SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Domain4 Application Security
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Sensitive information stored within a cookie that is obtained by unauthorized users
cookie leaking
presentation
network
data link
2. Threats to defined security objects are identified using knowledge gained during application decomposition in this phase of threat modeling
threat identification
tracking cookie
session
bytecode verifier
3. Can leave the sandbox and obtain access to client resources
ARP spoofing
digitally signed java control
data link
reflected and stored
4. A method of code signing - allows developers to obtain digital certificate generated by a certificate authority and digitally sign ActiveX controls
vbscript and jscript
packet sniffer
digitally signed java control
authenticode
5. OSI layer that establishes - manages and terminates the connections between the local and remote application
session
input validation criteria
tracking cookie
application
6. Phases of threat modeling
cookie attacks
reflected and stored
tracking cookie
security objective definition - application review - application decomposition - threat identification - vulnerability identification
7. P2P stands for...
peer to peer
presentation
session - persistent - tracking
security objective definition
8. Target for trojans and viruses - used to transfer stolen/pirated data - unintentional disclosure of data are risks associated with
cookies
input validation
peer to peer
P2P
9. XSS stands for
drive by download
bytecode verifier
cross-site scripting
application gateways
10. Categories of XSS
data link
session
cross-site scripting
reflected and stored
11. A named collection of Web sites that can be assigned a specific security level
stored XSS
authenticode
open mail relay
zones
12. Scripting languages - developed by Microsoft to allow developers to extend and reuse web functionality
Application - Presentation - Session - Transport - Network - Data Link - Physical
address resolution protocol
vbscript and jscript
security objective definition
13. Security objectives placed on an application are identified - controlling the scope of the threat modeling process
data link
security objective definition
Internet - Local Intranet - Trusted Sites - Restricted Sites
network
14. ARP stands for...
physical
cookie hijacking
address resolution protocol
common off the shelf
15. Protocols used in this layer (ARP
network
cookie hijacking
cookie poisoning
data link
16. Enforce application software restrictions - virus scan all files - restrict folders shared by other P2P clients are safeguards for
sandboxing
XSS
P2P
persistent cookie
17. OSI layer that provides interhost communication (Named Pipes
javascript
session
cross-site scripting
network
18. The unauthorized modification of the data stored within a cookie
session
cookie poisoning
vbscript and jscript
stack
19. Attack that occurs when a user navigates to a web site and hostile content is automatically downloaded and executed
drive by download
application layer
Internet - Local Intranet - Trusted Sites - Restricted Sites
java
20. An attack that occurs when malicious code is injected into a web site - where it is downloaded and executed by other users
application layer
open mail relay
persistent cookie
XSS
21. Tools used to capture packets of data off a network and allow viewing of contents
peer to peer
cookie attacks
packet sniffer
authenticode
22. Attacks targeting buffer overflow and cross-site scripting attack this OSI layer
application layer
common off the shelf
data link
presentation
23. Can filter out most buffer overflow attacks
physical
application gateways
application decomposition
IM
24. Number one safeguard against buffer overflow - XSS - data injection - and DoS attacks
data link
input validation
zones
application
25. OSI layer that provides the means to transfer data between network entities and detect/correct errors that may occur in the physical layer
security objective definition - application review - application decomposition - threat identification - vulnerability identification
cookies
buffer overflow
data link
26. COTS stands for
cookie poisoning
ARP spoofing
session - persistent - tracking
common off the shelf
27. A microsoft created technology that enables software applications to share and reuse software components - maybe used to access files on local system or system registry
network
cookie hijacking
application
ActiveX
28. Malicious code stored in a web application that is downloaded and executed without the user's knowledge
vulnerability identification
stack
java
stored XSS
29. Have a timeout value - are not deleted when the user closes their web brower - used to store user preferences and information about the use connection
physical
persistent cookie
transport
security objective definition
30. OSI layer responsible for end-to-end connections and reliability (i.e. TCP
transport
security objective definition - application review - application decomposition - threat identification - vulnerability identification
cookies
application
31. Deleted when the user closes their web browser - can contain authentication-related information
cookie poisoning
peer to peer
zones
session cookie
32. A programming language - developed by Sun - used to make small applications (applets) for the Internet and stand alone programs
application
tracking cookie
java
heap
33. Used by java and javascript to isolate executing code in a reserved area of memory to limit damage of malicious code
input validation criteria
stored XSS
XSS
sandboxing
34. Enable the cookie secure-bit setting - avoid using cookies to hold sensitive data - block third-party cookies will prevent ______
cookie attacks
XSS attacks
heap
tracking cookie
35. Each client is a peer and serves each other client on the network - requires client application and appropriate open network ports to operate
javascript
ARP spoofing
session cookie
peer to peer
36. OSI model layers
cross-site scripting
security objective definition
Application - Presentation - Session - Transport - Network - Data Link - Physical
reflected XSS
37. IP address exposure - download of worm/viruses circumventing the firewall - no way to track improper communication - messages in clear text are risks associated with
network
peer to peer
data link
IM
38. The application is reviewed and specific vulnerabilities are documented in this phase of threat modeling
cookies
application layer
vulnerability identification
stored XSS
39. Two types of buffer overflows
heap
stack and heap
open mail relay
sandboxing
40. Protocols in this layer NNTP
session
application review
application
common off the shelf
41. OSI layer 2 - verify the connection between two devices is intact (i.e. physical addressing)
data link
vbscript and jscript
presentation
application review
42. More data is put into a buffer than it was designed to hold - can be caused deliberately by hackers to run malicious code
buffer overflow
address resolution protocol
physical
peer to peer
43. Allow an attacker to intercept and modifiy data sent between two network devices - hijacking of network communications - attacks data link layer
threat identification
stack and heap
cookies
ARP spoofing
44. Three main cookie types
session - persistent - tracking
application layer
physical
XSS attacks
45. Security zone options offered by Internet Explorer
stored XSS
Internet - Local Intranet - Trusted Sites - Restricted Sites
tracking cookie
application decomposition
46. Phase of threat modeling that reviews application ingress and egress data flow and trust boundaries
heap
data link
bytecode verifier
application decomposition
47. Key functionality (how the application works) is identified and an application diagram developed in this phase of threat modeling
security objective definition
IM
buffer overflow
application review
48. OSI layer responsible for data representation and encryption (MIME
drive by download
threat identification
presentation
application
49. OSI layer responsible for network processes to application
reflected and stored
application
network
data link
50. Cause of open SMTP relays
bytecode verifier
misconfigured mail server
buffer overflow
input validation