Exam 8: Security of Web Applications

____ are collections of IP addresses of known spam sources on the Internet, and they can be easily integrated into most SMTP server configurations.

Describe the most common way a Web client can access Web servers.

Match each item with a statement below. a.Telnet f.CGI b.SNMP g.Perl c.NNTP h.PHP d.CSS i.CSRF e.XML -Allows users to connect a remote shell to run programs, view files, and perform a variety of other operations as if they were using the system locally.

In 2010, OWASP determined that ____ attacks were the top risk to Web applications.

Match each item with a statement below. a.Telnet f.CGI b.SNMP g.Perl c.NNTP h.PHP d.CSS i.CSRF e.XML -Standardizes the HTML formatting for an entire Web site by allowing developers to customize fonts, tables, and other page elements.

Match each item with a statement below. a.Telnet f.CGI b.SNMP g.Perl c.NNTP h.PHP d.CSS i.CSRF e.XML -An attack that exploits a Web site's trust or previous authentication of a user.

Match each item with a statement below. a.Telnet f.CGI b.SNMP g.Perl c.NNTP h.PHP d.CSS i.CSRF e.XML -An API (application programming interface) that allows external programs or scripts to interact with a Web server.

Which HTTP request method retrieves meta-information only from the resource signified in the URI?

Why are more and more organizations turning to encryption to make sure data is stored in a format that cannot be leaked if a system is compromised?

Why is insufficient transport layer protection considered to be a threat in Web applications?.

What is the "POP before SMTP" authentication method and how is it used to defend against improper use of an SMTP server?

When properly configured to afford anonymous users only very limited access, the FTP server works well.

Which HTTP response code indicates that an error has occurred on the client side?

Match each item with a statement below. a.Telnet f.CGI b.SNMP g.Perl c.NNTP h.PHP d.CSS i.CSRF e.XML -Developed specifically to allow developers to create dynamically generated HTML content.

A(n) ____ is designed to translate information sent from a particular agent or class of agents.

____________________ queries are initiated by clients to resolve a fully qualified domain name (FQDN)to its IP address.

Explain why cross-site scripting (XSS) vulnerabilities may be the least understood.

The Common Gateway Interface (CGI) is a programming language in and of itself.

DNS ____________________ consists of inserting incorrect translation information within the DNS server (or within the communication between the resolver and server) in order to take a legitimate domain name and point the resolver to a malicious server, thereby secretly subverting the session.

Match each item with a statement below. a.Telnet f.CGI b.SNMP g.Perl c.NNTP h.PHP d.CSS i.CSRF e.XML -Used to monitor the status and performance of network devices and systems.