SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Domain4 Application Security
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. More data is put into a buffer than it was designed to hold - can be caused deliberately by hackers to run malicious code
heap
buffer overflow
network
XSS attacks
2. Area of the memory where dynamically allocated variables are stored
packet sniffer
heap
ActiveX
persistent cookie
3. Attack that occurs when a user navigates to a web site and hostile content is automatically downloaded and executed
ARP spoofing
drive by download
stack
network
4. A microsoft created technology that enables software applications to share and reuse software components - maybe used to access files on local system or system registry
address resolution protocol
ActiveX
bytecode verifier
application decomposition
5. ARP stands for...
input validation
application gateways
address resolution protocol
sandboxing
6. Security zone options offered by Internet Explorer
data link
Internet - Local Intranet - Trusted Sites - Restricted Sites
presentation
common off the shelf
7. An attack that occurs when malicious code is injected into a web site - where it is downloaded and executed by other users
misconfigured mail server
reflected XSS
XSS
packet sniffer
8. Used to record user's web activity - may be downloaded in the background
tracking cookie
XSS
authenticode
reflected XSS
9. Process to identify and assess a system's security risks
threat modeling
presentation
application decomposition
sandboxing
10. Threats to defined security objects are identified using knowledge gained during application decomposition in this phase of threat modeling
physical
threat identification
transport
stack
11. Used by java to verify the code for a list of predetermined insecurities
application
bytecode verifier
cookie poisoning
session
12. Can filter out most buffer overflow attacks
input validation criteria
application gateways
presentation
zones
13. OSI layer attributed with 75% of malicious attacks
stored XSS
ActiveX
application
Internet - Local Intranet - Trusted Sites - Restricted Sites
14. Can leave the sandbox and obtain access to client resources
open mail relay
digitally signed java control
peer to peer
misconfigured mail server
15. OSI layer responsible for path determination and logical addressing - routers operate at this layer
network
vulnerability identification
presentation
ActiveX
16. A method of code signing - allows developers to obtain digital certificate generated by a certificate authority and digitally sign ActiveX controls
authenticode
cookie hijacking
persistent cookie
session - persistent - tracking
17. Used by java and javascript to isolate executing code in a reserved area of memory to limit damage of malicious code
peer to peer
sandboxing
cookies
input validation criteria
18. Protocols used in this layer - IP
P2P
input validation criteria
network
packet sniffer
19. Phases of threat modeling
javascript
transport
security objective definition - application review - application decomposition - threat identification - vulnerability identification
Application - Presentation - Session - Transport - Network - Data Link - Physical
20. Sensitive information stored within a cookie that is obtained by unauthorized users
stack
cookie leaking
buffer overflow
bytecode verifier
21. Two types of buffer overflows
cross-site scripting
stack and heap
common off the shelf
session - persistent - tracking
22. A programming language - developed by Sun - used to make small applications (applets) for the Internet and stand alone programs
threat identification
java
peer to peer
presentation
23. Malicious code stored in a web application that is downloaded and executed without the user's knowledge
address resolution protocol
stored XSS
data link
cookie attacks
24. Server misused to forward spam - DoS conditions - damage to brand - blacklist on spam sites are risks associated with
session
transport
open mail relay
bytecode verifier
25. Have a timeout value - are not deleted when the user closes their web brower - used to store user preferences and information about the use connection
heap
cookies
authenticode
persistent cookie
26. This layer formats and encrypts data to be sent across a network - providing freedom from compatibility problems - sometimes called the syntax layer
data link
security objective definition
presentation
network
27. The application is reviewed and specific vulnerabilities are documented in this phase of threat modeling
security objective definition
IM
bytecode verifier
vulnerability identification
28. Each client is a peer and serves each other client on the network - requires client application and appropriate open network ports to operate
common off the shelf
peer to peer
zones
P2P
29. Key functionality (how the application works) is identified and an application diagram developed in this phase of threat modeling
misconfigured mail server
Application - Presentation - Session - Transport - Network - Data Link - Physical
application review
common off the shelf
30. A scripting language - developed by Netscape to perform client-side web development
transport
security objective definition - application review - application decomposition - threat identification - vulnerability identification
javascript
physical
31. Area of the memory where function calls are stored
address resolution protocol
threat modeling
stack
drive by download
32. Categories of XSS
digitally signed java control
ARP spoofing
reflected and stored
zones
33. Scripting languages - developed by Microsoft to allow developers to extend and reuse web functionality
drive by download
java
misconfigured mail server
vbscript and jscript
34. COTS stands for
common off the shelf
session
transport
P2P
35. Phase of threat modeling that reviews application ingress and egress data flow and trust boundaries
data link
application decomposition
network
packet sniffer
36. Three main cookie types
bytecode verifier
persistent cookie
stack
session - persistent - tracking
37. Enable the cookie secure-bit setting - avoid using cookies to hold sensitive data - block third-party cookies will prevent ______
threat identification
IM
stored XSS
cookie attacks
38. Protocols used in this layer (ARP
common off the shelf
data link
zones
security objective definition - application review - application decomposition - threat identification - vulnerability identification
39. Deleted when the user closes their web browser - can contain authentication-related information
cookie poisoning
data link
session cookie
application
40. Attacks targeting buffer overflow and cross-site scripting attack this OSI layer
application layer
session cookie
cross-site scripting
Application - Presentation - Session - Transport - Network - Data Link - Physical
41. Target for trojans and viruses - used to transfer stolen/pirated data - unintentional disclosure of data are risks associated with
common off the shelf
network
P2P
presentation
42. OSI layer that establishes - manages and terminates the connections between the local and remote application
session
common off the shelf
input validation
ARP spoofing
43. Attackers sniff network traffic and capture a cookie download or gain access to a computer and view locally stored cookie
common off the shelf
stored XSS
drive by download
cookie hijacking
44. The unauthorized modification of the data stored within a cookie
persistent cookie
cookie poisoning
input validation criteria
buffer overflow
45. Ensure data input is validated - encode user supplied data - don't click on unknown hyperlinks - implement restrictive web browser security zones are preventative measures against
peer to peer
cross-site scripting
drive by download
XSS attacks
46. OSI layer responsible for data representation and encryption (MIME
ActiveX
digitally signed java control
misconfigured mail server
presentation
47. Number one safeguard against buffer overflow - XSS - data injection - and DoS attacks
cookie poisoning
input validation
reflected and stored
session
48. OSI layer responsible for end-to-end connections and reliability (i.e. TCP
Application - Presentation - Session - Transport - Network - Data Link - Physical
peer to peer
stored XSS
transport
49. Enticing a user to execute malicious code stored on a web server (i.e. via hyperlink in an email)
zones
reflected XSS
bytecode verifier
application decomposition
50. OSI model layers
Application - Presentation - Session - Transport - Network - Data Link - Physical
persistent cookie
stored XSS
application review