Question 1

There is a problem anticipating and testing for all potential types of
non-standard inputs that might be exploited by an attacker to subvert a program.

Accepted Answer

A) True 
 B)False

Question 2

"Incorrect Calculation of Buffer Size" is in the __________ software error category.

Accepted Answer

A) Porous Defenses 
B) Allocation of Resources 
C) Risky Resource Management 
D) Insecure Interaction Between Components 
A) Porous Defenses 
B) Allocation of Resources 
C) Risky Resource Management 
D) Insecure Interaction Between Components

Question 3

To prevent XSS attacks any user supplied input should be examined
and any dangerous code removed or escaped to block its execution.

Accepted Answer

A) True 
 B)False

Question 4

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.

Accepted Answer

A) shell scripting 
B) fuzzing 
C) canonicalization 
D) deadlocking 
A) shell scripting 
B) fuzzing 
C) canonicalization 
D) deadlocking

Question 5

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

Accepted Answer

The answer of Program _______ refers to any source of...

Question 6

A _________ attack occurs when the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server.

Accepted Answer

A) command injection 
B) SQL injection 
C) code injection 
D) PHP remote code injection 
A) command injection 
B) SQL injection 
C) code injection 
D) PHP remote code injection

Question 7

Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

Accepted Answer

The answer of Two key areas of concern for any...

Question 8

To counter XSS attacks a defensive programmer needs to explicitly
identify any assumptions as to the form of input and to verify that any
input data conform to those assumptions before any use of the data.

Accepted Answer

A) True 
 B)False

Question 9

_________ is a program flaw that occurs when program input data can accidentally or deliberately influence the flow of execution of the program.

Accepted Answer

A) PHP attack 
B) Format string injection attack 
C) XSS  attack 
D) Injection attack 
A) PHP attack 
B) Format string injection attack 
C) XSS  attack 
D) Injection attack

Question 10

UNIX related systems provide the chroot system function to limit a program's view of the file system to just one carefully configured section that is known as a ________.

Accepted Answer

The answer of UNIX related systems provide the chroot system...

Question 11

_________ attacks are most commonly seen in scripted Web applications.

Accepted Answer

Cross-site

Question 12

A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.

Accepted Answer

A) fuzzing 
B) deadlock 
C) memory injection 
D) memory leak 
A) fuzzing 
B) deadlock 
C) memory injection 
D) memory leak

Question 13

The principle of ________ strongly suggests that programs should execute with the least amount of privileges needed to complete their function.

Accepted Answer

The answer of The principle of ________ strongly suggests that...

Question 14

Defensive programming requires a changed mindset to traditional
programming practices.

Accepted Answer

A) True 
 B)False

Question 15

"Improper Access Control (Authorization)" is in the _________ software error category.

Accepted Answer

A) Porous Defenses 
B) Allocation of Resources 
C) Risky Resource Management 
D) Insecure Interaction Between Components 
A) Porous Defenses 
B) Allocation of Resources 
C) Risky Resource Management 
D) Insecure Interaction Between Components

Question 16

Defensive programming is sometimes referred to as _________.

Accepted Answer

A) variable programming 
B) secure programming 
C) interpretive programming 
D) chroot programming 
A) variable programming 
B) secure programming 
C) interpretive programming 
D) chroot programming

Question 17

Incorrect handling of program _______ is one of the most common failings in software security.

Accepted Answer

A) lines 
B) input 
C) output 
D) disciplines 
A) lines 
B) input 
C) output 
D) disciplines

Question 18

Key issues from a software security perspective are whether the
implemented algorithm correctly solves the specified problem,whether the machine instructions executed correctly represent the high level algorithm specification,and whether the manipulation of data values in variables is valid and meaningful.

Accepted Answer

A) True 
 B)False

Question 19

Many computer security vulnerabilities result from poor programming
practices.

Accepted Answer

A) True 
 B)False

Question 20

Software security is closely related to software quality and reliability.

Accepted Answer

A) True 
 B)False

Exam 11: Software Security

There is a problem anticipating and testing for all potential types of non-standard inputs that might be exploited by an attacker to subvert a program.

"Incorrect Calculation of Buffer Size" is in the __________ software error category.

To prevent XSS attacks any user supplied input should be examined and any dangerous code removed or escaped to block its execution.

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

A _________ attack occurs when the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server.

Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

To counter XSS attacks a defensive programmer needs to explicitly identify any assumptions as to the form of input and to verify that any input data conform to those assumptions before any use of the data.

_________ is a program flaw that occurs when program input data can accidentally or deliberately influence the flow of execution of the program.

UNIX related systems provide the chroot system function to limit a program's view of the file system to just one carefully configured section that is known as a ________.

_________ attacks are most commonly seen in scripted Web applications.

A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.

The principle of ________ strongly suggests that programs should execute with the least amount of privileges needed to complete their function.

Defensive programming requires a changed mindset to traditional programming practices.

"Improper Access Control (Authorization)" is in the _________ software error category.

Defensive programming is sometimes referred to as _________.

Incorrect handling of program _______ is one of the most common failings in software security.

Many computer security vulnerabilities result from poor programming practices.

Software security is closely related to software quality and reliability.

Computer Systems Overview

Cryptographic Tools

User Authentication

Access Control

Database and Cloud Security

Malicious Software

Denial-Of-Service Attacks

Intrusion Detection

Firewalls and Intrusion Prevention Systems

Buffer Overflow

Operating System Security

Trusted Computing and Multilevel Security

It Security Management and Risk Assessment

It Security Controls,plans,and Procedures

Physical and Infrastructure Security

Human Resources Security

Security Auditing

Legal and Ethical Aspects

Symmetric Encryption and Message Confidentiality

Public-Key Cryptography and Message Authentication

Internet Security Protocols and Standards

Internet Authentication Applications

Wireless Network Security

Filters