Name:
Class:
Date:
Page 1
1. CGI programs can be written in many different programming and scripting languages, such as C/C++, Perl,
UNIX shells, Visual Basic, and FORTRAN.
a.
True
b.
False
ANSWER:
True
2. A user can view the source code of a PHP file by using their Web browser’s tools.
a.
True
b.
False
ANSWER:
False
3. Web applications written in CFML can also contain other client-side technologies, such as HTML and
JavaScript.
a.
True
b.
False
ANSWER:
True
4. JavaScript is a server-side scripting language that is embedded in an HTML Web page.
a.
True
b.
False
ANSWER:
False
5. OLE DB relies on connection strings that enable the application to access the data stored on an external
device.
a.
True
b.
False
ANSWER:
True
6. Web servers use which of the following elements in an HTML document to allow an individual to submit
information to the Web server?
a.
b.
c.
d.
ANSWER:
d
7. Which of the following is the interface that determines how a Web server passes data to a Web browser?
a.
Perl
b.
ASP
c.
CGI
d.
PHP
ANSWER:
c
Name:
Class:
Date:
Page 2
8. To check whether a CGI program works, you can test the URL in your Web browser. Which of the following
directories should you save the program to on your Web server before you check the URL in your Web
browser?
a.
bin
b.
cgi-bin
c.
cgi
d.
scripts
ANSWER:
b
9. Which of the following programming languages was originally used primarily on UNIX systems, but is used
more widely now on many platforms, such as Macintosh and Windows?
a.
HTML
b.
JScript
c.
VBScript
d.
PHP
ANSWER:
d
10. Adobe System’s ColdFusion uses its proprietary tags, which are written in which of the following
languages?
a.
XML
b.
DHTML
c.
PHP
d.
CFML
ANSWER:
d
11. Which specific type of tag do All CFML tags begin with?
a.
#
b.
CF
c.
CFML
d.
%
ANSWER:
b
12. Which of the following cross-site scripting vulnerabilities types relies on social engineering to trick a user
into visiting a maliciously crafted link or URL?
a.
reflected
b.
injected
c.
unvalidated
d.
Stored
ANSWER:
a
13. Visual Basic Script (VBScript) is a scripting language developed by which of the following companies?
a.
Sun Microsystems
Name:
Class:
Date:
Page 3
b.
Symantec
c.
Macromedia
d.
Microsoft
ANSWER:
d
14. Which of the following resources is an excellent starting point for security professionals when investigating
VBScript vulnerabilities?
a.
CVE Web site
b.
CERT
c.
Microsoft Security Bulletin
d.
Macromedia security
ANSWER:
c
15. Which JavaScript function is a “method” or sequence of statements that perform a routine or task?
a.
getElementById()
b.
document.write()
c.
CFLOCATION()
d.
ANSWER:
a
16. Which of the following interfaces is a standard database access method, developed by SQL Access Group,
that allows an application to access data stored in a database management system (DBMS)?
a.
OLE DB
b.
ODBC
c.
ADO
d.
JDBC
ANSWER:
b
17. Which of the following interfaces, developed by Microsoft, is a set of interfaces that enable applications to
access data stored in a database management system (DBMS)?
a.
OLE DB
b.
ODBC
c.
ADO
d.
JDBC
ANSWER:
a
18. Connecting to an MS SQL Server database with Microsoft’s Object Linking and Embedding Database (OLE
DB) requires using which of the following providers?
a.
ADSDSOOBJECT
b.
MySQLProv
c.
SQLOLEDB
d.
SNAOLEDB
Name:
Class:
Date:
Page 4
ANSWER:
c
19. Which of the following does Object Linking and Embedding Database (OLE DB) rely on that allows an
application to access data stored on an external device?
a.
connection strings
b.
program strings
c.
SQL strings
d.
string interfaces
ANSWER:
a
20. Which of the following is a programming interface for connecting a Web application to a database and
defines technologies that allow applications, such as Word or Excel, to interact with the Web?
a.
ADOSQL
b.
ADO
c.
SQL
d.
SNAOLEDB
ANSWER:
b
21. Which of the following is an alternative term used when referring to Application Security?
a.
SecAPP
b.
Apps
c.
AppSec
d.
SQLSec
ANSWER:
c
22. Which of the following cross-site scripting vulnerabilities types is especially harmful because it can be
delivered to subsequent users of the application?
a.
reflected
b.
injected
c.
unvalidated
d.
Stored
ANSWER:
d
23. Which type of vulnerabilities can result from a server accepting untrusted, unvalidated input?
a.
redirection
b.
spoofing
c.
injection
d.
insertion
ANSWER:
c
24. Which of the following results from poorly configured technologies that a Web application runs on top of?
a.
reflected corruption
Name:
Class:
Date:
Page 5
b.
stored misconfigurations
c.
reflected misconfigurations
d.
security misconfigurations
ANSWER:
d
25. Which of the following application tests analyzes an application’s source code for vulnerabilities, and is
therefore only possible when the source code of an application is available?
a.
Static Application Security Testing
b.
Fast Application Security Testing
c.
Dynamic Application Security Testing
d.
Executable Application Security Testing
ANSWER:
a
26. Which of the following application tests analyzes a running application for vulnerabilities?
a.
Static Application Security Testing
b.
Fast Application Security Testing
c.
Dynamic Application Security Testing
d.
