Domain 8 Software Development

Question 1

What database technology, if implemented for web forms, can limit the potential for SQL injection? 
A) Triggers
B) Stored procedures
C) Column encryption 
D) Concurrency control

Answer 1

B) Stored procedures

Question 2

What condition is necessary on a web page for it to be used in a cross-site scripting attack? 
A) Reflected input 
B) Database-driven content 
C) .NET technology
D) CGI scripts

Answer 2

A) Reflected input

Question 3

What technology does the JAVA language use to minimize the threat posed by applets?
A) Confidentiality 
B) Encryption 
C) Stealth 
D) Sandbox

Answer 3

D) Sandbox

Question 4

When designing an object-oriented model, which of the following situations is ideal? 
A) High cohesion, high coupling 
B) High cohesion, low coupling 
C) Low cohesion, low coupling 
D) Low  cohesion, high coupling

Answer 4

B) Coupling is a description of the level of interaction between objects. Cohesion is the strength of the relationship between the purposes of methods within the same class. When you are developing an object-oriented model, it is desirable to have high cohesion and low coupling

Question 5

Which of the following is a common way that attackers leverage botnets? 
A) Sending spam messages 
B) Conducting brute-force attacks 
C) Scanning for vulnerable systems 
D) All of the above

Answer 5

D) Botnets are used for a wide variety of malicious purpose, including scanning the network for vulnerable systems, conducting brute-force attacks against other systems, and sending out spam messages

Question 6

Which one of the following statements is not true about code review?
A) Code review should be a peer-driven process that includes multiple developers
B) Code review may be automated
C) Code review occurs during the design phase
D) Code reviewers may expect to review several hundred lines of code per hour

Answer 6

C) Code review takes place after code has been developed, which occurs after the design phase of the system’s development life cycle (SDLC). Code review may use a combination of manual and automated techniques , or rely solely on one or the other. IT should be a peer-driven process that includes developers who did not write the code. Developers should expect to complete the review of around 300 lines per hour, on average.

Question 7

Which process is responsible for ensuring that changes to software include acceptance testing? 
A) Request control 
B)  Change control 
C) Release control 
D) Configuration control

Answer 7

C) One of the responsibilities of the release control process is ensuring that the process includes acceptance testing that confirms that any alterations to end-user work tasks are understood and functional prior to code release. Te request control, change control, and configuration control processes do not include acceptance testing.

Question 8

Which one of the following is not a goal of software threat modeling?
A) To reduce the number of security-related design flaws
B) To reduce the number of security-related coding flaws
C) To reduce the severity of non-security related flaws
D)To reduce the number of threat vectors

Answer 8

D) Software threat modeling is designed to reduce the number of security-related design and coding flaws as well as the severity of other flaws.The developer or evaluator of software has no control over the threat environment, because it is external to the organization

Question 9

What is a method in databases?

Answer 9

Object methods, also known as subprograms, are functions or procedures that you can declare in an object type definition to implement behavior that you want objects of that type to perform (the verb of the object)

Question 10

Which one of the following is considered primary storage? 
A) Memory
B) Hard disk 
C) Flash drive
D) DVD

Answer 10

A) Primary storage is a technical term used to refer to the memory that is directly available to the CPU. Nonvolatile storage mechanisms, such as flash drives, DVDs, and hard drives, are classified as secondary storage.

Question 11

Bobby is investigating how an authorized database user is gaining access to information outside his normal clearance level. Bobby believes that the user is making use of a type of function that summarizes data. What term describes this type of function? 
A) Inference 
B) Polymorphic 
C) Aggregate 
D) Modular

Answer 11

C) Aggregate functions summarize large amounts of data and provide only summary information as a result. When carefully crafted, aggregate functions may unintentionally reveal sensitive information.

Question 12

Carrie is analyzing the application logs for her web-based application and comes across the following string:

../../../../../../../../../etc./passwd

What type of attack was likely attempted against Carrie’s application?

A) Command injection
B) Session hijacking
C) Directory Transversal
D) Bruteforce

Answer 12

C) The string shown in the logs is characteristic of a directory transversal attack where the attacker attempts to force the web application to navigate up the file that should not normally be provided to a web user, such as password file.

Question 13

What term is used to describe the level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at any time during its life cycle, and that the software functions in the intended manner?

A) Validation
B) Accredidation
C) Confidence interval
D) Assurance

Answer 13

Assurance, when it comes to software is the level of confidence that software is free from vulnerabilities s, either intentionally designed into the software or accidentally inserted at any time during its life cycle, and that the software functions in the intended manner. It is a term typically used in military and defense environments.

Question 14

Referring to the database transaction shown here, what would happen if no account exists in the accounts table with account number 1001?

“BEGIN TRANSACTION
UPDATE accounts
SET balance= balance +250
WHERE Account_number=1001

Update accounts
SET balance = balance - 250
WHERE account_number=2002;

END TRANSACTION

A) The database would create a new account with this account number and give it a $250 balance
B) The database would ignore that command and still reduce the balance of the second account by $250
C) The database would roll back the transaction, ignoring the results of both commands.
D) The database would generate an error messgae.

