Question 1

A client-side attack that results in a user's computer becoming compromised just by viewing a Web page and not even clicking any content is known as a ____.

Accepted Answer

A)  buffer overflow 
B)  drive-by-download 
C)  denial of service 
D)  stack underflow 
A)  buffer overflow 
B)  drive-by-download 
C)  denial of service 
D)  stack underflow B

Question 2

A ____ attack is similar to a passive man-in-the-middle attack.

Accepted Answer

A)  replay 
B)  hijacking 
C)  denial 
D)  buffer overflow 
A)  replay 
B)  hijacking 
C)  denial 
D)  buffer overflow A

Question 3

HTML is a markup language that uses specific ____ embedded in brackets.

Accepted Answer

A)  blocks 
B)  marks 
C)  taps 
D)  tags 
A)  blocks 
B)  marks 
C)  taps 
D)  tags D

Question 4

Describe a drive-by-download attack.

Accepted Answer

Attackers first identify a vulnerable We

Question 5

Describe the two types of privilege escalation.

Accepted Answer

There are two types of privilege escalat

Question 6

Describe the differences between XML and HTML.

Accepted Answer

There are several significant difference

Question 7

When DNS servers exchange information among themselves it is known as a ____.

Accepted Answer

A)  resource request 
B)  zone disarticulation 
C)  zone transfer 
D)  zone removal 
A)  resource request 
B)  zone disarticulation 
C)  zone transfer 
D)  zone removal

Question 8

ARP poisoning is successful because there are few authentication procedures to verify ARP requests and replies.

Accepted Answer

A) True 
 B)False

Question 9

List three of the most common Web application attacks.

Accepted Answer

The most common Web applicatio

Question 10

Match between columns
                        Premises: Created from the Web site that a user is currently viewing
Privileges that are granted to users to access hardware and software resources
Exploits previously unknown vulnerabilities so victims have no time to prepare or defend against the attacks.
Takes advantage of vulnerability in the Web application program or the Web server software so that a user can move from the root directory to other restricted directories
Targets vulnerabilities in client applications that interact with a compromised server or process malicious data
The ability to move to another directory could allow an unauthorized user to view confidential files or even enter commands to execute on a server
An attack involving using a third party to gain access rights.
Injects scripts into a Web application server that will then direct attacks at clients
Exploiting a vulnerability in software to gain access to resources that the user would normally be restricted from obtaining

Accepted Answer

The Answer of Cross-site scripting (XSS) attack and Zero day is...

Question 11

____ is designed to display data, with the primary focus on how the data looks.

Accepted Answer

A)  XML 
B)  HTML 
C)  SGML 
D)  ISL 
A)  XML 
B)  HTML 
C)  SGML 
D)  ISL

Question 12

The SQL injection statement ____ discovers the name of a table.

Accepted Answer

A)  whatever%20 AND 1=(SELECT COUNT(*) FROM tabname); -- 
B)  whatever' AND 1=(SELECT COUNT(*) FROM tabname); -- 
C)  whatever; AND 1=(SELECT COUNT(*) FROM tabname); -- 
D)  whatever%; AND 1=(SELECT COUNT(*) FROM tabname); -- 
A)  whatever%20 AND 1=(SELECT COUNT(*) FROM tabname); -- 
B)  whatever' AND 1=(SELECT COUNT(*) FROM tabname); -- 
C)  whatever; AND 1=(SELECT COUNT(*) FROM tabname); -- 
D)  whatever%; AND 1=(SELECT COUNT(*) FROM tabname); --

Question 13

Users who access a Web server are usually restricted to the ____ directory.

Accepted Answer

A)  top 
B)  base 
C)  root 
D)  tap 
A)  top 
B)  base 
C)  root 
D)  tap

Question 14

Because the XSS is a widely known attack, the number of Web sites that are vulnerable is very small.

Accepted Answer

A) True 
 B)False

Question 15

The expression ____ up one directory level.