Executable Application Security Testing
ANSWER:
c
27. What is the specific act of checking a user’s privileges to understand if they should or should not have
access to a page, field, resource, or action in an application?
a.
authentication
b.
authorization
c.
auditing
d.
discovery
ANSWER:
b
28. What is the specific act of filtering, rejecting, or sanitizing a user’s untrusted input before the application
processes it?
a.
input validation
b.
authorization
c.
input auditing
d.
discovery
ANSWER:
a
29. Which of the following refers to the flow a user is expected to follow in an application to accomplish a
goal?
a.
error handling
b.
delay logic
c.
client flow
d.
business logic
Name:
Class:
Date:
ANSWER:
d
30. What type of useful tools can a security tester find available in both Firefox and Chrome Web browsers?
a.
security tools
b.
scan tools
c.
developer tools
d.
SQL tools
ANSWER:
c
31. What is OWASP?
ANSWER:
Much like ISECOM, Open Web Application Security Project (OWASP) is an open, not-for-profit foundation
dedicated to finding and fighting the causes of software vulnerabilities. OWASP publishes the Ten Most
Critical Web Application Security Vulnerabilities paper that has been built into the Payment Card Industry
(PCI) Data Security Standard.
32. Dynamic Web pages need special components for displaying information that changes depending on user
input or information obtained from a back-end server. What kind of components can Web pages use to achieve
this?
ANSWER:
To do this, dynamic Web pages can use the tag, Common Gateway Interface (CGI), Active Server Pages
(ASP), PHP, ColdFusion, JavaScript, and database connector strings, such as Open Database Connector
(ODBC).
33. What is the main difference between HTML pages and Active Server Pages (ASP)?
ANSWER:
The main difference between HTML pages and Active Server Pages (ASP) is that with ASP, developers can
display HTML documents to users on the fly. That is, when a user requests a Web page, one is created at that
time. ASP is technology that enables developers to create dynamic, interactive Web pages and uses scripting
languages, such as JScript (Microsoft’s version of JavaScript) or VBScript.
34. Why should security professionals have at least a little knowledge about the Apache Web Server?
ANSWER:
Apache Web Server is said to run on more than twice as many Web servers as IIS, so some familiarity with
this Web server can be helpful in the security-testing profession. Apache has important advantages over the
competition: It works in just about any *nix platform as well as in Windows, and it’s free.
35. As a security professional, what should you do after identifying that a Web server you are testing is using
PHP?
ANSWER:
After you have identified the Web server as using PHP, you should investigate further for specific
vulnerabilities. Several versions of PHP running on Linux can be exploited because of a line in the Php.ini
file: The line file_uploads=on permits file uploads; however, this setting might allow a remote attacker to run
arbitrary code with elevated privileges. The best solution is to upgrade to the latest version of PHP, but if that’s
not possible, change the line to file_uploads=off.
36. What is ColdFusion and which company owns the rights to ColdFusion?
ANSWER:
ColdFusion is a server-side scripting language used to develop dynamic Web pages. Created by Allaire
Corporation, it’s now owned by Adobe Systems, Inc., ColdFusion it integrates Web browser, Web server, and
database technologies. It uses its proprietary tags written in ColdFusion Markup Language (CFML), and Web
applications written in CFML can contain other client technologies, such as HTML and JavaScript.
Name:
Class:
Date:
37. What is VBScript, and how can it be utilized?
ANSWER:
Visual Basic Script (VBScript) is a scripting language developed by Microsoft. You can insert VBScript into
your HTML Web pages to convert static Web pages into dynamic Web pages. The biggest advantage of using
a scripting language is that you have the features of powerful programming languages at your disposal. For
those who have programming experience, VBScript will be easy for you to pick up quickly.
38. What features does the current version of Wfetch offer?
ANSWER:
The current version of Wfetch offers the following features:
– Multiple HTTP methods
– Configuration of host name and TCP port
– HTTP 1.0 and HTTP 1.1 support
– Anonymous, Basic, NTLM, Kerberos, Digest, and Negotiate authentication types
– Multiple connection types
– Proxy support
– Client-certificate support
– Capability to enter requests manually or have them read from a file
– On-screen and file-based logging
39. What is ODBC, and how can it be utilized?
ANSWER:
The ODBC interface allows an application to access data stored in a database management system (DBMS),
such as Microsoft SQL, Oracle, or any system that can recognize and issue ODBC commands. Interoperability
between back-end database management systems is a key feature of the ODBC interface, allowing application
developers to focus on the application without worrying about any specific DBMS.
40. What is ActiveX Data Objects (ADO), and name an application that uses ADO to interact with the Web?
ANSWER:
ActiveX Data Objects (ADO) is a programming interface for connecting a Web application to a database.
ActiveX defines technologies that allow applications, such as Word or Excel, to interact with the Web. For
example, you can place an Excel spreadsheet in a Web page.
Match each item with a statement below.
a.
ASP
b.
SQLi
c.
ODBC
d.
PHP
e.
CGI
f.
virtual directory
g.
DAST
h.
dynamic Web pages
i.
static Web pages
j.
SAST
41. A technology that developers can use to display HTML documents to users on the fly
Name:
Class:
Date:
Page 8
43. Standard database access method developed by the SQL Access Group and allows interoperability between
back-end DBMSs
ANSWER:
c
44. Open-source server-side scripting language that runs on a server and enables Web developers to create
dynamic Web pages
ANSWER:
d
45. The interface that determines how a Web server passes data to a Web browser
ANSWER:
e
46. A pointer to the physical directory
ANSWER:
f
47. The analysis of a running application for vulnerabilities
ANSWER:
g
48. Ability to vary the information that is displayed on the Web page
ANSWER:
h
49. Displays the same information on the Web page regardless of who accesses the page
ANSWER:
i
50. Analysis of an application’s source code for vulnerabilities
ANSWER:
j