Answer 14

B) In this example, the two SQL commands are indeed bundled in a transaction, but it is not an error to issue an update command that does not match any rows. Therefore, the first command would “succeed” in updating zero rows and not generate an error or cause the transaction to roll back. The second command would then execute, reducing the balance of the second account by $250 .

Question 15

What was the likely motivation of the user who posted the message on the forum containing cross-site scripting code?

A) Reconnaissance
B) Theft of sensitive information
C) Credential stealing
D) Social engineering

Answer 15

A) The script that Linda discovered merely pops up a message on a user’s screen and does not perform any more malicious action. This type of script using an alert() call, is commonly used to probe websites for cross-site scripting vulnerabilities.

Question 16

Linda communicates with the vendor and determines that no patch is available to correct this vulnerability (XSS). Which one of the following devices would best help her defned the application against further attack?

A) VPN
B) WAF
C) DLP
D) IDS

Answer 16

B) Web application firewalls (WAFs) sit in front of web applications and watch for potentially malicious web attacks including cross-site scripting. They then block that traffic from reaching the web application. An intrusion detection system (IDS) may detect the attack but is unable to to take action to prevent it. DLP and VPN solutions are unable to detect web application attacks.

Question 17

Lauren wants to use software review process for the application she is working on. Which of the following processes would work best if she is a remote worker who works different hours from the rest of her team?

A) Pass around
B) Pair programming
C) Team review
D) Fagan inspection

Answer 17

A) Pass-around reviews are often done via email or using or using a central code review system, allowing developers to review code asynchronously. Pair programming requires two programmers to work together, with one writing code and the other reviewing and tracking progress. Team reviews are typically done in a group, and Fagan inspection is a formal review process that would involve both the developer and a team to review the code using a formal process.

Question 18

If Chris is writing code for an application, what phase of the Agile process is he in?

A) Planning
B) Sprints
C) Deployment
D) Development

Answer 18

B) Chris is in an Agile sprint and is likely developing code based on user stories. Planning includes stakeholder stories, as well as design and test case preparation . Deployment of the application includes actual deployment of the application, as well as additional verification and testing.

Question 19

What type of attack is demonstrated in the following C programming language?

int myarray [10];
myarray[10]= 8;

A) Mismatched data types
b) overflow
c) SQL injection
D) Covert channel

Answer 19

This is an example of a specific type of buffer overflow known as an off-by-one error. The first line of code defines an array of 10 elements , which would be numbered 0-9. The second line of code tries to place a value in the 11th element of the array (remember array counting begins at 0!), which would cause an overflow.

Question 20

Which one of the following database issues occurs when one transaction writes a value to the database that overwrites a value that was needed by a transaction with earlier precedence?

A) Dirty read
B) Incorrect summary
C) Lost update
D) SQL injection

Answer 20

C) Lost updates occur when one transaction write a value to the database that overwrites a value a value needed by transactions that have earlier precedence, causing those transactions to to read an incorrect value. Dirty reads occur when one transaction reads value from a database that was written by another transaction that did not commit. Incorrect summary occur when one transaction is using an aggregate function to summarize data stored in a database while a second trnsaction is making modifications to the database, causing the summary to include incorrect information. SQL injection is clearly not relevant.

Question 21

Which one of the following is the most effective control against session hijacking attacks?

A) TLS
B) Complex session cookies
C) SSL
D) Expiring cookies frequently

Answer 21

A) Transport layer security (TLS) provides the most effective defense because it encrypts all traffic between the client and the server, preventing the attacker from stealing session credentials. Secure Sockets Layer also encrypts traffic, but is vulnerable to attacks against encryption technology. Complex and expiring cookies are a good idea, but they are not sufficient protection against session hijacking.

Question 22

Faith is looking at the / etc/passwd file on a system configured to use shadowed passwords. When she exampines a line in the file for a user with interactive login permissions, what should she expect to see in the password field?

A) Plaintext password
B) Hashed password
C) X
D) *

Answer 22

C) When a system uses shadowed passwords, the hased password value is stored in /etc/shawdow instead of /etc/passwd. The etc.passwd file would not contain the password in plaintext or hashed form. Instead, it would contain an x to indicate that the password hash is in the shadow file . The * character is normally used to disable interactive logins to an account.

Question 23

While evaluating a potential security incident, Harry comes across a log entry from a web server request showing that a user entered the the following input into a form field. CARROT’ 1=1;–
What type of attack was attempted?

A) Buffer overflow
B) Cross-site scripting
C) SQL injection
D) Cross-site request forgery

Answer 23

C) The single quotation mark in the input field is a telltale sign that this is a SQL injection attack. The quotation mark is used to escape outside the SQL code’s input field, and the text following is used to directly manipulate the SQL command sent from the web application to the database.

Question 24

Which one of the following is not an effective control against SQL injection attacks?

A) Escaping
B) Client-side input validation
C) Parameterization
D) Limiting database permissions

Answer 24

B) Client-side input validation is not an effective control against any type of attack because the attacker can easily bypass the validation by altering the code on the client. Escaping restricted characters prevents them from being passed to the database, as does parameterization. Limiting database permissions prevents dangerous code from executing.

