SUBJECTS
|
BROWSE
|
CAREER CENTER
|
POPULAR
|
JOIN
|
LOGIN
Business Skills
|
Soft Skills
|
Basic Literacy
|
Certifications
About
|
Help
|
Privacy
|
Terms
|
Email
Search
Test your basic knowledge |
Comptia Security +: Domain4 Application Security
Start Test
Study First
Subjects
:
certifications
,
comptia-security-+
,
it-skills
Instructions:
Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can
study here
.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.
This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.
1. XSS stands for
cross-site scripting
sandboxing
transport
tracking cookie
2. Key functionality (how the application works) is identified and an application diagram developed in this phase of threat modeling
XSS attacks
peer to peer
application review
input validation criteria
3. Attack that occurs when a user navigates to a web site and hostile content is automatically downloaded and executed
transport
Internet - Local Intranet - Trusted Sites - Restricted Sites
java
drive by download
4. OSI layer that establishes - manages and terminates the connections between the local and remote application
session
cookie hijacking
misconfigured mail server
network
5. Malicious code stored in a web application that is downloaded and executed without the user's knowledge
zones
security objective definition
stored XSS
digitally signed java control
6. Enticing a user to execute malicious code stored on a web server (i.e. via hyperlink in an email)
open mail relay
reflected XSS
physical
network
7. Sensitive information stored within a cookie that is obtained by unauthorized users
security objective definition - application review - application decomposition - threat identification - vulnerability identification
cookie leaking
java
common off the shelf
8. The application is reviewed and specific vulnerabilities are documented in this phase of threat modeling
network
IM
session
vulnerability identification
9. Ensure data input is validated - encode user supplied data - don't click on unknown hyperlinks - implement restrictive web browser security zones are preventative measures against
XSS attacks
threat modeling
application layer
Internet - Local Intranet - Trusted Sites - Restricted Sites
10. OSI layer responsible for data representation and encryption (MIME
data link
application
presentation
physical
11. OSI layer responsible for network processes to application
application
cookie leaking
javascript
network
12. OSI layer responsible for path determination and logical addressing - routers operate at this layer
network
open mail relay
P2P
misconfigured mail server
13. Protocols in this layer NNTP
application
Application - Presentation - Session - Transport - Network - Data Link - Physical
physical
digitally signed java control
14. A named collection of Web sites that can be assigned a specific security level
common off the shelf
transport
zones
packet sniffer
15. Server misused to forward spam - DoS conditions - damage to brand - blacklist on spam sites are risks associated with
data link
presentation
ActiveX
open mail relay
16. P2P stands for...
P2P
vbscript and jscript
physical
peer to peer
17. IP address exposure - download of worm/viruses circumventing the firewall - no way to track improper communication - messages in clear text are risks associated with
cookie hijacking
peer to peer
stack and heap
IM
18. OSI layer that provides transparent transfer of data between end users
security objective definition
session - persistent - tracking
transport
application review
19. OSI layer attributed with 75% of malicious attacks
peer to peer
persistent cookie
application
cookie attacks
20. Small text files downloaded and stored on a user's computer that contain information about the user's session and preferences
application
cookies
application
XSS attacks
21. Protocols used in this layer (ARP
XSS
transport
data link
transport
22. Each client is a peer and serves each other client on the network - requires client application and appropriate open network ports to operate
peer to peer
cookie attacks
open mail relay
bytecode verifier
23. OSI layer 2 - verify the connection between two devices is intact (i.e. physical addressing)
data link
ARP spoofing
application gateways
physical
24. Used to record user's web activity - may be downloaded in the background
P2P
tracking cookie
misconfigured mail server
open mail relay
25. Used by java and javascript to isolate executing code in a reserved area of memory to limit damage of malicious code
common off the shelf
cookie hijacking
sandboxing
security objective definition - application review - application decomposition - threat identification - vulnerability identification
26. OSI layer that provides interhost communication (Named Pipes
session
open mail relay
common off the shelf
security objective definition
27. Attackers sniff network traffic and capture a cookie download or gain access to a computer and view locally stored cookie
data link
misconfigured mail server
ActiveX
cookie hijacking
28. OSI layer defines the electrical / physical device specs (media - signal - and binary transmission). This includes the layout of pins - voltages - cable specifications - hubs - network adapters - host bus adapters and more.
input validation criteria
vbscript and jscript
IM
physical
29. More data is put into a buffer than it was designed to hold - can be caused deliberately by hackers to run malicious code
buffer overflow
stack
physical
application
30. Process to identify and assess a system's security risks
authenticode
digitally signed java control
threat modeling
XSS
31. Can leave the sandbox and obtain access to client resources
digitally signed java control
ActiveX
application review
transport
32. Security zone options offered by Internet Explorer
session - persistent - tracking
cookie poisoning
authenticode
Internet - Local Intranet - Trusted Sites - Restricted Sites
33. OSI layer that relates to the physical connection of two devices (i.e. RS-232
cookies
application gateways
physical
presentation
34. ARP stands for...
stack
reflected and stored
address resolution protocol
application decomposition
35. This layer formats and encrypts data to be sent across a network - providing freedom from compatibility problems - sometimes called the syntax layer
vbscript and jscript
packet sniffer
presentation
buffer overflow
36. Phase of threat modeling that reviews application ingress and egress data flow and trust boundaries
application decomposition
input validation
threat identification
cookies
37. Threats to defined security objects are identified using knowledge gained during application decomposition in this phase of threat modeling
ARP spoofing
cookie hijacking
reflected XSS
threat identification
38. Security objectives placed on an application are identified - controlling the scope of the threat modeling process
XSS attacks
transport
security objective definition
bytecode verifier
39. Three main cookie types
application review
Internet - Local Intranet - Trusted Sites - Restricted Sites
session - persistent - tracking
bytecode verifier
40. OSI model layers
cookie attacks
session
Application - Presentation - Session - Transport - Network - Data Link - Physical
stack and heap
41. Phases of threat modeling
Internet - Local Intranet - Trusted Sites - Restricted Sites
cookies
security objective definition - application review - application decomposition - threat identification - vulnerability identification
javascript
42. An attack that occurs when malicious code is injected into a web site - where it is downloaded and executed by other users
bytecode verifier
application
heap
XSS
43. A microsoft created technology that enables software applications to share and reuse software components - maybe used to access files on local system or system registry
IM
application gateways
ActiveX
session - persistent - tracking
44. Tools used to capture packets of data off a network and allow viewing of contents
packet sniffer
session
heap
threat identification
45. A scripting language - developed by Netscape to perform client-side web development
security objective definition - application review - application decomposition - threat identification - vulnerability identification
P2P
cookie hijacking
javascript
46. Scripting languages - developed by Microsoft to allow developers to extend and reuse web functionality
address resolution protocol
vbscript and jscript
security objective definition - application review - application decomposition - threat identification - vulnerability identification
application gateways
47. Cause of open SMTP relays
cross-site scripting
ActiveX
misconfigured mail server
ARP spoofing
48. Two types of buffer overflows
security objective definition
cookie poisoning
physical
stack and heap
49. Allow an attacker to intercept and modifiy data sent between two network devices - hijacking of network communications - attacks data link layer
session
common off the shelf
ARP spoofing
stack and heap
50. Number one safeguard against buffer overflow - XSS - data injection - and DoS attacks
common off the shelf
application gateways
input validation
stack