SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Domain4 Application Security
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Attacks targeting buffer overflow and cross-site scripting attack this OSI layer
misconfigured mail server
application layer
Application - Presentation - Session - Transport - Network - Data Link - Physical
session
2. A scripting language - developed by Netscape to perform client-side web development
security objective definition
javascript
data link
session - persistent - tracking
3. Used by java and javascript to isolate executing code in a reserved area of memory to limit damage of malicious code
javascript
sandboxing
drive by download
reflected XSS
4. Phases of threat modeling
stack
cookie attacks
application gateways
security objective definition - application review - application decomposition - threat identification - vulnerability identification
5. P2P stands for...
peer to peer
tracking cookie
presentation
authenticode
6. Enable the cookie secure-bit setting - avoid using cookies to hold sensitive data - block third-party cookies will prevent ______
peer to peer
XSS attacks
drive by download
cookie attacks
7. Attackers sniff network traffic and capture a cookie download or gain access to a computer and view locally stored cookie
drive by download
IM
cookie hijacking
vulnerability identification
8. Protocols in this layer NNTP
input validation criteria
input validation
application
application gateways
9. A method of code signing - allows developers to obtain digital certificate generated by a certificate authority and digitally sign ActiveX controls
authenticode
ARP spoofing
stack
vbscript and jscript
10. Can filter out most buffer overflow attacks
stored XSS
application review
persistent cookie
application gateways
11. Ensure data input is validated - encode user supplied data - don't click on unknown hyperlinks - implement restrictive web browser security zones are preventative measures against
application
application gateways
XSS attacks
heap
12. COTS stands for
Application - Presentation - Session - Transport - Network - Data Link - Physical
transport
common off the shelf
zones
13. Small text files downloaded and stored on a user's computer that contain information about the user's session and preferences
threat modeling
vulnerability identification
session cookie
cookies
14. Sensitive information stored within a cookie that is obtained by unauthorized users
physical
cookie leaking
cross-site scripting
buffer overflow
15. An attack that occurs when malicious code is injected into a web site - where it is downloaded and executed by other users
cookie poisoning
misconfigured mail server
XSS
data link
16. Protocols used in this layer (ARP
application
cookies
data link
stored XSS
17. Cause of open SMTP relays
tracking cookie
data link
misconfigured mail server
packet sniffer
18. Deleted when the user closes their web browser - can contain authentication-related information
P2P
session cookie
sandboxing
reflected and stored
19. Process to identify and assess a system's security risks
threat modeling
javascript
application decomposition
session
20. The unauthorized modification of the data stored within a cookie
application layer
misconfigured mail server
cookie poisoning
session
21. Categories of XSS
application
packet sniffer
session
reflected and stored
22. Tools used to capture packets of data off a network and allow viewing of contents
packet sniffer
data link
security objective definition
application gateways
23. Allow an attacker to intercept and modifiy data sent between two network devices - hijacking of network communications - attacks data link layer
cross-site scripting
ARP spoofing
stack and heap
data link
24. OSI layer responsible for end-to-end connections and reliability (i.e. TCP
transport
application decomposition
data link
stack
25. Used to record user's web activity - may be downloaded in the background
session - persistent - tracking
tracking cookie
vbscript and jscript
physical
26. More data is put into a buffer than it was designed to hold - can be caused deliberately by hackers to run malicious code
cookie hijacking
Internet - Local Intranet - Trusted Sites - Restricted Sites
buffer overflow
sandboxing
27. Enforce application software restrictions - virus scan all files - restrict folders shared by other P2P clients are safeguards for
P2P
stack and heap
packet sniffer
java
28. Each client is a peer and serves each other client on the network - requires client application and appropriate open network ports to operate
vulnerability identification
peer to peer
Internet - Local Intranet - Trusted Sites - Restricted Sites
javascript
29. Scripting languages - developed by Microsoft to allow developers to extend and reuse web functionality
vbscript and jscript
cookie attacks
application
open mail relay
30. This layer formats and encrypts data to be sent across a network - providing freedom from compatibility problems - sometimes called the syntax layer
IM
ARP spoofing
presentation
reflected XSS
31. Three main cookie types
security objective definition - application review - application decomposition - threat identification - vulnerability identification
session - persistent - tracking
digitally signed java control
vbscript and jscript
32. Threats to defined security objects are identified using knowledge gained during application decomposition in this phase of threat modeling
P2P
application
threat identification
java
33. ARP stands for...
data link
address resolution protocol
stored XSS
security objective definition - application review - application decomposition - threat identification - vulnerability identification
34. Two types of buffer overflows
cookie leaking
stored XSS
data link
stack and heap
35. Can leave the sandbox and obtain access to client resources
peer to peer
data link
misconfigured mail server
digitally signed java control
36. OSI layer that establishes - manages and terminates the connections between the local and remote application
physical
session
cookie hijacking
Internet - Local Intranet - Trusted Sites - Restricted Sites
37. Security objectives placed on an application are identified - controlling the scope of the threat modeling process
security objective definition
authenticode
digitally signed java control
reflected and stored
38. Area of the memory where dynamically allocated variables are stored
heap
tracking cookie
Application - Presentation - Session - Transport - Network - Data Link - Physical
session cookie
39. Have a timeout value - are not deleted when the user closes their web brower - used to store user preferences and information about the use connection
cross-site scripting
persistent cookie
application gateways
peer to peer
40. Security zone options offered by Internet Explorer
authenticode
common off the shelf
Internet - Local Intranet - Trusted Sites - Restricted Sites
session
41. Type - length - format - range
data link
threat identification
XSS attacks
input validation criteria
42. OSI layer responsible for path determination and logical addressing - routers operate at this layer
digitally signed java control
cookies
network
application gateways
43. OSI layer responsible for data representation and encryption (MIME
input validation criteria
physical
session
presentation
44. Protocols used in this layer - IP
cookie hijacking
application decomposition
application
network
45. Area of the memory where function calls are stored
XSS
application gateways
stack
stored XSS
46. OSI layer responsible for network processes to application
application
common off the shelf
stack
misconfigured mail server
47. Key functionality (how the application works) is identified and an application diagram developed in this phase of threat modeling
security objective definition
open mail relay
XSS
application review
48. OSI layer that provides transparent transfer of data between end users
session - persistent - tracking
network
transport
stored XSS
49. OSI layer that provides interhost communication (Named Pipes
drive by download
ActiveX
session
authenticode
50. Malicious code stored in a web application that is downloaded and executed without the user's knowledge
Internet - Local Intranet - Trusted Sites - Restricted Sites
security objective definition - application review - application decomposition - threat identification - vulnerability identification
stored XSS
presentation