Quiz
Analyse 9 week 7
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (40)
1All the following methods are useful to reduce the risk of Shell Command Injection, except:
- AAvoiding 'Finger' and 'Sendmail' commands
- BHandling shell metacharacters
- CAvoiding user input in the command arguments
- DManaging without the shell
2A program which sits between your browser and any web server, and that pop up nice dialog whenever your browser sends anything is known as _______________.
- AProxy
- BTelnet
- CMan in the middle
- DTrojan horse
3The local cache is managed by the ________.
- ABrowser
- BServer
- CHTTP Protocol
- DFirewall
4An attacker may modify the value of user's input. Which statement is incorrect?
- AIf a GET request is used, parameter manipulation is just a matter of modifying the URL in the location bar of the browser.
- BIf a POST request is used, the attacker may have to modify the form details of our HTML before sending the request.
- CModifying the HTML in POST request is not simple.
- DAn attacker can manipulate the values before sending the request.
5In input validation, if we identify bad data and filter it, the process is known as ___________.
- ARegular expression
- BBlacklisting
- CDeny by default
- DWhitelisting
6Which of the following statements is incorrect in XSS attack?
- AThe intention is often to steal session information, and thus be able to contact the site on behalf of the victim.
- BIt generally attacks the user of the web application, not the application itself.
- CIt attacks the network transport rather than the application or the client.
- DIt is about tricking a web server into presenting malicious HTML, typically script code, to a user.
7Suppose a web application allows the attacker to inject the attached script into the HTML sending to the user's browser, and the script is allowed to be executed by the browser. What is correct about the web application?
- AWeb application is not properly hiding the HTML.
- BWeb application is not properly handling the output.
- CWeb application is not properly handling the shell command.
- DWeb application is not properly handling the input.
8A voting website has a form containing HTML code shown in the attached image. What is the main reason which allows this voting website be easily attacked?
<form action="http://www.voting.example/vote.asp" method="get">
<input type="radio" name="alt" value="1"/>Foo<br/>
<input type="radio" name="alt" value="2"/>Bar<br/>
:
:
</form>- AMaybe the website is not protected by an Antivirus.
- BBecause the code does not include an encryption algorithm.
- CBecause the radio button input can be easily modified.
- DBecause the form uses the GET method.
9The ticketing system against Web Trojans will also protect the computer against the Cross-site Scripting.
- ATrue
- BFalse
10The hyphens are not the main problem in SQL injection attack.
- ATrue
- BFalse
11If we would like to have the string "AT&T" as part of the query string of a URL, exactly as it is, how it should be encoded in the URL?
- AAT%26T
- B%AT%&%T
- CAT\&T
- DAT&T
12in the request below: GET / HTTP/1.0 Host: http://www.someplace.example Accept: text/html, text/plain, image/* Accept-Language: en User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5a) "GET" is known as ______________.
- AMethod token
- BRequest
- CRequest header
- DValidation token
13Invalid server-generated input indicates _____________.
- AUser mistake
- BTampering
- CPoor interface
- DAuthorization error
14___________ may be invalid due to typing errors.
- ACookies
- BServer-generated input
- CHTTP headers
- DUser-generated input
15"The attacker needs the unique session ID cookie of the victim to impersonate him/her." What is the described attack?
- APacket Sniffing
- BSQL Injection
- CSession Hijacking
- DDenial-of-Service
16Check boxes and selection lists which are generated by server are not considered in input validation process, because users can only select the predefined options from the provided list.
- ATrue
- BFalse
17A secure web application will message invalid input to make it valid.
- ATrue
- BFalse
18Browsers are allowed to redo POST requests without first asking the user for permission.
- ATrue
- BFalse
19When developing web applications which additional measurement could be applied to provide in-depth defence against attacks, when passing data to subsystems?
- AHaving a subsystem permission mechanism
- BImplementing server-generated input wherever is possible, to avoid attacks caused by user-generated input
- CThe user interface should contain more static webpages. In this way a user has less possibility to pass data to the subsystem
- DRead the documentation of used libraries to verify the security level it provides before using it in your implementation.
20The code that is most vulnerable to SQL injection attack contains ___________.
