Question 1

The most common technique for using an appropriate synchronization mechanism to serialize the accesses to prevent errors is to acquire a _______ on the shared file,ensuring that each process has appropriate access in turn.
A)lock
B)code injection
C)chroot jail
D)privilege escalation

Accepted Answer

Acquiring a lock on the shared file is a common synchronization mechanism used to prevent errors caused by simultaneous access. This ensures that each process has appropriate access in turn, avoiding conflicts and data corruption. Code injection, chroot jail, and privilege escalation are not relevant to this context.

Question 2

A number of widely used standard C _________ compound the problem of buffer overflow by not providing any means of limiting the amount of data transferred to the space available in the buffer.

Accepted Answer

The answer of A number of widely used standard C...

Question 3

A _______ attack is where the input includes code that is then executed by the attacked system.
A)SQL injection
B)cross-site scripting
C)code injection
D)interpreter injection

Accepted Answer

A code injection attack is when an attacker inserts their own code into an application or system, which is then executed by the system. SQL injection and cross-site scripting attacks are both types of code injection attacks, but they target specific vulnerabilities in web applications rather than being generic attacks like code injection. Interpreter injection is not a common type of attack.

Question 4

__________ attacks are vulnerabilities involving the inclusion of script code in the HTML content of a Web page displayed by a user's browser.
A)PHP file inclusion
B)Mail injection
C)Code injection
D)Cross-site scripting

Accepted Answer

Cross-site scripting (XSS) is a vulnerability that allows an attacker to inject malicious code, usually in the form of a script, into a web page viewed by other users. This code is then executed within the victim’s browser, allowing the attacker to steal sensitive information or perform other malicious actions. PHP file inclusion, mail injection, and code injection are all different types of vulnerabilities.

Question 5

_________ attacks are most commonly seen in scripted Web applications.

Accepted Answer

The answer of _________ attacks are most commonly seen in...

Question 6

The process of transforming input data that involves replacing alternate,equivalent encodings by one common value is called _________.

Accepted Answer

The answer of The process of transforming input data that...

Question 7

"Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

Accepted Answer

The answer of "Failure to Preserve SQL Query Structure" is...

Question 8

A ________ is a pattern composed of a sequence of characters that describe allowable input variants.
A)canonicalization
B)race condition
C)regular expression
D)shell script

Accepted Answer

A regular expression is a pattern of characters that allows for the description of allowable input variants for text matching and manipulation. This can be useful in various applications such as search engines, text editors, and programming languages.

Question 9

A variant where the attacker includes malicious script content in data supplied to a site is the __________ vulnerability.

Accepted Answer

The answer of A variant where the attacker includes malicious...

Question 10

In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.

Accepted Answer

The answer of In the ________ attack the user supplied...

Question 11

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

Accepted Answer

The answer of Program _______ refers to any source of...

Question 12

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.
A)shell scripting
B)fuzzing
C)canonicalization
D)deadlocking

Accepted Answer

Fuzzing is a software testing technique that involves feeding unexpected, invalid, or random data inputs to a computer program in order to detect flaws, vulnerabilities, and crashes. This helps to determine whether the program or function can handle abnormal inputs and respond appropriately. This test is particularly useful for identifying security weaknesses in software applications.

Question 13

Blocking assignment of form field values to global variables is one of the defenses available to prevent a __________ attack.
A)PHP remote code injection
B)mail injection
C)command injection
D)SQL injection

Accepted Answer

The answer of Blocking assignment of form field values to...

Question 14

Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

Accepted Answer

The answer of Two key areas of concern for any...

Question 15

__________ programming is a form of design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of the software.

Accepted Answer

The answer of __________ programming is a form of design...

Question 16

Program input data may be broadly classified as textual or ______.

Accepted Answer

The answer of Program input data may be broadly classified...

Question 17

A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.
A)fuzzing
B)deadlock
C)memory injection
D)memory leak

Accepted Answer

A memory leak is a situation where allocated memory is not properly released, leading to a reduction in available memory over time until it is completely exhausted. Fuzzing is a technique used to discover vulnerabilities in software by sending unexpected input to the system. Deadlock is a situation where two or more processes are unable to continue executing because each is waiting for the other to finish. Memory injection is a technique used to overwrite existing memory with malicious code.

Question 18

_________ are a collection of string values inherited by each process from its parent that can affect the way a running process behaves.
A)Deadlocks
B)Privileges
C)Environment variables
D)Race conditions

Accepted Answer

Environment variables are a collection of string values inherited by each process from its parent that can affect the way a running process behaves. Deadlocks are situations where multiple threads or processes are waiting for one another to release the resources they need in order to continue executing, resulting in a standstill. Privileges refer to the level of access granted to a user or process, which can allow or restrict certain actions. Race conditions occur when two or more processes or threads access a shared resource simultaneously and the final outcome depends on the timing and order of their execution.

Question 19

The most common variant of injecting malicious script content into pages returned to users by the targeted sites is the _________ vulnerability.
A)XSS reflection
B)chroot jail
C)atomic bomb
D)PHP file inclusion

Accepted Answer

Cross-site scripting (XSS) is a type of vulnerability that allows an attacker to inject malicious script content into webpages viewed by other users. XSS can be either reflected or stored, but reflected XSS is the more common type. In a reflected XSS attack, the attacker includes malicious code in a parameter sent to the server, which is then included in the response sent back to the user, resulting in the execution of the attacker's code in the victim's browser.

Question 20

A _________ attack occurs when the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server.
A)command injection
B)SQL injection
C)code injection
D)PHP remote code injection

Accepted Answer

Command injection occurs when an attacker is able to inject commands into the input fields of a web application, which are then executed by the system with the privileges of the web server. This can result in the attacker gaining unauthorized access to sensitive information or taking control of the system. SQL injection and code injection are similar types of attacks, but they target specific vulnerabilities in database or code structures, respectively. PHP remote code injection is a specific type of code injection that targets vulnerabilities in PHP-based web applications.

Quiz 11: Software Security

The most common technique for using an appropriate synchronization mechanism to serialize the accesses to prevent errors is to acquire a _______ on the shared file,ensuring that each process has appropriate access in turn.

A number of widely used standard C _________ compound the problem of buffer overflow by not providing any means of limiting the amount of data transferred to the space available in the buffer.

A _______ attack is where the input includes code that is then executed by the attacked system.

__________ attacks are vulnerabilities involving the inclusion of script code in the HTML content of a Web page displayed by a user's browser.

_________ attacks are most commonly seen in scripted Web applications.

The process of transforming input data that involves replacing alternate,equivalent encodings by one common value is called _________.

"Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

A ________ is a pattern composed of a sequence of characters that describe allowable input variants.

A variant where the attacker includes malicious script content in data supplied to a site is the __________ vulnerability.

In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.

Blocking assignment of form field values to global variables is one of the defenses available to prevent a __________ attack.

Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

__________ programming is a form of design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of the software.

Program input data may be broadly classified as textual or ______.

A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.

_________ are a collection of string values inherited by each process from its parent that can affect the way a running process behaves.

The most common variant of injecting malicious script content into pages returned to users by the targeted sites is the _________ vulnerability.

A _________ attack occurs when the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server.