22842272
Descripción
Test por Requiemdust Sheena, actualizado hace más de 1 año
|
Creado por Requiemdust Sheena
hace más de 4 años
|
|
Pregunta 1
Pregunta
Linda is reviewing posts to a user forum on her company’s website
and, when she browses a certain post, a message pops up in a
dialog box on her screen reading “Alert.” She reviews the source
code for the post and finds the following code snippet:
<script>alert(‘Alert’);</script>
Linda communicates with the vendor and determines that no patch is
available to correct this vulnerability. Which one of the following
devices would best help her defend the application against further
attack?
Respuesta
-
A. VPN
-
B. WAF
-
C. DLP
-
D. IDS
Pregunta 2
Pregunta
Linda is reviewing posts to a user forum on her company’s website
and, when she browses a certain post, a message pops up in a
dialog box on her screen reading “Alert.” She reviews the source
code for the post and finds the following code snippet:
<script>alert(‘Alert’);</script>
What was the likely motivation of the user who posted the message on
the forum containing this code?
Respuesta
-
A. Reconnaissance
-
B. Theft of sensitive information
-
C. Credential stealing
-
D. Social engineering
Pregunta 3
Pregunta
Linda is reviewing posts to a user forum on her company’s website
and, when she browses a certain post, a message pops up in a
dialog box on her screen reading “Alert.” She reviews the source
code for the post and finds the following code snippet:
<script>alert(‘Alert’);</script>
In further discussions with the vendor, Linda finds that they are
willing to correct the issue but do not know how to update their
software. What technique would be most effective in mitigating the
vulnerability of the application to this type of attack?
Respuesta
-
A. Bounds checking
-
B. Peer review
-
C. Input validation
-
D. OS patching
Pregunta 4
Pregunta
What property of relational databases ensures that once a database
transaction is committed to the database, it is preserved?
Respuesta
-
A. Atomicity
-
B. Consistency
-
C. Durability
-
D. Isolation
Pregunta 5
Pregunta
Lauren wants to use software review process for the application she is
working on. Which of the following processes would work best if she
is a remote worker who works different hours from the rest of her
team?
Respuesta
-
A. Pass around
-
B. Pair programming
-
C. Team review
-
D. Fagan inspection
Pregunta 6
Pregunta
Which one of the following is not a technique used by virus authors to
hide the existence of their virus from antimalware software?
Respuesta
-
A. Stealth
-
B. Multipartitism
-
C. Polymorphism
-
D. Encryption
Pregunta 7
Pregunta
Which one of the following types of software testing usually occurs
last and is executed against test scenarios?
Respuesta
-
A. Unit testing
-
B. Integration testing
-
C. User acceptance testing
-
D. System testing
Pregunta 8
Pregunta
What type of requirement specifies what software must do by
describing the inputs, behavior, and outputs of software?
Respuesta
-
A. Derived requirements
-
B. Structural requirements
-
C. Behavioral requirements
-
D. Functional requirements
Pregunta 9
Pregunta
Which of the following organizations is widely considered as the
definitive source for information on web-based attack vectors?
Respuesta
-
A. (ISC)2
-
B. ISACA
-
C. OWASP
-
D. Mozilla Foundation
Pregunta 10
Pregunta
If Chris is writing code for an application, what phase of the Agile
process is he in?
Respuesta
-
A. Planning
-
B. Sprints
-
C. Deployment
-
D. Development
Pregunta 11
Pregunta
Lisa is attempting to prevent her network from being targeted by IP
spoofing attacks as well as preventing her network from being the
source of those attacks. Which one of the following rules is NOT a
best practice that Lisa can configure at her network border?
Respuesta
-
A. Block packets with internal source addresses from entering the network.
-
B. Block packets with external source addresses from leaving the network.
-
C. Block packets with private IP addresses from exiting the network.
-
D. Block packets with public IP addresses from entering the network.
Pregunta 12
Pregunta
What type of attack is demonstrated in the following C programming
language example?
int myarray[10];
myarray[10] = 8;
Respuesta
-
A. Mismatched data types
-
B. Overflow
-
C. SQL injection
-
D. Covert channel
Pregunta 13
Pregunta
Which one of the following database issues occurs when one
transaction writes a value to the database that overwrites a value that
was needed by transactions with earlier precedence?
Respuesta
-
A. Dirty read
-
B. Incorrect summary
-
C. Lost update
-
D. SQL injection
Pregunta 14
Pregunta
Which one of the following is the most effective control against
session hijacking attacks?
Respuesta
-
A. TLS
-
B. Complex session cookies
-
C. SSL
-
D. Expiring cookies frequently
Pregunta 15
Pregunta
Faith is looking at the /etc/passwd file on a system configured to use
shadowed passwords. When she examines a line in the file for a user
with interactive login permissions, what should she expect to see in
the password field?
Respuesta
-
A. Plaintext password
-
B. Hashed password
-
C. x
-
D. *
Pregunta 16
Pregunta
What type of vulnerability does a TOCTOU attack target?
