Cissp-Domain 8-Application Security

Front 1

1. If a database is protected from modification using only symmetric encryption, someone may still
be able to mount an attack by:

Back 1

a Moving blocks of data such that a field belonging to one person is a. assigned to another

Front 2

2. Why cannot outside programs determine the existence of malicious code with 100 percent
accuracy?

Back 2

c. The purpose of a string depends upon the context in which it is interpreted.

Front 3

3. Format string vulnerabilities in programs can be found by

Back 3

d. Including string specifiers in input data

Front 4

4. Files temporarily created by applications can expose confidential data if:

Back 4

c. File permissions are not set appropriately

Front 5

5. The three structural parts of a virus are:

Back 5

b. Infection, payload, and trigger

Front 6

6. An application that uses dynamic link libraries can be forced to execute malicious code, even
without replacing the target .dll file, by exploiting:

Back 6

b. The library search order

Front 7

7. In terms of databases, cryptography can:

Back 7

Improve availability by allowing data to be easily placed where authorized users can
access it

Front 8

8. Proprietary protocols and data formats:

Back 8

a. Are unsafe because they typically rely on security by obscurity

Front 9

9. Integrating cryptography into applications may lead to:

Back 9

d. Possible denial of service if the keys are corrupted

Front 10

types of Database management systems (DBMS)

Back 10

1) Hierarchical
2) Network
3) Relational
4) Object-Oriented
5) Object-Relational

Front 11

standardized access methods that provide an interface to the database

Back 11

Database Interface Language

Front 12

ACID lock control test

Back 12

Atomicity (all or no changes)
Consistency (integrity of transactions)
Isolation (results of transaction no visible until complete)
Durability (a completed transaction is permanent)

Front 13

uses an knowledge base and aset of algorithms and/or rules that infer new facts from knowledge

Back 13

Expert System Approach to Knowledge mgmt

Front 14

Knowledge mgt that organizes data into nodes that are arranged in layers and links between the nodes have specific weighting classifications

Back 14

Neural Networks

Front 15

Time-of-Check/Time-of-Use describes a problem that may be found in

Back 15

Kerberos, SESAME

Front 16

what are lock controls

Back 16

controls to read and write access to specific rows of data in relational system or objects in Object oriented system

Front 17

manage large, structured sets of data, proveide access to multiple users and enforce integrity of data

Back 17

DBMS

Front 18

Project management-based methodology used to plan,execute and control software development

Back 18

System Life Cycle

Front 19

an object derives data and functionality from another object

Back 19

Inheritance

Front 20

different object respond to the same command in defferent ways

Back 20

Polymorphism

Front 21

creating a new version of an object by replacing variables with other values
AND
allows different versions of the same information to exist at different classification levels

Back 21

Polyinstantiation

Front 22

Allows application to be divided into pieces called component and each component can exist in a different location

Back 22

Distributed Component Object Model (DCOM)

Front 23

comprehensive analysis of the features of a system to make sure it addresses the security problem that you may have

Back 23

Certification

Front 24

the official management decision to actually operate a system

Back 24

Accreditation

Front 25

designed to record all of the business transactions of an organization as they occur

Back 25

Online Transaction Processing (OLTP)

Front 26

The key objective of application security is to ensure:

Back 26

CIA of data

Front 27

For an application security program to be effective within your organization, it is critical to

Back 27

Develop the security policy that can be enforced

Front 28

There is no inherent difference between the representation of data and programming in computer memory can lead to injection attacks , characterized by executing data as instructions. This is the fundamental aspect of which of the following computer architecture

Back 28

Von Neumann

Front 29

An important characteristic of bytecode is that it

Back 29

is faster than interpreted lanuages

Front 30

Two cooperating process that simultaneously compete for a shared resource in such a away that they violate the system's security policy is commonly known as

Back 30

A covert channel

Front 31

The art of influencing people to divulge sensitive info is

Back 31

Social engineering

Front 32

The most effective defense agaist a buffer overflow attack is

Back 32

bounds checking

Front 33

It is extremely important that as one follows a software development project, security activities are performed

Back 33

c) in each stage of the life cycle

Front 34

Audit logs are what type of control?

Back 34

Detective

Front 35

Who can ensure an enforce the separation of duties by ensuring that programmers do not have access to production code?

Back 35

Software Librarian

Front 36

Technical evaluation of assurance to ensure that security requiementas have been met is known as

Back 36

certification

Front 37

Defect prevention rather than defect removal is characteristisc of which of the following software delveopment methodology?

