Exam 11: Software Security

A difference between defensive programming and normal practices isthat everything is assumed.

"Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

Injection attacks variants can occur whenever one program invokes theservices of another program, service, or function and passes to itexternally sourced, potentially untrusted information without sufficientinspection and validation of it.

__________ attacks are vulnerabilities involving the inclusion of script code in the HTML content of a Web page displayed by a user's browser.

A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.

The most common variant of injecting malicious script content into pages returned to users by the targeted sites is the _________ vulnerability.

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

The major advantage of ________ is its simplicity and its freedom from assumptions about the expected input to any program, service, or function.

In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.

Blocking assignment of form field values to global variables is one of the defenses available to prevent a __________ attack.

Many computer security vulnerabilities result from poor programmingpractices.

A variant where the attacker includes malicious script content in data supplied to a site is the __________ vulnerability.

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.

Software security is closely related to software quality and reliability.

Security flaws occur as a consequence of sufficient checking andvalidation of data and error codes in programs.

To counter XSS attacks a defensive programmer needs to explicitlyidentify any assumptions as to the form of input and to verify that anyinput data conform to those assumptions before any use of the data.

A _________ attack occurs when the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server.

Without suitable synchronization of accesses it is possible that valuesmay be corrupted, or changes lost, due to over-lapping access, use, and replacement of shared values.

The correct implementation in the case of an atomic operation is totest separately for the presence of the lockfile and to not always attempt to create it.

Defensive programming requires a changed mindset to traditionalprogramming practices.