- ADynamic SQL with concatenated input values.
- BCall external function.
- CDynamic SQL with bind arguments.
- DInput parameters.
21The header which contains the URL of the document from which the request originated is called _____________.
- AReferer
- BPlug-in
- CGET
- DUnified Header
22HTTP is line oriented, and text are encoded to avoid attackers from reading the plain text.
- ATrue
- BFalse
23Which answer can be used for validation of an E-mail address?
- AMetacharacter escaping
- BText encryption
- CRegular expression
- DAll the above approaches
24When we can start input validating?
- AAs soon as we have identified all input to the application.
- BAs soon as we need to use a specific input.
- CAs soon as the input is checked by the subsystem.
- DAs soon as the application is not busy with other tasks.
25What is the main task of injected script by attacker in XSS-based session hijacking?
- ATo change information on the page as it is displayed to the victim.
- BTo generate web a page that contains URLs and forms inviting the user to do something.
- CAll the above answers.
- DTo pick up the cookie containing the session ID, and passes the cookie to the attacker’s computer.
26For HTML Cross-site Scripting, the most appropriate time to deal with data passing problem is whenever our application _______________ .
- APasses data to the database
- BGenerates some input
- CGenerates some output
- DSends HTTP requests
27In browsing a website, If the document contains hypertext that references embedded contents, such as images and Java applets, the browser will need _____________ to display all the contents.
- AFast internet connection
- BA persistent connection
- CTo send multiple requests
- DTo send a single request
28To protect against Web Trojans, which technique is an appropriate approach to be implemented by developers?
- ATicket system
- BRegular expression based filtering
- CHTML encoding
- DTag filtering
29When implementing a secure web application, developers can rely on client-side security implementation such as validating user input and avoid unnecessary security measures on the server.
- ATrue
- BFalse
30Blacklist filtering is a good security mechanism, because it provides an easy way to deal with forgotten or unknown dangers.
- ATrue
- BFalse
31A web application that takes input only from sources other than the web client (user input) is considered as more secure?
- ATrue
- BFalse
32A programmer must always handle all metacharacters even if it seems unnecessary.
- ATrue
- BFalse
33For a money transfer in online banking, which request is the most appropriate method to store data?
- APOST
- BGET
- CTCP/IP
- DDELETE
34A client sends a HTTP request, the server responds, and then both forget that they have talked to each other.
- ATrue
- BFalse
35Which answer is incorrect about input?
- AUser is not allowed to enter whatever he likes.
- BWhatever the user enters in text fields and text areas are input to the web application.
- CInput may enters the application through GET or POST.
- DInput may decide what to do next.
36Cross-site Scripting is a _______________.
- AMetacharacter problem
- BNetwork layer problem
- CShell problem
- DInput validation problem
37In the ticketing system, for each ticket generated, we should add a string naming the action it refers to, and store the combined string in a ____________ in the session of the user who receives the offer.
- Aheader
- Bticket pool
- Ccookie
- Dsafe place
38Which rule is not correct regarding the implementation of a secure web application?
- ANever pass detailed error messages to the client
- BAlways generate a new session ID once the user logs in
- CWhen possible, pass data separate from control information
- DPass as much internal state information as possible to the client
39You log into an application at the following URL:
https://foo.wahh-app.com/login/home.php
and the server sets the following cookie:
Set-cookie: sessionId=1498172056438227; domain=foo.wahh-app.com; path=/login; HttpOnly;
You then visit a range of other URLs. To which of the following, will your browser submit the sessionId cookie?- Ahttps://foo.wahh-app.com/login/myaccount.php
- Bhttps://bar.wahh-app.com/login
- Chttps://bar.wahh-app.com/login/home.php
- Dhttp://bar.wahh-app.com/login/myaccount.php
40When implementing validation rules in web application, user permissions should not be checked along the validation process?
- ATrue
- BFalse
Information
- Description
- Learning Technology Quiz on Analyse 9 week 7, created by Joost Stam on 07/04/2019.
- Author
- Joost Stam
- Language
- English
- Views
- 24
- Tags
- Rating
- No ratings yet Rate this quiz