Application Security I

Which of the following scenarios is most likely to cause an injection attack?

• A Web application does not validate a client’s access to a resource.

• Unvalidated input can be distinguished from valid instructions.

• Unvalidated input is embedded in an instruction stream.

• A Web action performs an operation on behalf of the user without checking a shared secret.

You should set a secure flag in a cookie to ensure that:

• The cookie is a persistent cookie.

• The cookie is not available to client script.

• The cookie is sent over an encrypted channel.

• The cookie is deleted when the user closes the browser.

Which character is most likely to be used for an SQL injection attack?

• Null

• Less than sign(<)

• Greater than sign(>)

• Single quote (')

Which of the following attacks occurs when a malicious user convinces a victim to send a request to a server with malicious input and the server echoes the input back to client?

• Reflected XSS

• Persistent XSS

• Insecure direct object references

• Failure to restrict URL access

Which of the following is the best way to protect against injection attacks?

• Input validation using an allow list

• SQL queries based on user input

• Memory size checks

• Validate integer values before referencing arrays

Which of the following input sources can be directly controlled by a malicious user?

• Server configuration files

• GET/POST parameters

• Network ports

• Server code

You have not yet applied some recent service packs and updates to your Web application. Which of the following threats is your Web server susceptible to?

• Injection

• Security misconfiguration

• Insecure cryptographic storage

• Cross-site request forgery

Which of the following actions should you take to test the security of your Web application?

• Use policy mechanisms.

• Use a simple and positive model at every layer.

• Set the secure flag on session ID cookies.

• Use your browser to create unauthorized requests.

Which of the following should you use to protect the connections between the physical tiers of your application?

• EFS

• SSL

• SCP

• Kerberos

Which of the following is an injection attack?

• Cross-site scripting

• Cross-site request forgery

• Insecure direct object references

• Broken authentication and session management