Quiz
Questões - Web Application Security
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (15)
1How do we write the code to allow unauthenticated access for users of all rules?
- A< auth-constraint >
< role-name >*< /role-name >
< /auth-constraint > - B< auth-constraint >
< role-name >Guest< /role-name >
< /auth-constraint > - C< security-constraint >
< auth-constraint / >
< / security-constraint > - DNone of the Options
- A< auth-constraint >
2How do we write the code to allow authenticated access for users of all rules?
- A< auth-constraint >
< role-name >*< / role-name>
< /auth-constraint> - B< auth-constraint >
< role-name >Guest< / role-name>
< /auth-constraint> - C< security-constraint >
...
< web-resource-collection >
...
< /web-resource-collection >
< /security-constraint > - DNone of the Options
- A< auth-constraint >
3What is the result of this code?
< security-constraint >
< auth-constraint / >
< / security-constraint>- AAllows authenticated access to all users.
- BAllows unauthenticated access to all users.
- CAllows authenticated access only for the default "Guest" role.
- DThe Container will not allow access to constrained resources for any roles.
4How many values can be declared for the < transport-guarantee > element of the < user-data-constraint > ?
- A1
- B2
- C3
- D4
5Confidentiality is:
- ASecuring data in transit.
- BIdentifying the user by means of name and password.
- CMaking sure that data is not tampered during transit.
- DDeciding on the resources to access based on the role of the user.
6If data in transit should not be tampered, it is:
- AData Integrity
- BAuthentication
- CConfidentiality
- DAuthorization
7Before assigning users to roles according to each JavaEE server, what should be done?
- ASpecify the users in the deployment descriptor.
- BDeclare all roles specified in the application in the Deployment Descriptor.
- CNothing needs to be done.
- DNone of the options.
8There can be more than one < web-resource-name > element per collection.
- ATrue
- BFalse
9What is the meaning of the above deployment descriptor?
<web-app>
.........
< security-constraint >
< web-resource-collection >
< web-resource-name > Whizlabs < / web-resource-name >
< url-pattern > /whizlabs/* < / url-pattern >
< / web-resource-collection>
< auth-constraint >
< role-name> Member < / role-name >
< / auth-constraint >
< / security-constraint >- ABy default only the GET method is protected.
- BNone of the methods are protected.
- CThe POST method is protected.
- DAll the methods are protected.
10What is wrong with the above code?
<web-app>
......
< security-constraint >
< web-resource-collection >
< web-resource-name >Whizlabs< / web-resource-name >
< web-resource-name >OCWCD< / web-resource-name >
< url-pattern >/whizlabs/*< / url-pattern >
< / web-resource-collection >
< auth-constraint >
< role-name > Guest < / role-name >
< / auth-constraint >
< / security-constraint >
< / web-app >- ANothing is wrong with this code.
- BThe < url-pattern > must be specified befor the < web-resource-name > element.
- CThere can be only one < web-resource-name > element.
- DThe < role-name > is not a valid element of < auth-constraint >
11Can we multiple security-constraint elements for a web application?
- ATrue
- BFalse
12What is the result of the following code?
< web-app >
...........
< security-constraint >
< web-resource-collection >
< web-resource-name >Listener < / web-resource-name >
< url-pattern > chapter01/Listener/* < / url-pattern >
< http-method > GET < / http-method >
< / web-resource-collection >
< auth-constraint >
< role-name > Guest < / role-name >
< role-name > Admin < / role-name >
< / auth-constraint >
< / security-constraint >
< security-constraint >
< web-resource-collection >
< web-resource-name >Listener1< / web-resource-name >
< url-pattern >chapter01/Listener/*< / url-pattern >
< http-method >GET < / http-method >
< / web-resource-collection >
< auth-constraint >
< role-name >*< / role-name >
< / auth-constraint >
< / security-constraint >
< / web-app >- AOnly Guest and Admin have access to the chapter01/Listener/* resources.
- BAll roles have access to the chapter01/Listener/* resources.
- CNone of the roles have access to the chapter01/Listener/* resources.
- DOnly Guest has access to the rosources.
13What are the two least secure authentication mechanisms?
- ABASIC and CLIENT-CERT
- BFORM and CLIENT-CERT
- CDIGEST and CLIENT-CERT
- DBASIC and FORM
14What is the default authentication when no type is specified?
- ABASIC
- BDIGEST
- CCLIENT-CERT
- DFORM
15Consider in the deployment descriptor:
< login-config >
< auth-method > FORM < / auth-method >
< form-login-config >
< form-login-page > /login.html < / form-login-page >
< form-error-page > /error.html < / form-error-page >
< / form-login-config >
< / login-config >
And this in the login.html page:
< form method="POST" action="check" >
< input type="text" name="j_username" >
< input type="password" name="j_password" >
< input type="submit" value="enter" >
< / form >
What is the result of the above code?- AAuthentication will proceed as normal.
- BAuthentication will proceed as normal but authorization not.
- CAuthentication will not proceed as normal.
- DAuthentication / Authorization both will proceed as normal.
Information
- Description
- Concursos Públicos Desenvolvimento de Software (OCEJWCD 6 ONLINE COURSE) Quiz on Questões - Web Application Security, created by Luis Felipe Guariento on 22/02/2018.
- Author
- Luis Felipe Guariento
- Language
- Português
- Views
- 0
- Tags
- Rating
- No ratings yet Rate this quiz