TestOut SecurityPro (8.2-8.5)

Which of the following information is typically not included in an access token?

• User security identifier

• Group memebership

• User rights

• User account password

Which of the following terms describes the component that is generated following authentication and is used to gain access to resources following login?

• Proxy

• Access token

• Account policy

• Cookie

Marcus White has just been promoted to a manager. To give him access to the files that he needs, you make his user account a member of the Managers group, which has access to a special shared folder.

Later that afternoon, Marcus tells you that he is still unable to access the files reserved for the Manager's group.

What should you do? (8.3)

• Add his user account to the ACL for the shared folder

• Have Marcus log off and log back in

• Manually refresh Group Policy settings on his computer

• Manually refresh Group Policy settings on the file server

(8.3) Which security mechanism uses a unique list that meets the following specifications?

• The list is embedded directly in the object itself
• The list defines which subjects have access to certain objects
• The list specifies the level or type of access allowed to certain objects

• Hasing

• Kerberos

• User ACL

• Mandatory access control

(8.4) You want to prevent your browser from running JavaScript commands that are potentially harmful. Which of the following would you restrict to accomplish this?

• ActiveX

• Server-side scripts

• CGI

• Client-side scripts

(8.4) A programmer that fails to check the length of input before processing leaves their code vulnerable to what form of common attack?

• Privilege escalation

• Session hijacking

• Buffer overflow

• Backdoor

(8.4) Which of the following is an attack that injects malicious scripts into web pages to redirect users to fake websites or gather personal information?

• Drive-by download

• SQL injection

• XSS

• DLL injection

(8.4) When you browse to a website, a pop-up window tells you that your computer has been infected with a virus. you click on the window to see what the problem is. Later, you find out that the window has installed spyware on your system.

What type of attack has occurred?

• Trojan horse

• DLL injection

• SQL injection

• Drive-by download

(8.4) Which of the following are subject to SQL injection attacks?

• ActiveX controls

• Database servers

• Web servers serving static content

• Browsers that allow client-side scripts

(8.4) Having poor software development practices and failing to program input validation checks during development of custom software can result in a system vulnerable to which type of attack?

• Denial of service

• Buffer overflow

• Superzapping

• Dictionary