Respuesta
-
A. Lack of input validation
-
B. Race condition
-
C. Injection flaw
-
D. Lack of encryption
Pregunta 17
Pregunta
While evaluating a potential security incident, Harry comes across a
log entry from a web server request showing that a user entered the
following input into a form field:
CARROT’&1=1;--
What type of attack was attempted?
Respuesta
-
A. Buffer overflow
-
B. Cross-site scripting
-
C. SQL injection
-
D. Cross-site request forgery
Pregunta 18
Pregunta
Which one of the following is not an effective control against SQL
injection attacks?
Respuesta
-
A. Escaping
-
B. Client-side input validation
-
C. Parameterization
-
D. Limiting database permissions
Pregunta 19
Pregunta
What type of project management tool is shown in the figure?
Image:
42 (binary/octet-stream)
Respuesta
-
A. WBS chart
-
B. PERT chart
-
C. Gantt chart
-
D. Wireframe diagram
Pregunta 20
Pregunta
In what software testing technique does the evaluator retest a large
number of scenarios each time that the software changes to verify that
the results are consistent with a standard baseline?
Respuesta
-
A. Orthogonal array testing
-
B. Pattern testing
-
C. Matrix testing
-
D. Regression testing
Pregunta 21
Pregunta
Which one of the following conditions may make an application most
vulnerable to a cross-site scripting (XSS) attack?
Respuesta
-
A. Input validation
-
B. Reflected input
-
C. Unpatched server
-
D. Promiscuous firewall rules
Pregunta 22
Pregunta
Roger is conducting a software test for a tax preparation application
developed by his company. End users will access the application over
the Web, but Roger is conducting his test on the back end, evaluating
the source code on the web server. What type of test is Roger
conducting?
Respuesta
-
A. White box
-
B. Gray box
-
C. Blue box
-
D. Black box
Pregunta 23
Pregunta
Which of the following statements is true about heuristic-based
antimalware software?
Respuesta
-
A. It has a lower false positive rate than signature detection.
-
B. It requires frequent definition updates to detect new malware.
-
C. It has a higher likelihood of detecting zero-day exploits than signature detection.
-
D. It monitors systems for files with content known to be viruses.
Pregunta 24
Pregunta
Martin is inspecting a system where the user reported unusual
activity, including disk activity when the system is idle and abnormal
CPU and network usage. He suspects that the machine is infected by a
virus but scans come up clean. What malware technique might be in
use here that would explain the clean scan results?
Respuesta
-
A. File infector virus
-
B. MBR virus
-
C. Service injection virus
-
D. Stealth virus
Pregunta 25
Pregunta
Tomas discovers a line in his application log that appears to
correspond with an attempt to conduct a directory traversal attack.
He believes the attack was conducted using URL encoding. The line
reads:
%252E%252E%252F%252E%252E%252Fetc/passwd
What character is represented by the %252E value?
Respuesta
-
A. .
-
B. ,
-
C. ;
-
D. /
Pregunta 26
Pregunta
An attacker posted a message to a public discussion forum that
contains an embedded malicious script that is not displayed to the
user but executes on the user’s system when read. What type of attack
is this?
Respuesta
-
A. Persistent XSRF
-
B. Nonpersistent XSRF
-
C. Persistent XSS
-
D. Nonpersistent XSS
Pregunta 27
Pregunta
Which one of the following is not a principle of the Agile software
development process?
Respuesta
-
A. Welcome changing requirements, even late in the development process.
-
B. Maximizing the amount of work not done is essential.
-
C. Clear documentation is the primary measure of progress.
-
D. Build projects around motivated individuals.
Pregunta 28
Pregunta
What are the two components of an expert system?
Respuesta
-
A. Decision support system and neural network
-
B. Inference engine and neural network
-
C. Neural network and knowledge bank
-
D. Knowledge bank and inference engine
Pregunta 29
Pregunta
Neal is working with a DynamoDB database. The database is not
structured like a relational database but allows Neal to store data
using a key-value store. What type of database is DynamoDB?
Respuesta
-
A. Relational database
-
B. Graph database
-
C. Hierarchical database
-
D. NoSQL database
Pregunta 30
Pregunta
In the transaction shown here, what would happen if the database
failed in between the first and second update statements?
Image:
43 (binary/octet-stream)
Respuesta
-
A. The database would credit the first account with $250 in funds but then not reduce the balance of the second account.
-
B. The database would ignore the first command and only reduce the balance of the second account by $250.
-
C. The database would roll back the transaction, ignoring the results of both commands.
-
D. The database would successfully execute both commands.
Pregunta 31
Pregunta
In the diagram shown here, which is an example of an attribute?
Image:
44 (binary/octet-stream)
Respuesta
-
A. Account
-
B. Owner
-
C. AddFunds
-
D. None of the above
Pregunta 32
Pregunta
Which one of the following statements is true about software testing?
Respuesta
-
A. Static testing works on runtime environments.
-
B. Static testing performs code analysis.
-
C. Dynamic testing uses automated tools, but static testing does not.
-
D. Static testing is a more important testing technique than dynamic testing.
Pregunta 33
Pregunta
David is working on developing a project schedule for a software
development effort, and he comes across the chart shown here. What
type of chart is this?
