Ch15 Flashcards
Which one of the following factors should not be taken into consideration when planning a security testing schedule for a particular system?
A. Sensitivity of the information stored on the system
B. Difficulty of performing the test
C. Desire to experiment with new testing tools
D. Desirability of the system to attackers
C Desire to experiment with new testing tools should not influence production testing schedule
What type of network discovery scan only follows the first two steps of the TCP handshake?
A. TCP connect scan
B. Xmas scan
C. TCP SYN scan
D. TCP ACK scan
C. TCP SYN scan because this is the best answer since there isn’t an answer TCP SYN/ACK
Badin Industries runs a web application that processes e-commerce orders and handles credit card transactions. As such, it is subject to the Payment Card Industry Data Security Standard (PCI DSS). The company recently performed a web vulnerability scan of the application and it had no unsatisfactory findings. How often must Badin rescan the application?
A. Only if the application changes
B. At least monthly
C. At least annually
D. There is no rescanning requirement.
PCI DSS requires rescan the application at least annually and after any change in the application
Users of a banking application may try to withdraw funds that don’t exist from their account. Developers are aware of this threat and implemented code to protect against it. What type of software testing would most likely catch this type of vulnerability if the developers have not already remediated it?
A. Misuse case testing
B. SQL injection testing
C. Fuzzing
D. Code review
Misuse case or (abuse case testing) testing identifies known ways that an attacker might exploit a system and tests explicitly to see if those attacks are possible in the proposed code
user interface testing includes assessments of what interfaces
both graphical user interfaces (GUIs)
and command‐line interfaces (CLIs) for a software program.
Takes previous input values from actual operation of the software and manipulates it to create fuzzed input
mutational (Dumb) testing
Develops data models and creates new fuzzed input based on an understanding of the types of data used by the program.
Generational (Intelligent) Fuzzing
Three types of interfaces should be tested during the software testing process
Application Programming Interface
User Interfaces
Physical Interfaces
what are log reviews particularly used for
Administrative activities/abuses
what is the default level of access given by an Administrator
NO ACCESS
