WGU C836 EXAM WITH 100% VERIFIED SOLUTIONS!!
bounds checking - ANSWER>>to set a limit on amount of data we expect to get in so
set aside storage for that data
*required in most programming languages
* prevents buffer overflows
race conditions A software development weakness occurring when multiple processes
or multiple threads of a process have control of, or share access to, a resource and the
proper handling of that resource depends upon the correct ordering or timing of
transactions.
input validation - ANSWER>>a type of attack that can occur when we fail to validate the
input to our applications or take steps to filter out unexpected or undesirable content
format string attack - ANSWER>>a type of input validation attacks in which certain
print functions within a programming language can be used to manipulate or view the
internal memory of an application
Authentication attack - ANSWER>>A type of attack that can occur when we fail to use
strong authentication mechanisms for our applications
Authorization attack - ANSWER>>A type of attack that can occur when we fail to use
authorization best practices for our applications
Cryptographic attack - ANSWER>>A type of attack that can occur when we fail to
properly design our security mechanisms when implementing cryptographic controls in
our applications
client-side attack - ANSWER>>An attack that takes advantage of vulnerabilities in the
software installed on client machines or one that relies on social engineering to trick us
into being a party to an attack
,XSS (Cross Site Scripting) - ANSWER>>An attack carried out by embedding code,
either in some sort of scripting language, in web pages or other media where it is run by
a client browser
XSRF (cross-site request forgery) - ANSWER>>an attack in which the attacker places a
link on a web page in such a way that it will be automatically executed to initiate a
particular activity on another web page or application where the user is currently
authenticated
SQL Injection Attack - ANSWER>>Attacks against a web site that take advantage of
vulnerabilities in poorly coded SQL (a standard and common database software
application) applications in order to introduce malicious program code into a company's
systems and networks.
clickjacking - ANSWER>>An attack that takes advantage of the graphical display
capabilities of our browser to trick us into clicking on something we might not otherwise
server-side attack - ANSWER>>Any attack against the web server itself, leveraging
potential weaknesses including a lack of input validation, permissions set either too high
or low, or extraneous files left on the server from the development process
Protocol issues, unauthenticated access, arbitrary code execution, and privilege
escalation - ANSWER>>Name the 4 main categories of database security issues
web application analysis tool - ANSWER>>A type of tool that analyzes web pages or
web-based applications and searches for common flaws such as XSS or SQL injection
flaws, and improperly set permissions, extraneous files, outdated software versions,
and many more such items
protocol issues - ANSWER>>unauthenticated flaws in network protocols,
authenticated flaws in network protocols, flaws in authentication protocols
, arbitrary code execution - ANSWER>>An attack that takes advantage of an applications
vulnerability to allow the attacker to execute commands on a user's computer.
* arbitrary code execution in intrinsic or securable SQL elements
Privilege Escalation - ANSWER>>An attack that takes advantage of a software
vulnerability to gain access to resources that the user normally would be restricted from
accessing.
* via SQL injection or local issues
validating user inputs - ANSWER>>a security best practice for all software
* the most effective way of mitigating SQL injection attacks
Nikto (and Wikto) - ANSWER>>A web server analysis tool that performs checks for
many common server-side vulnerabilities & creates an index of all the files and
directories it can see on the target web server (a process known as spidering)
Burp Suite - ANSWER>> A popular GUI web analysis tool that has a free and
professional version; the professional version contains advanced tools to perform more
in-depth types of attacks
fuzzer - ANSWER>>A class of tool which works by bombarding our applications with all
manner of data and inputs from a wide variety of sources, in the hope that we can cause
the application to fail or to perform in unexpected ways
MiniFuzz File Fuzzer - ANSWER>>A tool developed by Microsoft to find flaws in
file-handling source code
BinScope Binary Analyzer - ANSWER>>A tool developed by Microsoft to examine
source code for general good practices
SDL Regex Fuzzer - ANSWER>>A tool developed by Microsoft for testing certain
pattern-matching expressions for potential vulnerabilities
bounds checking - ANSWER>>to set a limit on amount of data we expect to get in so
set aside storage for that data
*required in most programming languages
* prevents buffer overflows
race conditions A software development weakness occurring when multiple processes
or multiple threads of a process have control of, or share access to, a resource and the
proper handling of that resource depends upon the correct ordering or timing of
transactions.
