Deck 11: Software Security

Question 1

_________ is a program flaw that occurs when program input data can accidentally or deliberately influence the flow of execution of the program.

A)PHP attack
B)Format string injection attack
C)XSS attack
D)Injection attack

Answer 1

D

Question 2

Security flaws occur as a consequence of sufficient checking and
validation of data and error codes in programs.

Answer 2

False

Question 3

Defensive programming is sometimes referred to as _________.

A)variable programming
B)secure programming
C)interpretive programming
D)chroot programming

Answer 3

B

Question 4

"Improper Access Control (Authorization)" is in the _________ software error category.

A)Porous Defenses
B)Allocation of Resources
C)Risky Resource Management
D)Insecure Interaction Between Components

Question 5

Software security is closely related to software quality and reliability.

Question 6

Incorrect handling of program _______ is one of the most common failings in software security.

A)lines
B)input
C)output
D)disciplines

Question 7

Defensive programming requires a changed mindset to traditional
programming practices.

Question 8

There is a problem anticipating and testing for all potential types of
non-standard inputs that might be exploited by an attacker to subvert a program.

Question 9

Injection attacks variants can occur whenever one program invokes the
services of another program,service,or function and passes to it
externally sourced,potentially untrusted information without sufficient
inspection and validation of it.

Question 10

To counter XSS attacks a defensive programmer needs to explicitly
identify any assumptions as to the form of input and to verify that any
input data conform to those assumptions before any use of the data.

Question 11

An ASCII character can be encoded as a 1 to 4 byte sequence using
the UTF-8 encoding.

Question 12

A difference between defensive programming and normal practices is
that everything is assumed.

Question 13

The correct implementation in the case of an atomic operation is to
test separately for the presence of the lockfile and to not always attempt to create it.

Question 14

"Incorrect Calculation of Buffer Size" is in the __________ software error category.

A)Porous Defenses
B)Allocation of Resources
C)Risky Resource Management
D)Insecure Interaction Between Components

Question 15

Programmers often make assumptions about the type of inputs a
program will receive.

Question 16

Cross-site scripting attacks attempt to bypass the browser's security
checks to gain elevated access privileges to sensitive data belonging to
another site.

Question 17

Many computer security vulnerabilities result from poor programming
practices.

Question 18

Without suitable synchronization of accesses it is possible that values
may be corrupted,or changes lost,due to over-lapping access,use, and replacement of shared values.

Question 19

Key issues from a software security perspective are whether the
implemented algorithm correctly solves the specified problem,whether the machine instructions executed correctly represent the high level algorithm specification,and whether the manipulation of data values in variables is valid and meaningful.

Question 20

To prevent XSS attacks any user supplied input should be examined
and any dangerous code removed or escaped to block its execution.

Question 21

The most common technique for using an appropriate synchronization mechanism to serialize the accesses to prevent errors is to acquire a _______ on the shared file,ensuring that each process has appropriate access in turn.

A)lock
B)code injection
C)chroot jail
D)privilege escalation

Question 22

A number of widely used standard C _________ compound the problem of buffer overflow by not providing any means of limiting the amount of data transferred to the space available in the buffer.

Question 23

A _______ attack is where the input includes code that is then executed by the attacked system.

A)SQL injection
B)cross-site scripting
C)code injection
D)interpreter injection

Question 24

__________ attacks are vulnerabilities involving the inclusion of script code in the HTML content of a Web page displayed by a user's browser.

A)PHP file inclusion
B)Mail injection
C)Code injection
D)Cross-site scripting

Question 25

_________ attacks are most commonly seen in scripted Web applications.

Question 26

The process of transforming input data that involves replacing alternate,equivalent encodings by one common value is called _________.

Question 27

"Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

Question 28

A ________ is a pattern composed of a sequence of characters that describe allowable input variants.

A)canonicalization
B)race condition
C)regular expression
D)shell script

Question 29

A variant where the attacker includes malicious script content in data supplied to a site is the __________ vulnerability.

Question 30

In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.

Question 31

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

Question 32

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.

A)shell scripting
B)fuzzing
C)canonicalization
D)deadlocking

Question 33

Blocking assignment of form field values to global variables is one of the defenses available to prevent a __________ attack.

A)PHP remote code injection
B)mail injection
C)command injection
D)SQL injection

Question 34

Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

Question 35

__________ programming is a form of design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of the software.

Question 36

Program input data may be broadly classified as textual or ______.

Question 37

A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.

A)fuzzing
B)deadlock
C)memory injection
D)memory leak

Question 38

_________ are a collection of string values inherited by each process from its parent that can affect the way a running process behaves.

A)Deadlocks
B)Privileges
C)Environment variables
D)Race conditions

Question 39

The most common variant of injecting malicious script content into pages returned to users by the targeted sites is the _________ vulnerability.

A)XSS reflection
B)chroot jail
C)atomic bomb
D)PHP file inclusion

Question 40

A _________ attack occurs when the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server.

A)command injection
B)SQL injection
C)code injection
D)PHP remote code injection

Question 41

If privileges are greater than those already available to the attacker the result is a _________.

Question 42

UNIX related systems provide the chroot system function to limit a program's view of the file system to just one carefully configured section that is known as a ________.

Question 43

The principle of ________ strongly suggests that programs should execute with the least amount of privileges needed to complete their function.

Question 44

A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.

Question 45

The major advantage of ________ is its simplicity and its freedom from assumptions about the expected input to any program,service,or function.