Security Testing - Session 5 - Quiz

Veracode is a ............... security scanning application

• IaaS

• SaaS

• PaaS

Sandbox scans are generally performed by the Developers against the Application policy

• True

• False

Jamie, a network engineer has observed that an application used for testing is open to public internet. This traffic has to be blocked to avoid incidents. This false under ................. (access control)

• MAC

• DAC

• RUBAC

Sarah (a security) tester has observed that she is not allowed to delete a sandbox created in a Veracode application. This could be resolved by allowing her ........................... role for her user in Veracode.

• Administrator

• Sandbox user

• Sandbox Administrator

• Submitter

Which one of the following is NOT an acceptable risk level?

• Risk Avoidance

• Risk Acceptance

• Risk Transference

• Risk Rejection

1. What should you check to ensure a file upload feature is secure?

• File size limit

• File extension validation

• MIME type validation

• All of the above

What is the main purpose of multi-factor authentication (MFA)?

• To prevent physical theft of devices

• To verify the identity of a user using multiple credentials

• To encrypt data during transmission

• To block spam emails

What is a key method to secure WebSocket connections against eavesdropping?

• Using HTTPS for WebSocket handshake

• Use wss protocol

• Disabling WebSocket altogether

• Restricting WebSocket connections to internal network

How can attackers exploit SSRF vulnerabilities to access sensitive information?

• By improving server performance

• By manipulating the server to make requests to internal resources

• By enhancing data confidentiality

• By preventing unauthorized access

Which type of input is commonly targeted in SQL injection attacks?

• Numeric inputs

• Text inputs

• Checkbox inputs

• Hidden inputs