cct250 ch09 quiz

Which of the following statements is NOT true regarding Structured Query Language (SQL) injections?

They are specific to only one vendor's database and cannot force the application to reveal restricted information.

Input validation refers to restricting the type of input or data the website will accept so that mistakes will not be entered into the system.

True

Which of the following statements is NOT true regarding the protection of databases?

Very few tools are available to locate, audit, and ultimately protect databases.

Which of the following refers to encryption using short keys or keys that are poorly designed and implemented that can allow an attacker to decrypt data easily and gain unauthorized access to the information?

Weak ciphers or encoding algorithms

Hunter collected the following banner information from a web server in his environment. What type of information can he determine solely by analyzing this banner?

Web server version

Typical categories of databases include all of the following EXCEPT

applied database.

Offloading services from the local intranet to the Internet itself can be done by using:

cloud computing

Security issues that can arise in cloud computing that are above and beyond those with standard environments include all of the following EXCEPT:

detectability.

The categories of Web application vulnerabilities include all of the following EXCEPT:

end-user education.

Web applications that require a user to log on prior to gaining access can track information relating to improper or incorrect logons; this information typically lists entries such as all of the following EXCEPT:

entry of a valid user ID and password.

Browser do not display

hidden fields

Exploitative behaviors against Web applications include all of the following EXCEPT:

man-in-the-middle attacks

Common database vulnerabilities include the following except _

many audit log settings

NGSSquirreL and AppDetective are:

pieces of software for performing audits on databases

Which of the following challenges can be solved by firewalls?

protection against buffer overflows

NCC SQuirreL and AppDetectivePro are ________.

software tools for performing audits on databases

Common database vulnerabilities include all of the following EXCEPT:

strong audit log settings.

SQLPing and SQLRecon are:

tools for locating rogue or unknown database installations.

-- are scripting languages. (Select two)

-Javascript -PHP

Web applications are used to

Allow dynamic content

Common forms of distributed denial of service (DDoS) attacks include all of the following EXCEPT:

Buffer overflows

What type of attack relies on a variation of the input validation attack but has the goal of going after a user instead of the application or data.

Cross-site scripting (XSS)

Which of the following is a hierarchical, structured format for storing information for later retrieval, modification, management, and other purposes?

Database

Which category of risk inherent with Web servers includes risks such as the ability to steal information from a server, run scripts or executables remotely, enumerate servers, and carry out denial of service (DoS) attacks?

Defects and misconfiguration risks

Which class of individuals works the most with the server and is primarily concerned with access to content and services?

End user

A denial of service (DoS) attack is considered a critical problem because it is very difficult to defeat.

False

A distributed denial of service (DDoS) attack is mostly an annoyance; however, a denial of service (DoS) attack is much more of a problem.

False

Databases can be a victim of source code exploits.

False

Input validation is a result of SQL injections.

False

The stability of a web server does not depend on the operating system

False

Which web session vulnerability is directly associated with sessions that remain valid for periods longer than they are needed?

Long-lived sessions

-- is used to audit databases.

NCC SQuirreL

Which of the following is the best choice for storing and retrieving massive volumes of data in extremely short periods of time?

NoSQL database

Which cloud computing service model provides a virtual infrastructure and some preinstalled software components?

PaaS

Which of the following is NOT considered a vulnerability of Web servers?

Poor end-user training

-- can be caused by the exploitation of defects and code.

SQL injection

Which class of individuals is primarily concerned with the security of the Web server because it can provide an easy means of getting into the local network?

Server administrator

Which of the following refers to a language used to interact with databases, making it possible to access, manipulate, and change data?

Structured Query Language (SQL)