Desarrollo Seguro 2019

In which of the following scenarios should you use the escaping technique?

• When you need to validate any input as valid input

• When user input is echoed back to the user in HTML

• When you are trying to protect against regular expression injection

• When you need to tell the interpreter that input is code

Which of the following is most likely to result from unvalidated redirects and forwards?

• Brute force attack

• Network sniffing

• Man-in-the-middle attack

• Bypassed authorization checks

Which of the following should you use to protect the connections between the physical tiers of your application?

• EFS

• SSL

• HTTP

• Kerberos

Which of the following combines public-key cryptography with a cryptographic hash?

• Nonce

• Digital Signature

• SSL

• Salt

Which of the following mistakes is most often associated with a security misconfiguration threat?

• Cross-site request forgery

• Failure to disable default accounts

• Bad cryptography

• Unsafe key storage

Which of the following is an authentication system mandatory requirement?

• Form variables are used for managing session IDs.

• Use a GOTCHA to prevent automated attacks.

• User logout and session inactivity controls.

• Session IDs are only accepted from cookies and parameter variables.

Which of the following is the best way to ensure that JavaScript cannot be used to access a cookie?

• Set the secure flag in the cookie

• Set the HttpOnly flag in the cookie

• Use the CAPTCHA system

• Use non-persistent cookies

Which of the following consequences are most likely to occur due to an injection attack? (Choose Two.)

• Spoofing

• Data loss

• Denial of service

• Insecure direct object references

Which of the following actions should you take before implementing a custom authentication and session management system? (Choose two.)

• Find out if a suitable framework component already exists.

• Find out if you can use a small extension to an existing component to implement the system.

• Find out if form variables are available to store data.

• Find out if you need to use session-based indirection.