Software Security Review

Client-server applications

A. are any apps that run on personal devices and need access to resources from a server.

B. are distributed resources across multiple apps or devices.

C. provide services such as data sharing and web pages.

D. include database, file, mail, print, web, and game servers

E. are also known as front-end and back-end applications.

• All options are correct

• B and E

• All options except D

• A, C, and D

The SQL query:

SELECT name, id FROM Employee;

will return

• the name and id columns, in that order.

• the Employee table

• the id and name columns , in that order.

• nothin because the SQL syntax is incorrect.

What happens during a SQLi attack?

A. A malicious actor uses SQL to get the database to reveal its contents.

B. Nothing happens as this is an old form of attack and no longer relevant because of newer cybersecurity protocols.

C. Malicious SQL statements are placed somewhere within a web page or application’s input or URL.

D. Hackers can gain access to sensitive data, such as PII, credit card information, and login credentials.

E. This is considered a low-level attack and not destructive on a large scale so typically the most an attacker can do is render web pages differently to an end user.

• All options are correct.

• B only

• D only

• A, C, and D

Some of the best ways to prevent or at least mitigate a SQLi attack are to

A. Keep data separate from commands and queries

B. Use a safe API

C. Reduce the amount of SQL used overall

D. Use server-side input validation

E. Use other SQL controls to prevent mass disclosure of records

F. Avoid leaving any raw SQL in the code

G. Have SQL reside behind multiple layers in the code base and not accessible by the site

• E, F, and G

• A, B, and D

• A, B, C, and D

• All options are correct

Using view page source allows you to quickly see the following:

A. The HTML that marks up the page

B. Images used and their location in a site folder

C. Fonts and icons

D. Stylesheets

E. Server-side scripts that bring in information from a database, such as search engines, forums, etc.

F. JavaScript within a <script> element

G. JavaScript outside of a <script> element

• All options are correct.

• A, B, C, and D.

• A, B, C, D, and F

• All except E

Developer tools can help with

A. Testing and debugging a site or web app.

B. Diagnosing problems quickly on a site or web app.

C. Building and maintaining a more secure site or web app.

D. Modifying site or web app elements and sending the changes back to the server.

E. Changing code in real-time to see how it impacts the site or web app on the fly.

• All except D.

• A, B, and C

• D only

• All options are correct

A database is always comprised of:

• personally identifying information

• tables with rows and columns

• lots of cryptographically stored symbols.

• lots of little databases.

In a database, columns and rows correspond to

• attributes and records.

• 1s and 0s

• tables and names

• SQL and HTML

Which term is used to describe the logical structure of a database?

• Table

• Record

• Schema

• Attribute

Which operator means “not equal to” in SQL?

• x=

• =!

• <>

• /=