865 538
Quiz by , created more than 1 year ago

application and networking-based attacks

152
0
0
865 538
Created by 865 538 almost 8 years ago
Close

nsf_03

Question 1 of 30

1

HTML is a markup language that uses specific ____ embedded in brackets.

Select one of the following:

  • a. blocks

  • b. taps

  • c. tags

  • d. marks

Explanation

Question 2 of 30

1

The default root directory of the Microsoft Internet Information Services (IIS) Web server is ____.

Select one of the following:

  • a. /var/html

  • b. /var/www

  • c. C:\Inetpub\wwwroot

  • d. /etc/var/www

Explanation

Question 3 of 30

1

The SQL injection statement ____ finds specific users.

Select one of the following:

  • a. whatever’ OR full_name IS ‘%Mia%’

  • b. whatever’ OR full_name LIKE ‘%Mia%’

  • c. whatever’ OR full_name = ‘%Mia%’

  • d. whatever’ OR full_name equals ‘%Mia%’

Explanation

Question 4 of 30

1

ARP poisoning is successful because there are few authentication procedures to verify ARP requests and replies.

Select one of the following:

  • True
  • False

Explanation

Question 5 of 30

1

Web application attacks are considered ____ attacks.

Select one of the following:

  • a. client-side

  • b. relationship

  • c. hybrid

  • d. server-side

Explanation

Question 6 of 30

1

When TCP/IP was developed, the host table concept was expanded to a hierarchical name system for matching computer names and numbers known as the ____.

Select one of the following:

  • a. DNS

  • b. URNS

  • c. HTTP

  • d. NSDB

Explanation

Question 7 of 30

1

____ is a language used to view and manipulate data that is stored in a relational database.

Select one of the following:

  • a. SQL

  • b. DQL

  • c. ISL

  • d. C

Explanation

Question 8 of 30

1

Although traditional network security devices can block traditional network attacks, they cannot always block Web application attacks.

Select one of the following:

  • True
  • False

Explanation

Question 9 of 30

1

A client-side attack that results in a user’s computer becoming compromised just by viewing a Web page and not even clicking any content is known as a ____.

Select one of the following:

  • a. denial of service

  • b. drive-by-download

  • c. stack underflow

  • d. buffer overflow

Explanation

Question 10 of 30

1

____ is for the transport and storage of data, with the focus on what the data is.

Select one of the following:

  • a. XML

  • b. SGML

  • c. HTML

  • d. SML

Explanation

Question 11 of 30

1

Which of these is NOT a reason why securing server-side web applications is difficult.

Select one of the following:

  • a. Although traditional network security devices can block traditional network attacks, they cannot always block web application attacks.

  • b. The processors on clients are smaller than on web servers an thus they are easier to defend.

  • c. Many web application attacks exploit previously unknown vulnerabilities.

  • d. By design dynamic server-side web applications accept user input that can contain malicious code.

Explanation

Question 12 of 30

1

Which of these is not an HTTP header attack?

Select one of the following:

  • a. Accept-Language

  • b. Referer

  • c. Response splitting

  • d. Content-length

Explanation

Question 13 of 30

1

What is another name for a locally share object (LSO)?

Select one of the following:

  • a. Flash cookie

  • b. session cookie

  • c. RAM cookie

  • d. secure cookie

Explanation

Question 14 of 30

1

Browser plug-ins ____.

Select one of the following:

  • a. only function on web servers.

  • b. can be embedded inside a webpage but add-ons cannot.

  • c. have additional functionality to the entire browser.

  • d. have been replaced by browser extensions.

Explanation

Question 15 of 30

1

An attacker who manipulates the maximum size of an integer type would be performing what kind of attack?

Select one of the following:

  • a. buffer overflow

  • b. real number

  • c. heap size

  • d. integer overflow

Explanation

Question 16 of 30

1

What kind of attack is performed by an attacker who takes advantage of the inadvertent and unauthorized access built through three succeeding systems that all trust one another?

