Secure Programming Practices

Through a successful format-string attack against a web application, an attacker is able to execute which of the following actions?

• All the above options

• Read and write to memory at will  

• Write only certain areas using tokens

• Read certain memory areas using the %s token

Setting the cookie flag to which of the following mode is a good programming practice?

• Protected

• Secure

• Locked

• Safe

Identify the correct statement in the following:

• B) Customer trust, reputation, financial, compliance, and privacy are the major reasons to implement a software security program.

• C) To secure online data, build secure software.

• A) Security is a technical problem and is the responsibility of the security manager.

• D) All the above options  

• E) A) and C)  

Secure practices for access control include which of the following?

• All the options 

• Business workflow

• Authorization on each request

• Role-based access

Which of the following is not recommended to secure web applications against authenticated users?

• Running the application with least privileges

• Client-side data validation  

• Filtering data with a default deny regular expression

• Using parameterized queries to access a database

Which of the following is the best approach to use when providing access to an SSO application in a portal?

• Mandatory access control

• Biometric access control

• Role-based access control

• Discretionary access control

Exception Handling refers to:

• During application execution, if certain special conditions are met, a specific subroutine 'exception handler' is called.

• All the options 

• Identifying all possible erroneous inputs, and managing how an application responds to them.

• Commercial runtime environments that contain tools to record debugging information from memory at the time of the exception, to provide 'root-cause' analysis information later.

Which of the following is not an authorization type?

• Role-based Access Control

• Mandatory Access Control

• User Access Control 

• Discretionary Access Control

Which of the following is a security advantage of managed code over unmanaged code?

• Size of the attack surface  

• Size of the chroot jail

• Number of lines of code

• Number of roles

There are various HTTP authentication mechanisms to authenticate a user. Login credentials are sent to the web server in clear text, in which of the following authentication scheme?

• Digest

• NTLM

• None of the options

• Basic

• Client Certificates