Back 37

d) Clean room

Front 38

based on the waterfall mode, at each phase, 4 substages,..PDCA (Plan Do Check Act)

Back 38

Spiral model

Front 39

process for dev high quality software, where by prevention of errors is key...write the code correctly the first time

Back 39

clean room

Front 40

technique of using computer and computer ulitities to help with the systemaatic analysis, design, development, implementation, and maintenance of software.

Back 40

CASE (Computer Aided Software Engineering)

Front 41

A Security protection mechanism in which untrusted code, which is not signed, is restricted from accessing system resources is known as

Back 41

Sandboxing

Front 42

a Program that does not reproduced itself but pretends to be performing a legitimate action, while acting performing malicious operations in the background is the characteristic of what?

Back 42

Trojan

Front 43

A plot to take insignificant pennies from a a user's bank account and move them to the attacker's bank account is an example of

Back 43

Salami scam

Front 44

Role-based access control to protect confidentiality of data in databases can be achieved by which of the following?
a) views
b) encryption
c) hashing
d) masking

Back 44

Views

Front 45

The two most common forms of attacks against databases are

Back 45

Aggregation and inference

Front 46

A property that ensure only valid or legal transaction that do not violate any user-defined integrity constraints in DBMS technologies is known as

Back 46

Consistency

Front 47

Expert system are comprised of a knowledge base comprising modeled human experience and which of the following?

Back 47

Inference engine

Front 48

The best defense against session hijacking and MiTM attacks is to use the following in the development of your software

Back 48

Unique and random identification

Front 49

Who released the CCM in 1991

Back 49

CMU's Software Engineering Institute

Front 50

The Capabiltity Maturity Model focuses on___ and has _ levels that contain several key practices w/in each.

Back 50

quality management processes, 5 maturity levels

Front 51

describes the essential characteristics of an organization's security engineering process

Back 51

SSE-CMMI System Security Engineering-Compatibility Maturity Model Integration

Front 52

International group of experts, industry practitioners who produces open source and widely agreed upon best-practice security standard for the WWW

Back 52

WASC (Web Application Security Consortium)

Front 53

the process of controlling software by managing the version of all components and the realtion bwetween them

Back 53

SCM Software Configuration Management

Front 54

a _ reviews and approves all changes to system software

Back 54

Configuration Control Board (CCB)

Front 55

what are the 5 level of the CMMI

Back 55

1) Initial (chaotic, immature)
2) Managed (disciplined, capable)
3) Defined (documented, consistent)
4) Quantitatively Managed (predictable)
5) Optimizing (constant improvement)

Front 56

what is the different between System lifecycle and "System development lifecycle"

Back 56

system lifecycle is also concerned with post-development operation and maintenance

Front 57

System lifecycle (SLC) is replaced by

Back 57

SDLC (System Dev lifecycle)

Front 58

what has the most extensive material on applicaiton and system development

Back 58

Information Technology Infrastructure Library

Front 59

SLC consists of:

Back 59

1) Initiation and planning
2) Acquisition & development
3) Implementation
4) Operation & maintenance
5) Decommissioning

Front 60

Who performs unit testing

Back 60

programmers

Front 61

who performes acceptance testing

Back 61

customer/users

Front 62

What is regression testing

Back 62

testing new code against old functions/processes ..retest old features incase new feature broke an old one

Front 63

Deadlocking

Back 63

when two elements in a process are waiting for each other to respond

Front 64

Change management process

Back 64

1) Request
2) analyze request for feasibility
3) develop implementaiton strategy
4) Approval of change
5) develop change
6) Test change
7) Implementation
8) Review & verify change
9) report to managment

Front 65

Databases are used to combing the data from many sources into one discrete source. What new risk does this introduce?

Back 65

Databases may enable insider inference attacks

Front 66

Datbase design models have change over the yuears. Which of the following model places the data in the tables

Back 66

Relational database mgt system

Front 67

RDMS are used to show associations between objects contained in the database. Which of the following best describes a foreign key

Back 67

A foreign key is used to join one table to the primary key of another table

Front 68

In an RDB, which of the following is true concerning a primary key?

Back 68

The primary key must contain a non-null value in order to uniquely identify the tuple

Front 69

which of the folloing database attacks describes an attack where the perpetrator uses information gained through authorized activity to reach conclusion relating to unauthorized data?

Back 69

Inference attack

Front 70

A databsase that uses pre-defined groupings of data that can only be accessed based upon user's authroization level, uses which of the following access control models?

Back 70

view-based access control

Front 71

AN AI system that gather information from SMEs and attempts to use programmed rules to analyze problems and suggest a recommended COA is called which of the following

Back 71

Expert system approach

Front 72

System Life Cycle (SLC) contain a step that Software Development Life Cycle (SDLC) doesn't..Whcih one is it?

