Assignment 3
Application Security
True/False
1. Hypertext Transfer Protocol (HTTP) is the communications protocol between web browsers
and web servers. [ ]
True
2. Cookies are inherently harmless. [ ]
True
Modified True/False
3. Cookies are designed for websites to remember stateful information (e.g., items added in the cart
on Amazon.com. [ T / F , if F, then
]
True
Multiple Choice
4. In what type of attack does the attacker send unauthorized commands directly to a database?
a. XSS (cross-site scripting)
b. SQL injection
c. XSRF (cross-site request forgery)
d. Database dumping
Answer B
5. Looking at logs for an online web application, you see that someone has entered the following
phrase into several queries:
‘or ‘1’=‘1’-Which of the following is the MOST likely explanation for this?
a.
b.
c.
d.
Session hijacking
XSS (cross-site scripting)
SQL injection
Domain hijacking
1
Answer C
6. While creating a web application, a developer adds code to limit data provided by users. The
code prevents users from entering special characters. Which of the following attacks will this
code MOST likely prevent?
a.
b.
c.
d.
Answer C
Man-in-the-Middle
Phishing
XSS (cross-site scripting)
Domain hijacking
7. Jemar recently received an email thanking him for a purchase that he did not make. He asked an
administrator about it and the administrator noticed a pop-up window, which included the
following code:
<body onload=”document.getElementByID(‘myform’).submit()”>
<form id=”myForm”action=”gcgapremium.com/purchase.php”method=”post”
<input name=”Buy Now” value=”Buy Now”/>
</form>
</body>
Which of the following is the MOST likely explanation?
a. XSRF (cross-site request forgery)
b. Session hijacking
c. SQL injection
d. ARP spoofing
Answer A
8. Your organization hosts a web site and the web site accesses a database server in the internal
network. Database fields hosting customer data are encrypted and all data in transit between the
web site server and the database server are encrypted. Which of the following represents the
GREATEST risk to the data on the server?
a.
b.
c.
d.
Theft of the database server
HTML injection
SQL injection
Sniffing
2
Answer C
9. A code review of a web application discovered that the application is not performing properly.
What should the web developer add to this application to resolve this issue?
a.
b.
c.
d.
Answer C
XSRF
XSS
Input validation
Antivirus software
Completion
Cross-site scripting (XSS) attacks occur when an attacker embeds malicious scripts without
10. ____________________
permission in a third-party website that are later run by innocent visitors to that site.
Answer: Cross-site scripting (XSS)
Cross-site request forgery
11. ____________________
attacks leverage the fact that users are often logged into multiple sites
(XSRF / CSRF)
at the same time and use one site to trick the browser into sending malicious requests to another
site without the users’ knowledge.
Answer: Cross-site Request Forgery (XSRF or CSRF)
3
Cloud security
True/False
1. Cloud venders expose a set of software interface or APIs in which customers use to interact with
cloud services. [ ]
True
2. An Application Program Interface (API) refers to tools for creating software applications. [
True
]
3. To be secure interfaces and APIs, strong authentication and access controls are required with
encrypted transmission. [
]
True
Modified True/False
4. IaaS (Infrastructure as a Service) gives the customer access to applications running in the cloud.
[ T / F , if F, then
]
False, Software as a service
5. Session Hijacking is the process in which a user’s or organization’s cloud account credentials are
stolen and exploited by an unauthorized attacker. [ T / F , if F, then
]
False, Account hijacking
Multiple Choice
6. Of the following choices, which one is a cloud computing option model that the vendor
provides access to a computer, but customers must manage the system, including keeping it up
to data with current patches?
a.
b.
c.
d.
Answer C
Platform as a Service
Software as a Service
Infrastructure as a Service
Private
4
7. Malicious users inject malicious code or software in Adobe PDF and MS office and upload it to
the cloud service. Customers who download the Adobe PDF and the MS office will also execute
the malwares. Which of the following choices BEST describes this example?
a.
b.
c.
d.