Accepted Answer

A)  ;/traverses 
B) ./traverses 
C)  %20/traverses 
D) ../ traverses 
A)  ;/traverses 
B) ./traverses 
C)  %20/traverses 
D) ../ traverses

Question 16

Because of the minor role it plays, DNS is never the focus of attacks.

Accepted Answer

A) True 
 B)False

Question 17

Describe a cross-site scripting (XSS) attack.

Accepted Answer

Unlike other Web application attacks, a

Question 18

Describe how to harden a Web server.

Accepted Answer

Enhancing the security of the Web server

Question 19

Web application attacks are considered ____ attacks.

Accepted Answer

A)  client-side 
B)  hybrid 
C)  server-side. 
D)  relationship 
A)  client-side 
B)  hybrid 
C)  server-side. 
D)  relationship

Question 20

Although traditional network security devices can block traditional network attacks, they cannot always block Web application attacks.

Accepted Answer

A) True 
 B)False

A client-side attack that results in a user's computer becoming compromised just by viewing a Web page and not even clicking any content is known as a ____.

A ____ attack is similar to a passive man-in-the-middle attack.

HTML is a markup language that uses specific ____ embedded in brackets.

Describe a drive-by-download attack.

Describe the two types of privilege escalation.

Describe the differences between XML and HTML.

When DNS servers exchange information among themselves it is known as a ____.

ARP poisoning is successful because there are few authentication procedures to verify ARP requests and replies.

List three of the most common Web application attacks.

____ is designed to display data, with the primary focus on how the data looks.

The SQL injection statement ____ discovers the name of a table.

Users who access a Web server are usually restricted to the ____ directory.

Because the XSS is a widely known attack, the number of Web sites that are vulnerable is very small.

The expression ____ up one directory level.

Because of the minor role it plays, DNS is never the focus of attacks.

Describe a cross-site scripting (XSS) attack.

Describe how to harden a Web server.

Web application attacks are considered ____ attacks.

Although traditional network security devices can block traditional network attacks, they cannot always block Web application attacks.

Introduction to Security

Malware and Social Engineering Attacks

Vulnerability Assessment and Mitigating Attacks

Host, Application, and Data Security

Network Security

Administering a Secure Network

Wireless Network Security

Access Control Fundamentals

Authentication and Account Management

Basic Cryptography

Advanced Cryptography

Business Continuity

Risk Mitigation

Filters

Exam 3: Application and Network Attacks

A client-side attack that results in a user's computer becoming compromised just by viewing a Web page and not even clicking any content is known as a ____.

A ____ attack is similar to a passive man-in-the-middle attack.

HTML is a markup language that uses specific ____ embedded in brackets.

Describe a drive-by-download attack.

Describe the two types of privilege escalation.

Describe the differences between XML and HTML.

When DNS servers exchange information among themselves it is known as a ____.

ARP poisoning is successful because there are few authentication procedures to verify ARP requests and replies.

List three of the most common Web application attacks.

____ is designed to display data, with the primary focus on how the data looks.

The SQL injection statement ____ discovers the name of a table.

Users who access a Web server are usually restricted to the ____ directory.

Because the XSS is a widely known attack, the number of Web sites that are vulnerable is very small.

The expression ____ up one directory level.

Because of the minor role it plays, DNS is never the focus of attacks.

Describe a cross-site scripting (XSS) attack.

Describe how to harden a Web server.

Web application attacks are considered ____ attacks.

Although traditional network security devices can block traditional network attacks, they cannot always block Web application attacks.

Introduction to Security

Malware and Social Engineering Attacks

Vulnerability Assessment and Mitigating Attacks

Host, Application, and Data Security

Network Security

Administering a Secure Network

Wireless Network Security

Access Control Fundamentals

Authentication and Account Management

Basic Cryptography

Advanced Cryptography

Business Continuity

Risk Mitigation

Filters