C836/D430 WGU FUNDAMENTALS OF
INFORMATION SECURITY QUIZ WITH
VERIFIED ANSWERS [GRADED A+]
bounds checking - ✔✔to set a limit on the amount of data we expect to
receive to set aside storage for that data
*required in most programming languages
* prevents buffer overflows
race conditions - ✔✔A type of software development vulnerability that
occurs when multiple processes or multiple threads within a process control
or share access to a particular resource, and the correct handling of that
resource depends on the proper ordering or timing of transactions
input validation - ✔✔a type of attack that can occur when we fail to
validate the input to our applications or take steps to filter out unexpected
or undesirable content
©morren2025/2026.Year published 2026.
,format string attack - ✔✔a type of input validation attacks in which certain
print functions within a programming language can be used to manipulate
or view the internal memory of an application
authentication attack - ✔✔A type of attack that can occur when we fail to
use strong authentication mechanisms for our applications
authorization attack - ✔✔A type of attack that can occur when we fail to
use authorization best practices for our applications
cryptographic attack - ✔✔A type of attack that can occur when we fail to
properly design our security mechanisms when implementing cryptographic
controls in our applications
client-side attack - ✔✔A type of attack that takes advantage of
weaknesses in the software loaded on client machines or one that uses
social engineering techniques to trick us into going along with the attack
©morren2025/2026.Year published 2026.
,XSS (Cross Site Scripting) - ✔✔an attack carried out by placing code in
the form of a scripting language into a web page or other media that is
interpreted by a client browser
XSRF (cross-site request forgery) - ✔✔an attack in which the attacker
places a link on a web page in such a way that it will be automatically
executed to initiate a particular activity on another web page or application
where the user is currently authenticated
SQL Injection Attack - ✔✔Attacks against a web site that take advantage
of vulnerabilities in poorly coded SQL (a standard and common database
software application) applications in order to introduce malicious program
code into a company's systems and networks.
clickjacking - ✔✔An attack that takes advantage of the graphical display
capabilities of our browser to trick us into clicking on something we might
not otherwise
©morren2025/2026.Year published 2026.
, server-side attack - ✔✔A type of attack on the web server that can target
vulnerabilities such as lack of input validation, improper or inadequate
permissions, or extraneous files left on the server from the development
process
Protocol issues, unauthenticated access, arbitrary code execution, and
privilege escalation - ✔✔Name the 4 main categories of database security
issues
web application analysis tool - ✔✔A type of tool that analyzes web pages
or web-based applications and searches for common flaws such as XSS or
SQL injection flaws, and improperly set permissions, extraneous files,
outdated software versions, and many more such items
protocol issues - ✔✔unauthenticated flaws in network protocols,
authenticated flaws in network protocols, flaws in authentication protocols
©morren2025/2026.Year published 2026.
INFORMATION SECURITY QUIZ WITH
VERIFIED ANSWERS [GRADED A+]
bounds checking - ✔✔to set a limit on the amount of data we expect to
receive to set aside storage for that data
*required in most programming languages
* prevents buffer overflows
race conditions - ✔✔A type of software development vulnerability that
occurs when multiple processes or multiple threads within a process control
or share access to a particular resource, and the correct handling of that
resource depends on the proper ordering or timing of transactions
input validation - ✔✔a type of attack that can occur when we fail to
validate the input to our applications or take steps to filter out unexpected
or undesirable content
©morren2025/2026.Year published 2026.
,format string attack - ✔✔a type of input validation attacks in which certain
print functions within a programming language can be used to manipulate
or view the internal memory of an application
authentication attack - ✔✔A type of attack that can occur when we fail to
use strong authentication mechanisms for our applications
authorization attack - ✔✔A type of attack that can occur when we fail to
use authorization best practices for our applications
cryptographic attack - ✔✔A type of attack that can occur when we fail to
properly design our security mechanisms when implementing cryptographic
controls in our applications
client-side attack - ✔✔A type of attack that takes advantage of
weaknesses in the software loaded on client machines or one that uses
social engineering techniques to trick us into going along with the attack
©morren2025/2026.Year published 2026.
,XSS (Cross Site Scripting) - ✔✔an attack carried out by placing code in
the form of a scripting language into a web page or other media that is
interpreted by a client browser
XSRF (cross-site request forgery) - ✔✔an attack in which the attacker
places a link on a web page in such a way that it will be automatically
executed to initiate a particular activity on another web page or application
where the user is currently authenticated
SQL Injection Attack - ✔✔Attacks against a web site that take advantage
of vulnerabilities in poorly coded SQL (a standard and common database
software application) applications in order to introduce malicious program
code into a company's systems and networks.
clickjacking - ✔✔An attack that takes advantage of the graphical display
capabilities of our browser to trick us into clicking on something we might
not otherwise
©morren2025/2026.Year published 2026.
, server-side attack - ✔✔A type of attack on the web server that can target
vulnerabilities such as lack of input validation, improper or inadequate
permissions, or extraneous files left on the server from the development
process
Protocol issues, unauthenticated access, arbitrary code execution, and
privilege escalation - ✔✔Name the 4 main categories of database security
issues
web application analysis tool - ✔✔A type of tool that analyzes web pages
or web-based applications and searches for common flaws such as XSS or
SQL injection flaws, and improperly set permissions, extraneous files,
outdated software versions, and many more such items
protocol issues - ✔✔unauthenticated flaws in network protocols,
authenticated flaws in network protocols, flaws in authentication protocols
©morren2025/2026.Year published 2026.
