SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Domain4 Application Security
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. OSI layer that provides transparent transfer of data between end users
java
address resolution protocol
transport
application
2. Used by java to verify the code for a list of predetermined insecurities
presentation
bytecode verifier
open mail relay
session cookie
3. Phases of threat modeling
security objective definition - application review - application decomposition - threat identification - vulnerability identification
P2P
misconfigured mail server
application
4. OSI model layers
Application - Presentation - Session - Transport - Network - Data Link - Physical
P2P
reflected XSS
transport
5. Enforce application software restrictions - virus scan all files - restrict folders shared by other P2P clients are safeguards for
zones
peer to peer
reflected XSS
P2P
6. Target for trojans and viruses - used to transfer stolen/pirated data - unintentional disclosure of data are risks associated with
P2P
application
session
IM
7. Enticing a user to execute malicious code stored on a web server (i.e. via hyperlink in an email)
heap
reflected XSS
transport
buffer overflow
8. This layer formats and encrypts data to be sent across a network - providing freedom from compatibility problems - sometimes called the syntax layer
input validation
reflected XSS
presentation
cookie leaking
9. Small text files downloaded and stored on a user's computer that contain information about the user's session and preferences
cookies
cookie attacks
java
input validation criteria
10. The unauthorized modification of the data stored within a cookie
cookie poisoning
zones
session
javascript
11. OSI layer responsible for path determination and logical addressing - routers operate at this layer
presentation
network
ARP spoofing
cookie hijacking
12. Used by java and javascript to isolate executing code in a reserved area of memory to limit damage of malicious code
application review
sandboxing
network
persistent cookie
13. Scripting languages - developed by Microsoft to allow developers to extend and reuse web functionality
cookie hijacking
reflected XSS
common off the shelf
vbscript and jscript
14. Three main cookie types
address resolution protocol
digitally signed java control
session - persistent - tracking
cookie attacks
15. Can filter out most buffer overflow attacks
stack and heap
application gateways
common off the shelf
session
16. Protocols used in this layer - IP
application decomposition
java
cookies
network
17. A scripting language - developed by Netscape to perform client-side web development
data link
peer to peer
javascript
application
18. OSI layer responsible for network processes to application
input validation
cookie leaking
application
stack
19. OSI layer attributed with 75% of malicious attacks
Internet - Local Intranet - Trusted Sites - Restricted Sites
transport
session - persistent - tracking
application
20. IP address exposure - download of worm/viruses circumventing the firewall - no way to track improper communication - messages in clear text are risks associated with
cookie attacks
IM
drive by download
common off the shelf
21. Attackers sniff network traffic and capture a cookie download or gain access to a computer and view locally stored cookie
data link
stored XSS
network
cookie hijacking
22. OSI layer that establishes - manages and terminates the connections between the local and remote application
session
reflected XSS
application review
threat identification
23. Malicious code stored in a web application that is downloaded and executed without the user's knowledge
threat identification
XSS
session cookie
stored XSS
24. Area of the memory where dynamically allocated variables are stored
heap
physical
reflected XSS
peer to peer
25. Attacks targeting buffer overflow and cross-site scripting attack this OSI layer
Application - Presentation - Session - Transport - Network - Data Link - Physical
application
application layer
input validation criteria
26. OSI layer responsible for data representation and encryption (MIME
java
application
javascript
presentation
27. Deleted when the user closes their web browser - can contain authentication-related information
vulnerability identification
network
session cookie
cookie leaking
28. OSI layer that provides interhost communication (Named Pipes
zones
input validation
tracking cookie
session
29. Allow an attacker to intercept and modifiy data sent between two network devices - hijacking of network communications - attacks data link layer
ARP spoofing
java
input validation
ActiveX
30. Security zone options offered by Internet Explorer
transport
common off the shelf
ARP spoofing
Internet - Local Intranet - Trusted Sites - Restricted Sites
31. A named collection of Web sites that can be assigned a specific security level
zones
transport
reflected XSS
IM
32. OSI layer responsible for end-to-end connections and reliability (i.e. TCP
XSS
transport
drive by download
vbscript and jscript
33. Key functionality (how the application works) is identified and an application diagram developed in this phase of threat modeling
P2P
ActiveX
application review
stack and heap
34. Used to record user's web activity - may be downloaded in the background
tracking cookie
presentation
data link
reflected and stored
35. Attack that occurs when a user navigates to a web site and hostile content is automatically downloaded and executed
vulnerability identification
data link
drive by download
IM
36. Type - length - format - range
ActiveX
transport
input validation criteria
application
37. OSI layer that relates to the physical connection of two devices (i.e. RS-232
application gateways
physical
stack and heap
peer to peer
38. Ensure data input is validated - encode user supplied data - don't click on unknown hyperlinks - implement restrictive web browser security zones are preventative measures against
address resolution protocol
vbscript and jscript
XSS attacks
packet sniffer
39. Sensitive information stored within a cookie that is obtained by unauthorized users
cookie leaking
cookies
transport
network
40. Can leave the sandbox and obtain access to client resources
cookie attacks
digitally signed java control
ARP spoofing
transport
41. A microsoft created technology that enables software applications to share and reuse software components - maybe used to access files on local system or system registry
ActiveX
stack and heap
data link
vulnerability identification
42. ARP stands for...
sandboxing
application
address resolution protocol
threat identification
43. COTS stands for
physical
common off the shelf
session cookie
zones
44. A method of code signing - allows developers to obtain digital certificate generated by a certificate authority and digitally sign ActiveX controls
security objective definition
zones
vulnerability identification
authenticode
45. Threats to defined security objects are identified using knowledge gained during application decomposition in this phase of threat modeling
security objective definition
threat identification
physical
zones
46. Categories of XSS
java
javascript
reflected and stored
stack and heap
47. OSI layer that provides the means to transfer data between network entities and detect/correct errors that may occur in the physical layer
digitally signed java control
vulnerability identification
presentation
data link
48. Two types of buffer overflows
tracking cookie
stack and heap
data link
data link
49. Enable the cookie secure-bit setting - avoid using cookies to hold sensitive data - block third-party cookies will prevent ______
cookie hijacking
cookie attacks
common off the shelf
buffer overflow
50. Process to identify and assess a system's security risks
security objective definition
threat identification
threat modeling
data link