Select one of the following:

  • a. privilege rights

  • b. heap spray

  • c. transitive

  • d. vertical escalation

Explanation

Question 17 of 30

1

Which statement is correct regarding why traditional network security devices cannot be used to block web application attacks?

Select one of the following:

  • a. Traditional network security devices ignore the content of HTTP traffic, which is the vehicle of web application attacks.

  • b. Web application attacks use web browsers that cannot be controlled on a local computer.

  • c. Network security devices cannot prevent attacks from web resources.

  • d. The complex nature of TCP/IP allows for too man ping sweeps to be blocked.

Explanation

Question 18 of 30

1

What do attackers use buffer overflows to do?

Select one of the following:

  • a. erase buffer overflow signature files

  • b. corrupt the kernel so the computer cannot reboot

  • c. point to another area in data memory that contains the attacker's malware code

  • d. place a virus into the kernel

Explanation

Question 19 of 30

1

What is unique about a cross-site scripting (XSS) attack compared to other injection attacks?

Select one of the following:

  • a. SQL code is used in an XSS attack.

  • b. XSS requires the use of a browser.

  • c. XSS does not attack the web application server to steal or corrupt its information.

  • d. XSS attacks are rarely used anymore compared to other injection attacks.

Explanation

Question 20 of 30

1

What is a cookie that was not created by the website being viewed called?

Select one of the following:

  • a. first-party cookie

  • b. second-party cookie

  • c. third-party cookie

  • d. fourth-party cookie

Explanation

Question 21 of 30

1

What is the basis of an SQL injection attack?

Select one of the following:

  • a. to have the SQL server attack client web browsers

  • b. to inject SQL statements through unfiltered user input

  • c. to expose SQL code so that it can be examined

  • d. to link SQL servers into a botnet

Explanation

Question 22 of 30

1

Which action cannot be performed through a successful SQL injection attack?

Select one of the following:

  • a. reformat the web application server's hard drive

  • b. display a list of customer telephone numbers

  • c. discover the names of different fields in a table

  • d. erase a database table

Explanation

Question 23 of 30

1

Which markup language is designed to carry data?

Select one of the following:

  • a. ICMP

  • b. HTTP

  • c. HTML

  • d. XML

Explanation

Question 24 of 30

1

What type of attack involves an attacker accessing files in directories other than the root directory?

Select one of the following:

  • a. SQL injection

  • b. command injection

  • c. XML injection

  • d. directory traversal

Explanation

Question 25 of 30

1

Which type of attack modifies the fields that contain the different characteristics of the data that is being transmitted?

Select one of the following:

  • a. XML manipulation

  • b. HTML packet

  • c. SQL injection

  • d. HTTP header

Explanation

Question 26 of 30

1

What is a session token?

Select one of the following:

  • a. XML code used in an XML injection attack

  • b. a random string assigned by a web server

  • c. another name for a third-party cookie

  • d. a unique identifier that includes the user's email address

Explanation

Question 27 of 30

1

Which of these is NOT a DoS attack?

Select one of the following:

  • a. SYN flood

  • b. ping flood

  • c. smurf

  • d. push flood

Explanation

Question 28 of 30

1

What type of attack intercepts legitimate communication and forges a fictitious response to the sender?

Select one of the following:

  • a. SIDS

  • b. interceptor

  • c. man-in-the-middle

  • d. SQL intrusion

Explanation

Question 29 of 30

1

A replay attack ____.

Select one of the following:

  • a. is considered to be a type of DoS attack

  • b. makes a copy of the transmission for use at a later time

  • c. can be prevented by patching the web browser

  • d. replays the attack over and over to flood the server

Explanation

Question 30 of 30

1

DNS poisoning ____.

Select one of the following:

  • a. floods a DNS server with requestes until it can no longer respond

  • b. is rarely found today due to the use of host tables

  • c. substitutes DNS addresses so that the computer is automatically redirected to another device

  • d. is the same as ARP poisoning

Explanation

Previous
Next