example of a:
- ADOM-based XSS Attack
- BPersistent XSS Attack
- CPersistent CSRF Attack
- DReflected XSS Attack
14When validating input before use, one needs to be aware of the following except:
- ASession Management
- BEncoding Methods
- CCanonical Form
- DLanguage-Based Character Sets
15Historically, the most damaging and still significant threat is the __________ attack.
- AUser Impersonation
- BCross-Site Scripting
- CSQL Injection
- DBuffer Overflow
16A widespread source of entry points into software comes from:
- AManaged Code
- BAPIs
- CCryptographic Agility
- DHandling Configuration Parameters
17Placing the security attributes into metadata is an example of:
- APervasive Syntax Security
- BCryptographic Agility
- CImperitive Syntax Security
- DDeclaritive Syntax Security
18The benefits of managed code include all of the following except:
- AFaster Execution
- BType-Safe Code
- CImproved Memory Management
- DLifetime Object Control
19To deal with international distribution issues associated with cryptography, a clean method is via:
- AVersioning
- BUser of international cryptography for all versions
- CUse of approved cryptographic libraries only
- DUse of cryptographic agility
20Address Space Layout Randomization (ASLR) is a specific memory management technique used to defend against:
- ALocality Attacks
- BStack Overflows
- CCryptographically Agile Attacks
- DBuffer Overflows
21What mechanism can be employed to handle data issues that lead to out-of-range calculations?
- ARegular Expressions
- BVetted Functions
- CLibrary Calls
- DException Handling
22To embody business rule-based security in the code, the most efficient mechanism is:
- ADeclarative Syntax Security
- BInternal Syntax Security
- CImperative Syntax Security
- DPervasive Syntax Security
23The tools used to mitigate API-based threats include all of the following except:
- AThreat Model
- BAttack Surface Analysis
- CCryptographic Agility
- DAuthentication
24The following are primary mitigation methods except:
- ALocking down the environment
- BInput validation
- CUse of deprecated libraries for legacy code
- DOutput validation
25The following are primary mitigation methods except:
- AAssume external components are untrusted.
- BCreate your own security controls unique to your environment.
- CApply a broad mix of methods to find weaknesses.
- DUse approved libraries.
26The level of security applied to configuration files depends upon:
- AThe location of the actual configuration file
- BThe number of data elements in the configuration file (scaling)
- CWhether configuration files are locked down in a read-only directory
- DThe risk introduced by bad configurations
27To manage replacement of deprecated cryptographic functions, one should employ:
- ACryptographic Agility
- BOnly custom cryptography so you can control when it gets deprecated
- COnly approved cryptographic library functions
- DOnly current cryptographic functions
28All of the following are concerns of memory management except:
- AGarbage Collection
- BBuffer Overflows
- CMemory Allocation
- DException Management
29Type-safe practices enable:
- AMemory management safety
- BSmaller programs
- CAvoidance of exception in managed code
- DEasier-to-maintain code
30Elements of defensive coding include all of the following except:
- ACustom cryptographic functions to avoid algorithm disclosure
- BException handling to avoid program termination
- CInterface coding efforts to avoid API-facing attacks
- DCryptographic agility to make cryptographic functions stronger
31Code signing cannot provide which of the following to the end user?
- AProof of integrity of the code
- BAuthentication of the source
- CAssurance that the code is free of vulnerabilities
- DAssurance that the code is authentic
32Verifying that code can perform in a particular manner under production conditions is a task managed by:
- AStatic Code Analysis
- BDynamic Code Analysis
- CProduction Testing
- DCode Walkthroughs
33To ensure that the end user is receiving valid code, which of the following methodologies is employed?
- ACode Signing
- BVersion Control
- CConfiguration Management
- DRevision Control
34The /GS compiler switch is used to:
- AManage Memory Leaks
- BPrevent Buffer Overflow
- CPrevent XSS attacks
- DControl for stack overflows through the use of a cookie
35Code walkthroughs are effective for checking for all of the following except?
- ADeprecated library calls
- BStack pointer overflows
- CNonapproved Cryptographic Functions
- DLogic Bombs
36At what level should code analysis be performed?
- AUnit level
- BSubsystem level
- CSystem level
- DAt all levels
37Static analysis can be used to check for:
- AApproved function/library calls, examining rules and semantics associated with logic, and thread performance management.
- BSyntax, approved function/library calls, and race conditions
- CSyntax approved function/library calls, and memory management.
- DSyntax, approved function/library calls, and examining rules and semantics associated with logic and calls.
38Automated testing has the following advantages over manual code review except:
- ADetection of unsafe or deprecated function calls.
- BIdentification of obfuscated routines
- CSpeed of analysis
- DIntegration into the IDE
39Compiler options should be:
- ANot relied upon, as they can provide errant information
- BLimited to key checks for efficiency
- CLeft to developer discretion to enable efficient production
- DPredefined as part of the SDL
40What are the major elements of code signing?
- AEncrypted source code
- BFile integrity checks
- CPublic key cryptography and hash functions
- DControlled distribution channels such as SSL
41Managing the versions and changes associated with all these individual pieces of a software project is referred to as:
- AVersion Control
- BSecure Development Process
- CConfiguration Management
- DSource Code Repository
42Version control is best performed by:
- AA manual, structured process with checks
- BAn automated, transparent process
- CEach developer taking responsibility
- DThe project manager or lead developer to ensure consistency
43The use of only approved libraries of functions enables:
- AFaster development
- BUse of lower skilled developers
- CLower error rates from unknown issues
- DCheaper development
44Libraries of safe function calls are used to address the following issues except:
- AStack overflow
- BXSS attack
- CBuffer overflows
- DInjection attacks
45Code reviews are performed using:
- AStatic analysis tools
- BDynamic analysis tools
- CCompiler with special flag options
- DHuman examination of code.
Informações
- Descrição
- Quiz sobre Secure Software Implementation/Coding, criado por Ashton Norton em 13-03-2017.
- Autor
- Ashton Norton
- Idioma
- English
- Visualizações
- 22
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz