Question 1

A number of widely used standard C _________ compound the problem of buffer overflow by not providing any means of limiting the amount of data transferred to the space available in the buffer.

Accepted Answer

The answer of A number of widely used standard C...

Question 2

__________ programming is a form of design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of the software.

Accepted Answer

The answer of __________ programming is a form of design...

Question 3

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.
A)shell scripting
B)fuzzing
C)canonicalization
D)deadlocking

Accepted Answer

Fuzzing is a testing technique in which a large amount of random input data, or "fuzz," is sent to a program or function to see how it handles unexpected or abnormal inputs. The goal is to identify any vulnerabilities or weaknesses in the program's handling of such inputs. The other options (shell scripting, canonicalization, and deadlocking) are not directly related to this type of testing.

Question 4

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

Accepted Answer

The answer of Program _______ refers to any source of...

Question 5

Blocking assignment of form field values to global variables is one of the defenses available to prevent a __________ attack.
A)PHP remote code injection
B)mail injection
C)command injection
D)SQL injection

Accepted Answer

The answer of Blocking assignment of form field values to...

Question 6

A ________ is a pattern composed of a sequence of characters that describe allowable input variants.
A)canonicalization
B)race condition
C)regular expression
D)shell script

Accepted Answer

A regular expression is a pattern composed of a sequence of characters that describe allowable input variants. Regular expressions are commonly used for tasks such as pattern matching and string searching. Options A, B, and D are not relevant to the definition of a regular expression.

Question 7

The most common technique for using an appropriate synchronization mechanism to serialize the accesses to prevent errors is to acquire a _______ on the shared file,ensuring that each process has appropriate access in turn.
A)lock
B)code injection
C)chroot jail
D)privilege escalation

Accepted Answer

The most common and appropriate synchronization mechanism to prevent errors while accessing a shared file is acquiring a lock on the file. This ensures that each process has appropriate access in turn and prevents multiple processes from accessing the file simultaneously, which can lead to errors and corruption of data. Code injection, chroot jail, and privilege escalation are not relevant in this context.

Question 8

A variant where the attacker includes malicious script content in data supplied to a site is the __________ vulnerability.

Accepted Answer

The answer of A variant where the attacker includes malicious...

Question 9

The major advantage of ________ is its simplicity and its freedom from assumptions about the expected input to any program,service,or function.

Accepted Answer

The answer of The major advantage of ________ is its...

Question 10

In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.

Accepted Answer

The answer of In the ________ attack the user supplied...

Question 11

_________ are a collection of string values inherited by each process from its parent that can affect the way a running process behaves.
A)Deadlocks
B)Privileges
C)Environment variables
D)Race conditions

Accepted Answer

Environment variables are a collection of string values inherited by each process from its parent that can affect the way a running process behaves. Deadlocks, privileges, and race conditions are unrelated concepts in operating systems.

Question 12

"Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

Accepted Answer

The answer of "Failure to Preserve SQL Query Structure" is...

Question 13

Program input data may be broadly classified as textual or ______.

Accepted Answer

The answer of Program input data may be broadly classified...

Question 14

A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.

Accepted Answer

The answer of A ________ occurs when multiple processes and...

Question 15

The process of transforming input data that involves replacing alternate,equivalent encodings by one common value is called _________.

Accepted Answer

The answer of The process of transforming input data that...

Question 16

Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

Accepted Answer

The answer of Two key areas of concern for any...

Question 17

A _______ attack is where the input includes code that is then executed by the attacked system.
A)SQL injection
B)cross-site scripting
C)code injection
D)interpreter injection

Accepted Answer

Code injection attacks involve injecting malicious code or commands into a system to manipulate its behavior. SQL injection and cross-site scripting attacks are specific types of code injection attacks, but not all code injection attacks are SQL injection or cross-site scripting attacks. Interpreter injection is not a known term in security attacks, making it an invalid option.

Question 18

A _________ attack occurs when the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server.
A)command injection
B)SQL injection
C)code injection
D)PHP remote code injection

Accepted Answer

The given scenario is the definition of a command injection attack, where an attacker injects malicious code into an input field that is later used as a command to be executed by the server with the associated privileges. SQL injection attacks and code injection attacks focus on manipulating and injecting code into databases or applications, whereas PHP remote code injection is a specific type of code injection targeting PHP scripts.

Question 19

A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.
A)fuzzing
B)deadlock
C)memory injection
D)memory leak

Accepted Answer

A memory leak is a gradual reduction in available memory that eventually leads to the exhaustion of heap memory. This often happens due to a program not releasing memory after it's no longer needed, causing a buildup of unused memory over time. Fuzzing is a technique used to test software for vulnerabilities by providing unexpected or random inputs. Deadlock is a situation where two or more processes are unable to proceed due to each waiting for the other to release a resource. Memory injection is a technique used to modify the behavior of a program by injecting code into its memory space. None of these options fully fit the description of a gradual reduction in memory until it's exhausted except for a memory leak.

Question 20

_________ attacks are most commonly seen in scripted Web applications.

Accepted Answer

The answer of _________ attacks are most commonly seen in...

Quiz 11: Software Security

A number of widely used standard C _________ compound the problem of buffer overflow by not providing any means of limiting the amount of data transferred to the space available in the buffer.

__________ programming is a form of design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of the software.

The intent of ________ is to determine whether the program or function correctly handles all abnormal inputs or whether it crashes or otherwise fails to respond appropriately.

Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

Blocking assignment of form field values to global variables is one of the defenses available to prevent a __________ attack.

A ________ is a pattern composed of a sequence of characters that describe allowable input variants.

The most common technique for using an appropriate synchronization mechanism to serialize the accesses to prevent errors is to acquire a _______ on the shared file,ensuring that each process has appropriate access in turn.

A variant where the attacker includes malicious script content in data supplied to a site is the __________ vulnerability.

The major advantage of ________ is its simplicity and its freedom from assumptions about the expected input to any program,service,or function.

In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.

_________ are a collection of string values inherited by each process from its parent that can affect the way a running process behaves.

"Failure to Preserve SQL Query Structure" is in the __________ CWE/SANS software error category.

Program input data may be broadly classified as textual or ______.

A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.

The process of transforming input data that involves replacing alternate,equivalent encodings by one common value is called _________.

Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

A _______ attack is where the input includes code that is then executed by the attacked system.

A _________ attack occurs when the input is used in the construction of a command that is subsequently executed by the system with the privileges of the Web server.

A stead reduction in memory available on the heap to the point where it is completely exhausted is known as a ________.

_________ attacks are most commonly seen in scripted Web applications.