SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Domain4 Application Security
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. Process to identify and assess a system's security risks
threat modeling
heap
digitally signed java control
common off the shelf
2. Three main cookie types
ActiveX
vbscript and jscript
session - persistent - tracking
authenticode
3. Attack that occurs when a user navigates to a web site and hostile content is automatically downloaded and executed
digitally signed java control
session
Internet - Local Intranet - Trusted Sites - Restricted Sites
drive by download
4. Protocols used in this layer - IP
authenticode
cookie leaking
network
java
5. Phases of threat modeling
security objective definition - application review - application decomposition - threat identification - vulnerability identification
heap
cross-site scripting
application
6. Have a timeout value - are not deleted when the user closes their web brower - used to store user preferences and information about the use connection
input validation criteria
digitally signed java control
threat identification
persistent cookie
7. Used to record user's web activity - may be downloaded in the background
buffer overflow
tracking cookie
java
misconfigured mail server
8. Threats to defined security objects are identified using knowledge gained during application decomposition in this phase of threat modeling
P2P
zones
reflected XSS
threat identification
9. Can filter out most buffer overflow attacks
threat identification
reflected XSS
peer to peer
application gateways
10. Security objectives placed on an application are identified - controlling the scope of the threat modeling process
application gateways
sandboxing
heap
security objective definition
11. Enticing a user to execute malicious code stored on a web server (i.e. via hyperlink in an email)
P2P
reflected XSS
open mail relay
threat modeling
12. This layer formats and encrypts data to be sent across a network - providing freedom from compatibility problems - sometimes called the syntax layer
application layer
tracking cookie
transport
presentation
13. OSI layer responsible for end-to-end connections and reliability (i.e. TCP
physical
heap
transport
network
14. Cause of open SMTP relays
stack and heap
cross-site scripting
misconfigured mail server
threat modeling
15. Ensure data input is validated - encode user supplied data - don't click on unknown hyperlinks - implement restrictive web browser security zones are preventative measures against
stack and heap
XSS attacks
bytecode verifier
presentation
16. Attacks targeting buffer overflow and cross-site scripting attack this OSI layer
P2P
physical
application layer
P2P
17. Security zone options offered by Internet Explorer
heap
Internet - Local Intranet - Trusted Sites - Restricted Sites
cookie attacks
data link
18. Attackers sniff network traffic and capture a cookie download or gain access to a computer and view locally stored cookie
IM
stack
cookie hijacking
misconfigured mail server
19. Used by java to verify the code for a list of predetermined insecurities
open mail relay
bytecode verifier
common off the shelf
data link
20. Used by java and javascript to isolate executing code in a reserved area of memory to limit damage of malicious code
persistent cookie
ActiveX
drive by download
sandboxing
21. Type - length - format - range
security objective definition - application review - application decomposition - threat identification - vulnerability identification
input validation criteria
threat modeling
cookie leaking
22. Malicious code stored in a web application that is downloaded and executed without the user's knowledge
application review
session
Internet - Local Intranet - Trusted Sites - Restricted Sites
stored XSS
23. Protocols in this layer NNTP
session cookie
application
tracking cookie
buffer overflow
24. XSS stands for
cross-site scripting
persistent cookie
application gateways
sandboxing
25. A programming language - developed by Sun - used to make small applications (applets) for the Internet and stand alone programs
java
stack
application
bytecode verifier
26. OSI layer responsible for data representation and encryption (MIME
IM
presentation
transport
application
27. Deleted when the user closes their web browser - can contain authentication-related information
stored XSS
session cookie
presentation
IM
28. Each client is a peer and serves each other client on the network - requires client application and appropriate open network ports to operate
misconfigured mail server
peer to peer
application gateways
application layer
29. COTS stands for
address resolution protocol
P2P
persistent cookie
common off the shelf
30. OSI layer attributed with 75% of malicious attacks
open mail relay
session
application
data link
31. Scripting languages - developed by Microsoft to allow developers to extend and reuse web functionality
vbscript and jscript
application
stack
application
32. P2P stands for...
P2P
cross-site scripting
reflected XSS
peer to peer
33. OSI layer that provides interhost communication (Named Pipes
session
network
session cookie
buffer overflow
34. Area of the memory where dynamically allocated variables are stored
application
heap
session cookie
session - persistent - tracking
35. Can leave the sandbox and obtain access to client resources
security objective definition - application review - application decomposition - threat identification - vulnerability identification
javascript
digitally signed java control
P2P
36. OSI model layers
cross-site scripting
buffer overflow
network
Application - Presentation - Session - Transport - Network - Data Link - Physical
37. A method of code signing - allows developers to obtain digital certificate generated by a certificate authority and digitally sign ActiveX controls
authenticode
persistent cookie
security objective definition
transport
38. OSI layer responsible for network processes to application
common off the shelf
cross-site scripting
application
stack and heap
39. A named collection of Web sites that can be assigned a specific security level
ARP spoofing
application
data link
zones
40. Phase of threat modeling that reviews application ingress and egress data flow and trust boundaries
session
Application - Presentation - Session - Transport - Network - Data Link - Physical
security objective definition - application review - application decomposition - threat identification - vulnerability identification
application decomposition
41. Enable the cookie secure-bit setting - avoid using cookies to hold sensitive data - block third-party cookies will prevent ______
cookie attacks
peer to peer
drive by download
Internet - Local Intranet - Trusted Sites - Restricted Sites
42. Key functionality (how the application works) is identified and an application diagram developed in this phase of threat modeling
stack and heap
transport
application review
application
43. OSI layer responsible for path determination and logical addressing - routers operate at this layer
application gateways
persistent cookie
session
network
44. OSI layer that provides the means to transfer data between network entities and detect/correct errors that may occur in the physical layer
input validation
network
vulnerability identification
data link
45. A microsoft created technology that enables software applications to share and reuse software components - maybe used to access files on local system or system registry
data link
application
ActiveX
drive by download
46. Protocols used in this layer (ARP
cookie leaking
data link
digitally signed java control
session
47. Allow an attacker to intercept and modifiy data sent between two network devices - hijacking of network communications - attacks data link layer
ARP spoofing
persistent cookie
heap
physical
48. The application is reviewed and specific vulnerabilities are documented in this phase of threat modeling
vulnerability identification
zones
heap
stored XSS
49. IP address exposure - download of worm/viruses circumventing the firewall - no way to track improper communication - messages in clear text are risks associated with
session - persistent - tracking
security objective definition
P2P
IM
50. OSI layer that provides transparent transfer of data between end users
transport
security objective definition - application review - application decomposition - threat identification - vulnerability identification
bytecode verifier
sandboxing