Image:
45 (binary/octet-stream)
Respuesta
-
A. Work breakdown structure
-
B. Functional requirements
-
C. PERT chart
-
D. Gantt chart
Pregunta 34
Pregunta
Barry is a software tester who is working with a new gaming
application developed by his company. He is playing the game on a
smartphone to conduct his testing in an environment that best
simulates a normal end user, but he is referencing the source code as
he conducts his test. What type of test is Barry conducting?
Respuesta
-
A. White box
-
B. Black box
-
C. Blue box
-
D. Gray box
Pregunta 35
Pregunta
Miguel recently completed a penetration test of the applications that
his organization uses to handle sensitive information. During his
testing, he discovered a condition where an attacker can exploit a
timing condition to manipulate software into allowing him to perform
an unauthorized action. Which one of the following attack types fits
this scenario?
Respuesta
-
A. SQL injection
-
B. Cross-site scripting
-
C. Pass the hash
-
D. TOC/TOU
Pregunta 36
Pregunta
What part of the security review process are the input parameters
shown in the diagram used for?
Image:
46 (binary/octet-stream)
Respuesta
-
A. SQL injection review
-
B. Sprint review
-
C. Fagan inspection
-
D. Attack surface identification
Pregunta 37
Pregunta
What application security process can be described in these three
major steps?
1. Decomposing the application
2. Determining and ranking threats
3. Determining countermeasures and mitigation
Respuesta
-
A. Fagan inspection
-
B. Threat modeling
-
C. Penetration testing
-
D. Code review
Pregunta 38
Pregunta
Which one of the following approaches to failure management is the
most conservative from a security perspective?
Respuesta
-
A. Fail open
-
B. Fail mitigation
-
C. Fail clear
-
D. Fail closed
Pregunta 39
Respuesta
-
A. Waterfall
-
B. Agile
-
C. Lean
-
D. Spiral
Pregunta 40
Pregunta
Which of the following database keys is used by an RDBMS to
uniquely identify each row in a database table?
Respuesta
-
A. Foreign key
-
B. Primary key
-
C. Candidate key
-
D. Referential key
Pregunta 41
Pregunta
Which one of the following change management processes is initiated
by users rather than developers?
Respuesta
-
A. Request control
-
B. Change control
-
C. Release control
-
D. Design review
Pregunta 42
Pregunta
Which one of the following techniques is an effective countermeasure
against some inference attacks?
Respuesta
-
A. Input validation
-
B. Parameterization
-
C. Polyinstantiation
-
D. Server-side validation
Pregunta 43
Pregunta
Ursula is a government web developer who recently created a public
application that offers property records. She would like to make it
available for other developers to integrate into their applications.
What can Ursula create to make it easiest for developers to call her
code directly and integrate the output into their applications?
Respuesta
-
A. Object model
-
B. Data dictionary
-
C. API
-
D. Primary key
Pregunta 44
Pregunta
During what phase of the IDEAL model do organizations develop a
specific plan of action for implementing change?
Respuesta
-
A. Initiating
-
B. Diagnosing
-
C. Establishing
-
D. Acting
Pregunta 45
Pregunta
TJ is inspecting a system where the user reported a strange error
message and the inability to access files. He sees the window shown in
this figure. What type of malware should TJ suspect?
Image:
48 (binary/octet-stream)
Respuesta
-
A. Service injection
-
B. Encrypted virus
-
C. SQL injection
-
D. Ransomware
Pregunta 46
Pregunta
Charles is developing a mission-critical application that has a direct
impact on human safety. Time and cost are less important than
correctly functioning software. Which of the following software
development methodologies should he choose given these
requirements?
Respuesta
-
A. Agile
-
B. DevOps
-
C. Spiral
-
D. Waterfall
Pregunta 47
Pregunta
Which one of the following types of artificial intelligence attempts to
use complex computations to replicate the partial function of the
human mind?
Respuesta
-
A. Decision support systems
-
B. Expert systems
-
C. Knowledge bank
-
D. Neural networks
Pregunta 48
Pregunta
At which level of the Software Capability Maturity Model (SW-CMM)
does an organization introduce basic life-cycle management
processes?
Respuesta
-
A. Initial
-
B. Repeatable
-
C. Defined
-
D. Managed
Pregunta 49
Pregunta
Lucas runs the accounting systems for his company. The morning
after a key employee was fired, systems began mysteriously losing
information. Lucas suspects that the fired employee tampered with
the systems prior to his departure. What type of attack should Lucas
suspect?
Respuesta
-
A. Privilege escalation
-
B. SQL injection
-
C. Logic bomb
-
D. Remote code execution
Pregunta 50
Pregunta
Which one of the following principles would not be favored in an
Agile approach to software development?
Respuesta
-
A. Processes and tools over individuals and interactions
-
B. Working software over comprehensive documentation
-
C. Customer collaboration over contract negotiations
-
D. Responding to change over following a plan
¿Quieres crear tus propios Tests gratis con GoConqr? Más información.