Deck 9: Secure Programming With Perl

Question 1

8)The main purpose of ____ is to isolate tainted data so that the script cannot use it to perform tasks unintentionally.

A) safe mode
B) taint mode
C) sandbox mode
D) domain mode

Answer 1

B

Question 2

12)In Perl, the ternary conditional operator "____" is an exception to the principle of "one tainted value taints the whole expression."

A) ++
B) ?:
C) *=
D) &&

Answer 2

B

Question 3

10)Perl's ____ allows developers program security even when running extra privileges such as setuid or setgid programs.

A) taint mode
B) safe mode
C) domain mode
D) sandbox mode

Answer 3

A

Question 4

19)The goal of the ____ library is to provide classes and functions that allow developers to write WWW clients.

A) LWP
B) CPAN
C) WWP
D) perl-weblib

Question 5

17)____ is an algorithm based on a random permutation using a variable key-size stream cipher with byte-oriented operations.

A) RC4
B) SHA1
C) MD5
D) RSA

Question 6

18)____ is a set of Perl modules that provide a simple and consistent Application Programming Interface (API) to the World Wide Web.

A) Crypt::Web:Lib
B) RC4
C) Crypt::Lib:Web
D) LWP

Question 7

6)____ is a general-purpose scripting language that is widely used to implement common gateway interface (CGI).

A) Java
B) Python
C) Ruby
D) Perl

Question 8

1)Hypertext transfer protocol (HTTP) only allows one-way communication from the server to the client (Web browser).

Question 9

16)The Perl's ____ function is based on the data encryption standard (DES) algorithm, and its variations are intended to discourage the use of hardware implementations of a key search.

A) des()
B) crypt()
C) password()
D) passwd()

Question 10

3)In Perl, any subexpression is considered tainted if all of the elements in the expression are tainted.

Question 11

15)____ is a search engine for the distributions, modules, documentation, and IDs on CPAN.

A) Perl search
B) Google-Perl
C) Google.CPAN
D) CPAN search

Question 12

4)Once a variable is tainted, Perl will allow you to use it in a system() , exec() , piped open, eval() , backtick , or unlink command.

Question 13

2)Since CGI scripts are designed to run by individuals around the world, they are the prime targets for malicious users to exploit any vulnerability.

Question 14

9)The setuid and ____ are UNIX functions that deal with privileges.

A) setdid
B) setoid
C) setgid
D) setprv

Question 15

7)____ permits communication and interaction from the client to the server for producing dynamic, two-way Web pages.

A) CGI
B) HTTP
C) HTTPS
D) HTTP2

Question 16

13)____ is a tool designed to help developers to write safer scripts by forcing them to think about external input validation and protecting them from accidentally performing unsafe operations, such as unwillingly changing external resources.

A) Safe mode
B) Sandbox mode
C) Domain mode
D) Taint mode

Question 17

14)Variables are considered ____ if they are set with values that are retrieved from outside of the script.

A) sandboxed
B) secure
C) tainted
D) safe

Question 18

20)Communication in LWP follows hypertext transfer protocol (HTTP) and is ____.

A) stateful
B) stateless
C) state-aware
D) state-smart

Question 19

11)You can enable taint mode explicitly by using the command line flag ____.

A) -A
B) -S
C) -T
D) -X

Question 20

5)It is a good practice to verify that a variable you are planning to untaint has only bad characters (black listing) rather than check whether or not it has any good characters (white listing).

Question 21

38)Briefly describe the Perl's crypt() function.

Question 22

29)The _________________________ module enables a Perl program to use OpenSSL to parse an X.509-formatted certificate.

Question 23

28)Perl provides a built-in security-checking mechanism called ____________________.

Question 24

39)What are the steps followed by a communication in LWP?

Question 25

40)What are the characteristics of a namespace when Perl is in safe mode?

Question 26

33)What are some of the characteristics of Perl's taint mode?

Question 27

25)The safe module operation ____ returns a glob reference for the symbol table entry of VARNAME in the package of the compartment.

A) reval (STRING)
B) deny_only (OP, ...)
C) share (NAME, ...)
D) varglob (VARNAME)

Question 28

22)____ provides internal data checking for developers to catch malicious data coming into the program.

A) Taint mode
B) Domain mode
C) Sandbox mode
D) Safe mode

Question 29

24)The safe module operation ____ permits only the provided list of operators to be used when compiling code in the compartment.

A) permit (OP, ...)
B) permit_only (OP, ...)
C) trap (OP, ...)
D) share (NAME, ...)

Question 30

26)The two areas of concern in file processing are temporary file creation and ____ in file access.

A) covert channels
B) side channels
C) race conditions
D) share conditions

Question 31

37)How can you set values for a variable in Perl?

Question 32

36)How can you untaint Perl variables?

Question 33

23)In Perl, ____ provides a "sandbox" environment that compiles and executes code in restricted compartments.

A) taint module
B) taint mode
C) safe module
D) domain mode

Question 34

31)In Perl, the RSA public key cryptography functions can be accessed through the _________________________ module.

Question 35

21)In order to provide support for the HTTPS protocol under LWP, we need the ____ Perl module.

A) LWP::UserAgent
B) Crypt::HTTPS
C) Crypt::SSLeay
D) Crypt::SSLAgent

Question 36

30)The ____________________ function is a built-in Perl routine usually used as the UNIX password-encryption function.

Question 37

34)What are some of the Perl's taint mode exceptions?

Question 38

27)Many programming languages can be used for building CGI, but the most common one is ____________________.

Question 39

35)How can you test whether a variable that contains tainted data will trigger an "Insecure dependency" message?

Question 40

What are the operator-access restrictions when Perl is in safe mode?

Question 42

42)Briefly describe race conditions in file access.