SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Domain4 Application Security
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Key functionality (how the application works) is identified and an application diagram developed in this phase of threat modeling
stored XSS
application review
P2P
digitally signed java control
2. A named collection of Web sites that can be assigned a specific security level
persistent cookie
physical
cookie leaking
zones
3. Type - length - format - range
input validation
peer to peer
input validation criteria
XSS
4. Number one safeguard against buffer overflow - XSS - data injection - and DoS attacks
Internet - Local Intranet - Trusted Sites - Restricted Sites
threat identification
input validation
P2P
5. OSI layer attributed with 75% of malicious attacks
presentation
security objective definition - application review - application decomposition - threat identification - vulnerability identification
network
application
6. Allow an attacker to intercept and modifiy data sent between two network devices - hijacking of network communications - attacks data link layer
security objective definition
session
ARP spoofing
sandboxing
7. IP address exposure - download of worm/viruses circumventing the firewall - no way to track improper communication - messages in clear text are risks associated with
XSS
cookie poisoning
IM
data link
8. P2P stands for...
session
stack and heap
open mail relay
peer to peer
9. COTS stands for
session
reflected and stored
zones
common off the shelf
10. Two types of buffer overflows
transport
stack and heap
drive by download
IM
11. Target for trojans and viruses - used to transfer stolen/pirated data - unintentional disclosure of data are risks associated with
transport
application
persistent cookie
P2P
12. Security objectives placed on an application are identified - controlling the scope of the threat modeling process
common off the shelf
security objective definition
IM
input validation criteria
13. Protocols used in this layer - IP
input validation criteria
threat identification
network
cross-site scripting
14. Security zone options offered by Internet Explorer
threat identification
input validation criteria
Internet - Local Intranet - Trusted Sites - Restricted Sites
digitally signed java control
15. Ensure data input is validated - encode user supplied data - don't click on unknown hyperlinks - implement restrictive web browser security zones are preventative measures against
open mail relay
cross-site scripting
application
XSS attacks
16. The unauthorized modification of the data stored within a cookie
input validation criteria
application review
buffer overflow
cookie poisoning
17. Used to record user's web activity - may be downloaded in the background
P2P
session - persistent - tracking
XSS attacks
tracking cookie
18. Tools used to capture packets of data off a network and allow viewing of contents
stack
cookies
vbscript and jscript
packet sniffer
19. OSI layer 2 - verify the connection between two devices is intact (i.e. physical addressing)
data link
application review
open mail relay
ActiveX
20. Area of the memory where dynamically allocated variables are stored
network
heap
threat identification
address resolution protocol
21. Malicious code stored in a web application that is downloaded and executed without the user's knowledge
stored XSS
application gateways
javascript
application
22. OSI model layers
application layer
application review
physical
Application - Presentation - Session - Transport - Network - Data Link - Physical
23. Scripting languages - developed by Microsoft to allow developers to extend and reuse web functionality
network
address resolution protocol
vbscript and jscript
physical
24. Server misused to forward spam - DoS conditions - damage to brand - blacklist on spam sites are risks associated with
persistent cookie
Internet - Local Intranet - Trusted Sites - Restricted Sites
open mail relay
application
25. The application is reviewed and specific vulnerabilities are documented in this phase of threat modeling
vulnerability identification
common off the shelf
application gateways
application
26. Attack that occurs when a user navigates to a web site and hostile content is automatically downloaded and executed
stack
reflected and stored
persistent cookie
drive by download
27. Can filter out most buffer overflow attacks
drive by download
transport
presentation
application gateways
28. Cause of open SMTP relays
application
data link
misconfigured mail server
network
29. Enable the cookie secure-bit setting - avoid using cookies to hold sensitive data - block third-party cookies will prevent ______
stack and heap
peer to peer
cookie attacks
threat identification
30. Protocols in this layer NNTP
address resolution protocol
application
java
sandboxing
31. OSI layer responsible for network processes to application
security objective definition - application review - application decomposition - threat identification - vulnerability identification
application
session
persistent cookie
32. ARP stands for...
stored XSS
stack and heap
address resolution protocol
zones
33. OSI layer defines the electrical / physical device specs (media - signal - and binary transmission). This includes the layout of pins - voltages - cable specifications - hubs - network adapters - host bus adapters and more.
session
misconfigured mail server
P2P
physical
34. OSI layer responsible for end-to-end connections and reliability (i.e. TCP
vulnerability identification
transport
misconfigured mail server
ARP spoofing
35. Have a timeout value - are not deleted when the user closes their web brower - used to store user preferences and information about the use connection
presentation
threat identification
persistent cookie
cookie poisoning
36. Enticing a user to execute malicious code stored on a web server (i.e. via hyperlink in an email)
IM
reflected XSS
security objective definition
drive by download
37. OSI layer that establishes - manages and terminates the connections between the local and remote application
cookie hijacking
session
session cookie
application layer
38. Phase of threat modeling that reviews application ingress and egress data flow and trust boundaries
session
cookie hijacking
cookie attacks
application decomposition
39. Can leave the sandbox and obtain access to client resources
address resolution protocol
data link
stored XSS
digitally signed java control
40. Enforce application software restrictions - virus scan all files - restrict folders shared by other P2P clients are safeguards for
stored XSS
application
input validation criteria
P2P
41. OSI layer that provides interhost communication (Named Pipes
session cookie
application
session
packet sniffer
42. This layer formats and encrypts data to be sent across a network - providing freedom from compatibility problems - sometimes called the syntax layer
open mail relay
peer to peer
presentation
persistent cookie
43. Threats to defined security objects are identified using knowledge gained during application decomposition in this phase of threat modeling
threat identification
XSS attacks
peer to peer
P2P
44. A scripting language - developed by Netscape to perform client-side web development
javascript
misconfigured mail server
sandboxing
application gateways
45. XSS stands for
ARP spoofing
cross-site scripting
application
tracking cookie
46. A microsoft created technology that enables software applications to share and reuse software components - maybe used to access files on local system or system registry
ActiveX
open mail relay
heap
cross-site scripting
47. Protocols used in this layer (ARP
security objective definition - application review - application decomposition - threat identification - vulnerability identification
data link
network
transport
48. Used by java and javascript to isolate executing code in a reserved area of memory to limit damage of malicious code
cookie attacks
threat identification
sandboxing
cookie poisoning
49. Each client is a peer and serves each other client on the network - requires client application and appropriate open network ports to operate
transport
address resolution protocol
peer to peer
physical
50. Used by java to verify the code for a list of predetermined insecurities
authenticode
vulnerability identification
bytecode verifier
threat modeling