Answer C
Account hijacking
Session hijacking
Nefarious use of cloud computing
SQL injection
8. To avoid the nefarious use of cloud computing, which of the following is the BEST safeguard?
a.
b.
c.
d.
Answer A
Rigorous registration process
Paid service
OAuth
Firewall
Completion
9. ____________________
enables a user to allow third-party application to access APIs on that
OAuth
user’s behalf; for example, when Facebook asks a user if a new application can have access to his
photos.
Answer: OAuth
5
Cryptocurrency Security
True/False
1. You must always use the same algorithm to encrypt information and decrypt the same
information. [ ]
False
2. Digital signatures require asymmetric key cryptography. [
]
3. In cryptocurrency security, the biggest vulnerability is stolen private keys. [
]
True
Multiple Choice
4. What type of function generates the unique value that corresponds to the contents of a message
and to create a digital signature?
a.
b.
c.
d.
Elliptic Curve
Decryption
Encryption
Hash
Hash
5. Alice would like to send a message to Bob using a digital signature. What cryptographic key does
to create the digital signature?
a.
b.
c.
d.
Alice’s Public Key
Alice’s Private Key
Bob’s public key
Bob’s private key
6. Bob received a message from Alice that contain a digital signature. What cryptographic key does
to verify the digital signature?
a.
b.
c.
d.
Alice’s public key
Alice’s private key
Bob’s public key
Bob’s private key
Alice’s public key
7. Betty receives a cipher text message from her college Tim. What type of function does Betty
need to read the plaintext message?
a.
b.
c.
d.
Encryption
Hashing
Decryption
Validation
Decryption
8. Alice would like to send a message to Bob securely and wishes to encrypt the contents of the
message key does she use to encrypt this message?
a.
b.
c.
d.
Alice’s public key
Alice’s private key
Bob’s public key
Bob’s private key
Bob’s public key
9. Which of the following is popularly used for storing bitcoins?
a.
b.
c.
d.
Pocket
Box
Stack
Wallet
Wallet
Privacy & Compliance
Multiple Choice
1. What type of organizations are required to comply with the Sarbanes-Oxley (SOX) Act?
a.
b.
c.
d.
Non-profit organizations
Publicly traded companies
Government agencies
Private held companies
Publicly traded companies
2. Under the Health Insurance Portability and Accountability Act (HIPAA) Security Rule, What
type of safeguards must be implemented by all covered entities, regardless of the circumstances?
a.
b.
c.
d.
Addressable
Standard
Security
Required
Required
3. Vincent recently went to work for a hospital systems. He is reading about various regulations
that apply to his industry. What law applies specifically to health records?
a.
b.
c.
d.
Sarbanes-Oxley (SOX) Act
Payment Card Industry Data security Standard (PCI DSS)
Gramm-Leach-Bliley Act (GLBA)
Health Insurance Portability Act (HIPAA)
Health Insurance Portability Act (HIPAA)
4. ________ specifies methods to create and sustain security controls and procedures and conduct
a yearly audit to corporate fraud and protect investors.
a.
b.
c.
d.
SOX
PCI DSS
PII
HIPAA
SOX
5. ________ is legislation that governs data privacy and security practices that safeguard patient
medical information U.S. medical facilities, along with reporting any breach activity.
a.
b.
c.
d.
HIPAA
SOX
COBIT
PCI DSS
HIPAA
6. ________ security controls include rigorous requirements to protect cardholder data, such as
ensure strong access monitor and test networks and minimize vulnerabilities.
a.
b.
c.
d.
HIPAA
SOX
PCI DSS
PII
PCI DSS
7. Which response most accurately describes PCI DSS compliance?
a. The organization can guarantee that credit card data will never be lost
b. The organization has followed the rules set forth in the Payment Card Industry Data
Security Standards, and can offer proof in the form of documentation
c. The organization is not liable if credit card data is lost or stolen
d. The organization does not store PAN or CVV data under any circumstances
The organization has followed the rules set forth in the Payment Card Industry Data
Security Standards, and can offer proof in the form of documentation