input validation - ANSWER>>a type of attack that can occur when we fail to validate the
input to our applications or take steps to filter out unexpected or undesirable content
format string attack - ANSWER>>a type of input validation attacks in which certain
print functions within a programming language can be used to manipulate or view the
internal memory of an application
Authentication attack - ANSWER>>A type of attack that can occur when we fail to use
strong authentication mechanisms for our applications
Authorization attack - ANSWER>>A type of attack that can occur when we fail to use
authorization best practices for our applications
Cryptographic attack - ANSWER>>A type of attack that can occur when we fail to
properly design our security mechanisms when implementing cryptographic controls in
our applications
client-side attack - ANSWER>>An attack that takes advantage of vulnerabilities in the
software installed on client machines or one that relies on social engineering to trick us
into being a party to an attack
,XSS (Cross Site Scripting) - ANSWER>>An attack carried out by embedding code,
either in some sort of scripting language, in web pages or other media where it is run by
a client browser
XSRF (cross-site request forgery) - ANSWER>>an attack in which the attacker places a
link on a web page in such a way that it will be automatically executed to initiate a
particular activity on another web page or application where the user is currently
authenticated
SQL Injection Attack - ANSWER>>Attacks against a web site that take advantage of
vulnerabilities in poorly coded SQL (a standard and common database software
application) applications in order to introduce malicious program code into a company's
systems and networks.
clickjacking - ANSWER>>An attack that takes advantage of the graphical display
capabilities of our browser to trick us into clicking on something we might not otherwise
server-side attack - ANSWER>>Any attack against the web server itself, leveraging
potential weaknesses including a lack of input validation, permissions set either too high
or low, or extraneous files left on the server from the development process
Protocol issues, unauthenticated access, arbitrary code execution, and privilege
escalation - ANSWER>>Name the 4 main categories of database security issues
web application analysis tool - ANSWER>>A type of tool that analyzes web pages or
web-based applications and searches for common flaws such as XSS or SQL injection
flaws, and improperly set permissions, extraneous files, outdated software versions,
and many more such items
protocol issues - ANSWER>>unauthenticated flaws in network protocols,
authenticated flaws in network protocols, flaws in authentication protocols
, arbitrary code execution - ANSWER>>An attack that takes advantage of an applications
vulnerability to allow the attacker to execute commands on a user's computer.
* arbitrary code execution in intrinsic or securable SQL elements
Privilege Escalation - ANSWER>>An attack that takes advantage of a software
vulnerability to gain access to resources that the user normally would be restricted from
accessing.
* via SQL injection or local issues
validating user inputs - ANSWER>>a security best practice for all software
* the most effective way of mitigating SQL injection attacks
Nikto (and Wikto) - ANSWER>>A web server analysis tool that performs checks for
many common server-side vulnerabilities & creates an index of all the files and
directories it can see on the target web server (a process known as spidering)
Burp Suite - ANSWER>> A popular GUI web analysis tool that has a free and
professional version; the professional version contains advanced tools to perform more
in-depth types of attacks
fuzzer - ANSWER>>A class of tool which works by bombarding our applications with all
manner of data and inputs from a wide variety of sources, in the hope that we can cause
the application to fail or to perform in unexpected ways
MiniFuzz File Fuzzer - ANSWER>>A tool developed by Microsoft to find flaws in
file-handling source code
BinScope Binary Analyzer - ANSWER>>A tool developed by Microsoft to examine
source code for general good practices
SDL Regex Fuzzer - ANSWER>>A tool developed by Microsoft for testing certain
pattern-matching expressions for potential vulnerabilities
