IS3340 CHAPTER 12 Flashcards
Computer software designed to allow users to perform specific tasks is called ___?
APPLICATION SOFTWARE
An integrated collection of software programs that are used to manage many aspects of a business, including financials, human resources, assets, and business process is called ___?
ENTERPRISE RESOURCE PLANNING (ERP)
A popular protocol used to transfer files from one computer to another is called ___?
FILE TRANSFER PROTOCOL (FTP)
A secure application layer protocol used to transfer encrypted content between Web browsers and Web servers. It encrypts traffic by sending messages over SLS/TLS and is called ___?
HYPERTEXT TRANSFER PROTOCOL SECURE (HTTPS)
An attack in which the attacker is located between a client and a server and intercepts traffic flowing back and forth between the two computers. The attacker can view or modify data that is transmitted in the clear and is called ___?
MAN-IN-THE-MIDDLE
Adding more authority to the current session than the process should possess is called ___?
PRIVILEGE ESCALATION
A statement that accesses data in a database is called ___?
QUERY
The act of masquerading as another identity is called ___?
SPOOFING
An attack that adds SQL statements to input data for the purpose of sending commands to a database management system is called ___?
SQL INJECTION
A computer language for accessing data in a database is called ___?
STRUCTURED QUERY LANGUAGE (SQL)
An option in several database management systems that encrypts all data in the database without any user or application action required is called ___?
TRANSPARENT DATA ENCRYPTION (TDE)
A character string used to identify the location and name of a resource on the Internet is called ___?
UNIFORM RESOURCE LOCATOR (URL)
A computer that follows the instructions sent from another computer is called a ___?
ZOMBIE
- The main focus when security application software is confidentiality.
TRUE OR FALSE
FALSE
- Which type of application attack attempts to add more authority to the current process?
- Privilege spoofing
- Identity escalation
- Privilege escalation
- Identity spoofing
Privilege escalation
- Which of the following is the best first step in securing application software?
- Install all of the latest patches
- Harden the operating system
- Configure application software using least privilege
- Perform penetration tests to evaluate vulnerabilities
Harden the operating system
- A ___ is an attractive target because it is the primary client of Web applications.
Web browser
- Why are ActiveX controls potential security risks?
- Active X controls potential security risks
- Active X controls can contain malware and run on the server
- Active X controls require that you divulge sensitive authentication details
- Active X controls are outdated and generally used by older Web applications
Active X controls potential security risks
- Enabling secure connections ensures email messages are encrypted between sender and recipient.
TRUE OR FALSE
FALSE
- Which of the following is a simple step to make email clients more secure?
- Use EFS/BitLocker to store email messages on the server
- Install third party message encryption
- Turn off message preview
- Remove email clients and use server-based email access
Turn off message preview
- Which of the following steps can increase the security of all application software?
- Install anti-malware software
- Use whole disk encryption on client workstations
- Run SCW on workstations
- Require an SSL/TLS for connections to a Web server
Install anti-malware software
- You use Windows server roles to configure each Windows server computer to perform only one task.
TRUE OR FALSE
FALSE
- A URL can contain commands the Web server will execute.
TRUE OR FALSE
TRUE
- How do you install IIS on a Windows Server 2008 R2 computer?
- Purchase IIS and install it
- Download IIS for free and install it
- Add the Web Server (IIS) role to a server
- Install IIS from the Windows install DVD
Add the Web Server (IIS) role to a server
12.A ___ is any statement that accesses data in a database.
Query
- ___ encrypts all data in a database without requiring user or application action.
Transparent Dat Encryption (TDE)
- SQL Injection attacks are only possible against popular Microsoft SQL Server databases.
TRUE OR FALSE
FALSE
- Is requiring secure connections between your Web server and your application server worth the overhead and administrative effort?
- No, because both the Web server and application server are inside your secure network
- Yes, because your Web server is in the DMZ and is Internet-facing
- No, because secure connections between high volume servers can dramatically slow down both servers
- Yes, because your application server is in the DMZ and is Internet-facing
Yes, because your Web server is in the DMZ and is Internet-facing
