ASF quiz

Q1: Why do we perform security testing of our systems?

• To increase the complexity of Software Development Lifecycle

• To reduce the risk of attacks and data breaches

• Public information that bank performs security testing will scare away potential hackers

• To identify teams that create software with the worst quality

Q2: ASF does NOT stand for what?

• African Swine Flu

• Application Security Framework

• Affirmation Security Field

Q3: Which of the following is NOT a type of security testing?

• Black-box testing

• Grey-box testing

• Red-box tester

• White-box tester

Q4: What is OWASP Top 10?

• List of 10 most common web application vulnerabilities

• List of 10 recent web applications hacks that made it to the news

• List of 10 most critical security risks to web applications

• List of most basic web application vulnerabilities

Q5: Why pentesters use <script>alert(1)</script> phrase while looking for Cross-Site Scripting vulnerabilities?

• JavaScript alert(1) function allows execution of code on the server side

• JavaScript alert(1) function allows exfiltration of victim’s cookies to the attacker

• JavaScript alert(1) function is not a destructive as other JavaScript functions, such as console.log() or confirm()

• JavaScript alert(1) function is a proof that JavaScript was executed in the context of a web page

Q6: What type of vulnerability is presented below?

• SQL injection

• Command injection

• Server-Side Request Forgery

• Cross-Site Scripting

Q7: What type of vulnerabilities is static code analysis NOT suitable for?

• Insecure coding

• Implementation bugs

• Design flaws

Q8: Static code analysis security testing covers which scope?

• Black-box testing

• Grey-box testing

• Red-box testing

• White-box testing