For an application security program to be effective within an

organization, First is to

An organization has a website with a guest book feature, where visitors of the web site can put their names and comments.

A user received an invitation on his email to put his name and comment in the guest book. Once the web page was loads, a message box is prompted with the message ‘You have been P0wnd’ .

This is an example of This is the basis for the following type of attack?

A server's audit logs indicate that an employee who was terminated in the morning was still able to access certain sensitive resources on his system, on the internal network, that afternoon.

The logs indicate that the employee had logged on successfully before he was terminated but there is no record of him logging off before he was terminated.

This is an example of this type of attack?

The most effective defense method against a buffer overflow attack is

In which phase is the BEST to implement Security Software Development Life Cycle (SDLC) ?

Software Acquisition (SwA) major phases are

Technical evaluation of assurance that ensures security

requirements have been met is known as________

A security protection mechanism in which untrusted code, which is not digitally signed, is restricted from accessing system resources is known as?

A program that does not reproduce itself but pretends to be

performing a legitimate function, while performing a malicious operations in the background is the characteristic of which of the following?

Role-based access control to protect confidentiality of data in

databases can be achieved BEST by using ____

The two most dangerous types of attacks against databases

containing non-sensitive information are

A property that ensures only valid or legal transactions that do not violate any user-defined integrity constraints in DBMS technologies is +known as?

The capture below shows which type of attacks

*************************

GET /../../JPS/portal/LocaleSwitch.do?locale=en_MX&nRtY=<script>alert("XSS")</script>', HTTP/1.1

Accept-Language: en-us,en;q=0.5

Accept-Encoding: gzip,deflate

Host: 85.69.32.45

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

User-Agent: Opera/9.23 (Windows NT 5.0; U; en)

Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7

Connection: close

Pragma: no-cache

Cache-Control: no-cache,no-store

The capture below shows which type of attacks

*************************

GET /../../JPS/portal/LocaleSwitch.do?locale= SELECT table_name FROM information_schema.tables en_MX&nRtY=3403 WHERE 1=1 HTTP/1.1

Accept-Language: en-us,en;q=0.5

Accept-Encoding: gzip,deflate

Host: 58.69.24.86

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

User-Agent: Opera/9.23 (Windows NT 5.0; U; en)

Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7

Connection: close

Pragma: no-cache

Cache-Control: no-cache,no-store

This is example of

Good Software monitoring must be , Except

A software development methodology that does NOT rely on risk management Except

The property that guarantees the results of a transactions are invisible to other transactions until the transaction is complete

The BIGGEST concern while using Water Fall SDLC model is ___

DevOps adopts __________ SDLC

"Loose Coupling" is feature of implementing________ Architecture

Near Field Communication (NFC) is an example of ____

***A Company outsourced its customer service function to another company. As a result the outsourcing company will share its customer database with outsourcee company. As a security professional of the outsourcing company. What control you need to implement to detect if the outsourcee shared the information of the database with unauthorized third party ?

This an example of lack of _______________