Back 72

Decommissioning/disposal

Front 73

Which of the following model shows both progress and costs in a visual manner?

Back 73

Spiral Model

Front 74

One of the major characteristics of a s/w complier is that it will

Back 74

Convert high level programming language into machine code

Front 75

The primary key is used to uniquely identifiy record in a database by adding additional variable to the primary key, two items with the same identifieer can be differentitated. This is often used to preent inferenc attacks

Back 75

Polyinstantiation

Front 76

CORBA is designed to

Back 76

controll access to called object modules

Front 77

Which of these attack abuses the trus and application server has in a client

Back 77

Cross Site Request Forgery (CSRF)

Front 78

Configuration magmt ensure tht approved changes are i;mplement as approved. Chang mgt ensure which of the following?

Back 78

Changes are submitted, approved and recorded

Front 79

Fail Secure means:

Back 79

Fail in such a way as to maintain security

Front 80

Which the of the following statement is true about certification and accreditation?

Back 80

Certification is the technical analysis of a system to ensure that specific security requirements are met

Front 81

Wher should full access control be granted

Back 81

The application itself

Front 82

The software development company suggests that a software escrow should be set up. What does this mean?

Back 82

A third party will keep a copy of the s/w to protect the customer

Front 83

Technique of using computers and computer utilities to help with the systematic analysis, design, development,implementation and maintenance of software

Back 83

Computer-Aided Software Engineering (CASE)

Front 84

form of rapid prototyping that required strict time limits on each phase and relies on tools that enable quick development.

Back 84

Rapid Application Development (RAD)

Front 85

Uncovering restricted information by using permissible data is refferred to as

Back 85

Aggregation/inference

Front 86

What is a polymorphic virus?

Back 86

A Virus that self-garbles

Front 87

a structural design for the development and implementation of distributed applications written in JAVA. Provides interfaces and methods to allow different applications to communicate across a networked environment

Back 87

Enterprise JavaBeans

Front 88

which of the following describes the Capability Maturity Model

Back 88

It improves software quality, reduced the life cycle of development dnd provide better project managment capabilities

Front 89

Expert System are build to provide human-type logic. One componenet of an expert sytem is its "if/then" logic what is this logic called?

Back 89

Rule-based programming

Front 90

Which of the following is a backdoor to an application or system created by the developer?

Back 90

Trapdoor

Front 91

what does EICAR test?

Back 91

Anitvirus software

Front 92

System functionality is broken down into a more detailed level at what phase of software development?

Back 92

Design specifications

Front 93

when one object is copied and the attributes of the second object ar modified

Back 93

polyinstantiation

Front 94

the different between datamarts and data warehouses is that datatmars

Back 94

fulfill a specific, targeted need/objective

Front 95

what type of security mechanism is used in ActiveX

Back 95

Digital Signature

Front 96

different between Smurf and Fraggle

Back 96

FRagge used UDP, not ICMP

Front 97

In the project initiation phase of software development, all of the following tasks should be performed expect

Back 97

Review customer requirments

Front 98

what is not a reeason that security has been excluded from tytpical softwer development?

Back 98

Security is not a programmer's job; it's the job of a security professional

Front 99

Stage of CMMI described as "chaotic, immature, unpredictable, reactive"

Back 99

Initial

Front 100

Stage of CMMI described as "disciplined, capable, reactive"

Back 100

Managed or "repeatable"

Front 101

Stage of CMMI described as "documented, consistent, proactive"

Back 101

Defined

Front 102

Stage of CMMI described as "predictable, measured and controlled"

Back 102

Quantitatively Managed

Front 103

Stage of CMMI described as "constant improvement, continuous process improvement"

Back 103

Optimizing

Front 104

model which creates a chain of traceability

Back 104

SABSA

Front 105

type of malware: 100% CPU, network traffic exceptionally high

Back 105

worm

Front 106

The totality of protection mechanisms including h/w, firmware and s/w

Back 106

TCB

Front 107

is the TCB part of the OS protection mechansim

Back 107

no

Front 108

Lowest level of EAL leves at which semi-formal testing is performed?

Back 108

EAL 5

Front 109

An important characteristic of bytecode is that it

Back 109

is faster than interpreted languages

Front 110

Granting rights to groups as opposed to individuals is an example of

Back 110

abstraction

Front 111

To sucessfully complete a vuln assesment, it is critical tthat protection system are well understood. THis objective includes:

Back 111

Threat definition, target identification and faciliity characterization

Front 112

The term disaster recovery commonly refers to

Back 112

recovery of the technology enviornment

Front 113

who should ahve full control over an App

Back 113

no one

Front 114

two methods of enrypting data

Back 114

symmetric and symmetric