Application Security Quiz Flashcards
Which of the programming aspects listed below are critical in the secure application development process? (Select 2 answers)
A) Patch management
B) Input validation
C) Password protection
D) Error and exception handling
E)Application whitelisting
B) Input validation
D) Error and exception handling
A situation in which a web form field accepts data other than expected (e.g., server commands) is an example of:
A) Zero-day vulnerability
B) Improper input validation
C) Default configuration
D) Improper error handling
B) Improper input validation
Which of the following answers refers to a countermeasure against code injection?
A) Fuzzing
B) Input validation
C) Code signing
D) Normalization
B) Input validation
Which of the terms listed below refers to an automated or manual code review process aimed at discovering logic and syntax errors in the application’s source code?
A) Input validation
B) Dynamic code analysis
C) Fuzzing
D) Static code analysis
D) Static code analysis
The term “Secure cookie” refers to a type of HTTP cookie that is transmitted over an encrypted HTTPS connection, which helps prevent the cookie from being intercepted or tampered with during transit.
A) True
B) False
A) True
A dynamic code analysis allows for detecting application flaws without the need for actual execution of the application code.
A) True
B) False
B) False
The term “Static code analysis” refers to the process of discovering application runtime errors.
A) True
B) False
B) False
What is the purpose of code signing? (Select 2 answers)
A) Disables code reuse
B) Confirms the application’s source of origin
C) Enables application installation
D) Validates the application’s integrity
E) Protects the application against unauthorized use
D) Validates the application’s integrity
B) Confirms the application’s source of origin
The practice of finding vulnerabilities in an application by feeding it incorrect input is called:
A) Normalization
B) Hardening
C) Dynamic code analysis
D) Fuzzing
D) Fuzzing
In computer security, a mechanism for safe execution of untested code or untrusted applications is referred to as:
A) Sideloading
B) Virtualization
C) Sandboxing
D) Stress testing
C) Sandboxing
Which of the following answers refers to a Windows-specific feature for handling exceptions, errors, and abnormal conditions in software?
A) EPC
B) SEH
C) EH
D) EXR
B) SEH
Address Space Layout Randomization (ASLR) is an OS security technique that randomizes the location of key data areas in memory. The purpose of ASLR is to prevent attackers from predicting the location of specific code or data in memory, which adds a layer of defense against memory-based attacks, such as buffer overflows.
A) True
B) False
A) True
A type of user identification mechanism used as a countermeasure against automated software (such as network bots) is known as:
A) MFA
B) CAPTCHA
C) SSO
D) NIDS
