Quiz
Analyse 9 week 2
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (27)
1Any database server based on SQL will need to have quotes escaped in string constants.
- ATrue
- BFalse
2What is the main security problem with meta-characters, when a dynamic web applications pass data to one or more subsystems?
- AThey may cause the parser to switch context from normal text to control command.
- BThey may represent names, addresses, passwords, and some private information.
- CThey contain raw data, instead of encrypted data.
- DThe programmer is not able to handle them.
3An SQL injection attack is _________.
- Athe exploitation of programming weaknesses in SQL codes to gain access to a database, its resources, and applications.
- Bthe injection of malware in an SQL authentication processes.
- Ca botnet attack on SQL machines across different geographical locations.
- Dexploitation of database entry codes to gain access to user input forms.
4Which answer can help an attacker for a SQL injection on Microsoft Access database?
- ASQL comment introducer
- Binspection of cookies and cache
- Cplaying with Boolean operators precedence rules
- Dusing double hyphen in a query
5An attacker entered the following input in the email address field when registering in the system. You guess what attack he intend to perform?
foo@bar.example; mail badguy@badguy.example < /etc/passwd- AShell command injection
- BSQL injection
- CSession hijacking
- DMetacharacter injection
6The first line in the HTTP request is known as the request-header.
- ATrue
- BFalse
7The hyphens are not the main problem in SQL injection attack.
- ATrue
- BFalse
8If we do not handle metacharacters, our SQL-based database application will be vulnerable to SQL injection attacks.
- ATrue
- BFalse
9Which weakness is mainly used for SQL Injection attacks?
- AHTML encoding
- BHandling of meta-characters
- CText modification
- DScript injection
10A programmer must always handle all metacharacters even if it seems unnecessary.
- ATrue
- BFalse
11If the code developer implements metacharacter handling procedure, input validation is still required.
- ATrue
- BFalse
12You may occasionally have seen ‘‘404 Not Found’’ when visiting web pages. That error message is taken directly from the ___________.
- AStatus-Line
- BUser-Agent header
- CError header
- DHTML body
13What attack is described by the following definition?
"an attacker is able to modify or add queries that are sent to a database by playing with input to the web application."- AShell Command Injection
- BSQL Injection
- CCross-site Scripting
- DSession Hijacking
14All metacharacters must be escaped to be treated as control characters.
- ATrue
- BFalse
15If a code developer ask his program to run an external command by operating system, the risk of which attack is more probably increased?
- ASQL injection
- BShell command injection
- CSession Hijacking
- DAll the above answers
16Metacharacters typically are not problem where data are mixed with nondata, such as in dynamically built SQL statements.
- ATrue
- BFalse
17In SQL injection, quotes are bad only when they make a parser switch context.
- ATrue
- BFalse
18All the following methods are useful to reduce the risk of Shell Command Injection, except:
- AManaging without the shell
- BAvoiding user input in the command arguments
- CHandling shell metacharacters
- DAvoiding 'Finger' and 'Sendmail' commands
19An attacker can not do harm to a system even if the web application developer forgets about the backslash when passing string constants to a database that supports it.
- ATrue
- BFalse
20All the following methods are useful to reduce the risk of SQL injection, except:
- AUsing prepared statements
- Bescaping metacharacters
- CNeutralizing SQL metacharacters
- Dshowing detailed error messages to the client
21Code that most vulnerable to SQL injection attack contains ___________.
- Ainput parameters.
- Bdynamic SQL with bind arguments.
- Cdynamic SQL with concatenated input values.
- Dcall external function.
22Escaping all quotes from the client-side is the wrong way to avoid the SQL injection attack .
- ATrue
- BFalse
23In HTTP requests, the GET method expects a _____________.
- Amethod token
- Brequest-URI
- Cversion identifier
- Dstatus code
24Instead of handling the escaping of SQL metacharacters ourselves, we could use prepared statements.
- ATrue
- BFalse
25Attacker is not able to inject control information to dictate the behavior of the subsystem, if we provide appropriate message and ask the user to enter correct input.
- ATrue
- BFalse
26When escaping metacharacters, we tell the subsystem to treat the metacharacter as something that makes it switch context.
- ATrue
- BFalse
27If a user enters the following input in the user name fields, and leaves the password empty, you can guess that he is trying a perform a/an _________ attack.
john’ --- ASQL injection
- BShell Command Injection
- CSession hijacking
- DMetacharacter injection
Information
- Description
- Learning Technology Quiz on Analyse 9 week 2, created by Joost Stam on 07/04/2019.
- Author
- Joost Stam
- Language
- English
- Views
- 41
- Tags
- Rating
- No ratings yet Rate this quiz