Question 1

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

Accepted Answer

The answer of Program _______ refers to any source of...

Question 2

Incorrect handling of program _______ is one of the most common failings in software security.

Accepted Answer

A) lines 
B) input 
C) output 
D) disciplines 
A) lines 
B) input 
C) output 
D) disciplines

Question 3

A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.

Accepted Answer

The answer of A ________ occurs when multiple processes and...

Question 4

Software security is closely related to software quality and reliability.

Accepted Answer

A) True 
 B)False

Question 5

A _______ attack is where the input includes code that is then executed by the attacked system.

Accepted Answer

A) SQL injection 
B) cross-site scripting 
C) code injection 
D) interpreter injection 
A) SQL injection 
B) cross-site scripting 
C) code injection 
D) interpreter injection

Question 6

Defensive programming is sometimes referred to as _________.

Accepted Answer

A) variable programming 
B) secure programming 
C) interpretive programming 
D) chroot programming 
A) variable programming 
B) secure programming 
C) interpretive programming 
D) chroot programming

Question 7

Cross-site scripting attacks attempt to bypass the browser's security
checks to gain elevated access privileges to sensitive data belonging to
another site.

Accepted Answer

A) True 
 B)False

Question 8

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.

Accepted Answer

A) shell scripting 
B) fuzzing 
C) canonicalization 
D) deadlocking 
A) shell scripting 
B) fuzzing 
C) canonicalization 
D) deadlocking

Question 9

_________ attacks are most commonly seen in scripted Web applications.

Accepted Answer

Cross-site

Question 10

"Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

Accepted Answer

Insecure I

Question 11

__________ programming is a form of design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of the software.

Accepted Answer

The answer of __________ programming is a form of design...

Question 12

An ASCII character can be encoded as a 1 to 4 byte sequence using
the UTF-8 encoding.

Accepted Answer

A) True 
 B)False

Question 13

"Improper Access Control (Authorization)" is in the _________ software error category.

Accepted Answer

A) Porous Defenses 
B) Allocation of Resources 
C) Risky Resource Management 
D) Insecure Interaction Between Components 
A) Porous Defenses 
B) Allocation of Resources 
C) Risky Resource Management 
D) Insecure Interaction Between Components

Question 14

The most common variant of injecting malicious script content into pages returned to users by the targeted sites is the _________ vulnerability.

Accepted Answer

A) XSS reflection 
B) chroot jail 
C) atomic bomb 
D) PHP file inclusion 
A) XSS reflection 
B) chroot jail 
C) atomic bomb 
D) PHP file inclusion

Question 15

Many computer security vulnerabilities result from poor programming
practices.

Accepted Answer

A) True 
 B)False

Question 16

_________ is a program flaw that occurs when program input data can accidentally or deliberately influence the flow of execution of the program.

Accepted Answer

A) PHP attack 
B) Format string injection attack 
C) XSS  attack 
D) Injection attack 
A) PHP attack 
B) Format string injection attack 
C) XSS  attack 
D) Injection attack

Question 17

Defensive programming requires a changed mindset to traditional
programming practices.

Accepted Answer

A) True 
 B)False

Question 18

If privileges are greater than those already available to the attacker the result is a _________.

Accepted Answer

privilege

Question 19

To prevent XSS attacks any user supplied input should be examined
and any dangerous code removed or escaped to block its execution.

Accepted Answer

A) True 
 B)False

Question 20

The most common technique for using an appropriate synchronization mechanism to serialize the accesses to prevent errors is to acquire a _______ on the shared file,ensuring that each process has appropriate access in turn.

Accepted Answer

A) lock 
B) code injection 
C) chroot jail 
D) privilege escalation 
A) lock 
B) code injection 
C) chroot jail 
D) privilege escalation

Exam 11: Software Security

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

Incorrect handling of program _______ is one of the most common failings in software security.

A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.

Software security is closely related to software quality and reliability.

A _______ attack is where the input includes code that is then executed by the attacked system.

Defensive programming is sometimes referred to as _________.

Cross-site scripting attacks attempt to bypass the browser's security checks to gain elevated access privileges to sensitive data belonging to another site.

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.

_________ attacks are most commonly seen in scripted Web applications.

"Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

__________ programming is a form of design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of the software.

An ASCII character can be encoded as a 1 to 4 byte sequence using the UTF-8 encoding.

"Improper Access Control (Authorization)" is in the _________ software error category.

The most common variant of injecting malicious script content into pages returned to users by the targeted sites is the _________ vulnerability.

Many computer security vulnerabilities result from poor programming practices.

_________ is a program flaw that occurs when program input data can accidentally or deliberately influence the flow of execution of the program.

Defensive programming requires a changed mindset to traditional programming practices.

If privileges are greater than those already available to the attacker the result is a _________.

To prevent XSS attacks any user supplied input should be examined and any dangerous code removed or escaped to block its execution.

The most common technique for using an appropriate synchronization mechanism to serialize the accesses to prevent errors is to acquire a _______ on the shared file,ensuring that each process has appropriate access in turn.

Computer Systems Overview

Cryptographic Tools

User Authentication

Access Control

Database Security

Malicious Software

Denial-Of-Service Attacks

Intrusion Detection

Firewalls and Intrusion Prevention Systems

Buffer Overflow

Operating System Security

Trusted Computing and Multilevel Security

It Security Management and Risk Assessment

It Security Controls, plans, and Procedures

Physical and Infrastructure Security

Human Resources Security

Security Auditing

Legal and Ethical Aspects

Symmetric Encryption and Message Confidentiality

Public-Key Cryptography and Message Authentication

Internet Security Protocols and Standards

Internet Authentication Applications

Wireless Network Security

Filters