Alice, a security engineer, was conducting security testing on the application. He discovered that users can see the website structure and file names. Under standard security practices, this can create a serious security risk because attackers may access hidden script files in the directory. Which of the following will mitigate this security risk?
Which of the following Spring Security Framework configuration settings ensures protection against session-fixation attacks by not allowing an authenticated user to log in again?
Asession-fixation-protection ="newSessionID"
Bsession-fixation-protection ="migrateSession"
Csession-fixation-protection ="enabled"
Dsession-fixation-protection ="protectSession"
0
Community Discussion
No comments yet. Be the first to start the discussion!
Understanding Application Security, Threats, and AttacksSecurity Requirements GatheringSecure Application Design and ArchitectureSecure Coding Practices for Input ValidationSecure Coding Practices for Authentication and AuthorizationSecure Coding Practices for CryptographySecure Coding Practices for Session ManagementSecure Coding Practices for Error HandlingStatic and Dynamic Application Security Testing (SAST & DAST)Secure Deployment and Maintenance
Understanding Application Security, Threats, and Attacks
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
Save question
0
Community Discussion
No comments yet. Be the first to start the discussion!
James is a Java developer working at INFR INC. He has written Java code that opens a file, reads it line by line, and displays its contents in the text editor. He wants to ensure that any unhandled exception raised by the code automatically closes the opened file stream. Which exception-handling block should he use for this purpose?
ATry-Catch-Finally block
BTry-Catch block
CTry-With-Resources block
DTry-Catch-Resources block
During which phase of the secure development lifecycle is threat modeling performed?
ACoding phase
BTesting phase
CDeployment phase
DDesign phase
Which of the following elements in a web.xml file ensures that cookies are transmitted through an encrypted channel?
A< connector IsSSLEnabled="Yes" / >
B< connector EnableSSL="true" / >
C< connector SSLEnabled="false" / >
D< connector SSLEnabled="true" / >
Which of the following methods helps you determine whether the DEBUG level is enabled?
AisDebugEnabled()
BEnableDebug ()
CIsEnableDebug ()
DDebugEnabled()
Stephen is a web developer at InterCall Systems. He was working on a Real Estate website for one of his clients and was assigned to design a web page with a property-search feature. He created the following searchpage.jsp:
However, when the application entered the security-testing phase, the security tester identified an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?
AHe should write code like out.Write ("You Searched for: " +ESAPI.encoder().encodeForHTML(search));
BHe should write code like out.write ("You Searched for: " + request.getParameter("search").toString());
CHe should write code like out.write ("You Searched for: " + request.getParameter("txt_Search"));
DHe should write code like out.write (("You Searched for: " +(search));
Jacob, a Security Engineer on the testing team, is inspecting the source code to identify security vulnerabilities.
Which type of security-assessment activity is Jacob performing?
ASCST
BDAST
CCAST
DSAST
Alice is a Java developer at Fygo Software Services Ltd. He has been assigned responsibility for designing a bookstore website for one of its clients. The website is intended to store articles in .pdf format. Alice’s superior advises him to design the ArticlesList.jsp page so that it displays a list of all articles on one page and sends a selected filename as a query string to redirect users to the articledetails.jsp page.
Alice wrote the following code on page load to read the filename.
After reviewing this code, Alice’s superior identified a security mistake and instructed him not to repeat it in future. Can you identify the type of vulnerability that may exist in the code?
AURL Tampering vulnerability
BForm Tampering vulnerability
CXSS vulnerability
DDirectory Traversal vulnerability
On a certain website, a secure login feature is intended to prevent brute-force attacks by implementing an account-lockout mechanism. An account is automatically locked after five failed attempts. This feature prevents users from logging in to the website until their account is unlocked. However, this security feature could be abused to carry out a __________ attack.
AFailure to Restrict URL
BBroken Authentication
CUnvalidated Redirects and Forwards
DDenial-of-Service (DoS)
Identify the formula used to calculate risk during threat modeling.
ARISK = PROBABILITY *Attack
BRISK = PROBABILITY * ASSETS
CRISK = PROBABILITY * DAMAGE POTENTIAL
DRISK = PROBABILITY * VULNERABILITY
The threat-modeling phase in which applications are decomposed and their entry points are examined from an attacker’s perspective is called ________.
AAttack Surface Evaluation
BThreat Classification
CThreat Identification
DImpact Analysis
Ted is an application security engineer who makes sure application-security activities are followed throughout the project lifecycle. One day, he analyzed various user interactions depicted in the use cases for a project in inception. Based on the use case at hand, he began depicting scenarios in which an attacker could misuse the application. Identify the activity Ted is performing.
ATed was depicting abuse cases
BTed was depicting abstract use cases
CTed was depicting lower-level use cases
DTed was depicting security use cases
A US-based ecommerce company has developed the website www.ec-sell.com to sell its products online. The website includes a feature that lets customers search for products by price. Recently, a bug-bounty participant discovered a security flaw on the Search page: they could view every product in the database table by changing the website URL from http://www.ec-sell.com/products.jsp?val=100 to http://www.ec-sell.com/products.jsp?val=200 OR '1'='1 -. The product.jsp page is vulnerable to
ASession Hijacking attack
BCross Site Request Forgery attack
CSQL Injection attack
DBrute force attack
For global exception handling, a developer should use the _________ annotation together with the @ExceptionHandler method annotation on any class.
A@Advice
B@ControllerAdvice
C@globalControllerAdvice
D@GlobalAdvice
Which line in the following Java code example could make the application susceptible to a session attack?
ALine No. 1
BLine No. 3
CLine No. 4
DLine No. 5
Identify the type of attack shown in the figure below:
Community Discussion