Question 25

What is a PERT chart? What is a Gantt chart? What is a WBS?

Answer 25

PERT charts use nodes to represent milestones or deliverables and then show the estimated time to move between milestones. Gantt charts use a different format with row a row for each task and lines showing the expected duration of a task. A work breakdown sturcture (WBS) are an earlier deliverable that divides project work into achievable tasks.

Question 26

Scott is inspecting a system where the user reported unusual activity, including disk activity when the system is idel and abnormal CPU and network usage. HE suspects the machine is infected by a virus but scans come up clean. What malware technique might be in use here that would explain the clean scan results?

A) File infector virus
B) MBR virus
C) Service injection virus
D) Stealth virus

Answer 26

D) One possibility for the clean scan results is that the virus is using stealth techniques, such as intercepting read requests from the antivirus software and returning a correct-looking version of the infected file.

Question 27

Tomas discovers a line in his application log that appears to correspond with an attempt to conduct a directory traversal attack. He believes the attack was conducted using URL encoding. The line reads:

%252E%252E%252F%252E%252E%252Fetc/passwd

What character is represented by the %252E value?

A) .
B) ,
C) ;
D) /

Answer 27

A) In URL encoding, the . character is replaced by %25E and the / charter is replaced by %s252F. You can see this in log entry the log entry, where the expected pattern of ../../ is replaced by %252E%252E%252F%252E%252E%

Question 28

An attacker posted a message to a public to a public discussion forum that contains an embedded malicious script that is not displayed to the user but executes on the user’s system when read. What type of attack is this?

A) Persistent XSRF
B) Nonpersistent XSRF
C) Persistent XSS
D) Nonpersistent XSS

Answer 28

Attacks where malicious users tricks the victim’s web browser into executing a script through the use of a 3rd party are known as cross-site scripting (XSS) attacks. This particular attack is a persistent XSS attack because it remamins on the discussion forum until an administrator discovers and deletes it, giving it the ability to effect many users.

Question 29

Scott is working with DynamoDB database. The database is not structured like a relational database but allows Scott to store data using a key-value store. What type of database id Dynamo DB?

A) Relational database
B) Graph database
C) Hierarchical database
D) NOSQL database

Answer 29

D) A key-value store is an emaple of a NOSQL database that does not follow a relational or hierarchical model like traditional databases. A graph database is another example of a NoSQL database, but it uses nodes and edges to store data rather than keys and values.

Question 30

In the transaction shown here, what would happen if the databse failed in between the first and second update statements.

BEGIN TRANSACTION

UPDATE accounts
SET balance= balance + 250
WHERE account _number= 1001;

UPDATE accounts
SET balance=balance-250
WHERE account_number= 2002;

COMMIT TRANSACTION

A) Te database would credit the first account with $250 in funds but then not reduce the balance of the second account
B) The database would ignore the first command and only reduce the balance of the second account by $250
C) The database would roll back the transaction, ignoring the results of both commands.
D) The database would successfully execute both commands.

Answer 30

C) Database failure in the middle of a transaction causes the rollback of the entire transaction. In this scenario, the database would not execute either command.

Question 31

What part of the security review process are the input parameters shown in the diagram used for?

BOX 1: Configuration input parameters BOX 2: User input parameters BOX 3: Control input parameters BOX 4: Back-end input parameters BOX 5: Parameter tracking through code

A) SQL injection
B) Sprint review
C) Fagan inspection
D) Attack surface identification

Answer 31

D) Each of these input parameters makes up part of the attack surface of the application. Attackers may opt to target any of them to attack the code or its supporting infrastructure

Question 32

At which level of the software capability maturity model (SW-CMM) does an organization introduce basic life-cycle management processes?

A) Initial
B) Repeatable
C) Defined
D) Managed

Answer 32

B) In level 2, the repeatable level of SW-CMM, an organization introduces basic life cycle management processes. Reuse of code in an organized fashion begins, and repeatable results are expected from similar projects. The key process area for this level include requirements management, software project management, software project tracking and oversight, software subcontract management, software quality assurance, and software configuration management.

Question 33

Which one of the following database concurrency issues occurs when one transaction reads information that was written to a database by a second transaction that never committed?

A) Lost update
B) SQL injection
C) Incorrect summary
D) Dirty read

Answer 33

D) Dirty reads occur when one transaction reads a value from a database that was written by another transaction that did not commit. Lost updates occur when one transaction writes a value to the database that overwrites a value needed by transactions that have earlier precedence, causing those transactions to read an incorrect value. Incorrect summary occurs when one transaction is using an aggregate function to summarize data stored in a database while a second transaction is making modifications to the database, causing the summary to include incorrect information.

Question 34

What is parameterization and what is stored procedures?

Answer 34

Parameterization: A parameterized query (also known as a prepared statement) is a means of pre-compiling a SQL statement so that all you need to supply are the “parameters” (think “variables”) that need to be inserted into the statement for it to be executed

Stored procedures:A stored procedure is a prepared SQL code that you can save, so the code can be reused over and over again. So if you have an SQL query that you write over and over again, save it as a stored procedure, and then just call it to execute it.