4.1 Application Security Development and Testing

Question 1

What is the primary task of IT professionals regarding application vulnerabilities?

Answer 1

Installing security patches for applications with vulnerabilities such as buffer overflow or SQL injection.

Question 2

What process is used to ensure the security of an application during development?

Answer 2

Quality assurance testing that includes functionality and security checks.

Question 3

What is input validation in application development?

Answer 3

Ensuring that unexpected data input into the application is not interpreted by the application.

Question 4

What is fuzzing?

Answer 4

An automated process where random types of data are input into applications to test their behavior.

Question 5

What are cookies in the context of web applications?

Answer 5

Small bits of information stored in browsers that help track user activity and maintain sessions.

Question 6

What is the purpose of secure cookies?

Answer 6

To require cookies to be transferred only over HTTPS or an encrypted connection.

Question 7

What is static code analysis?

Answer 7

A process where code is analyzed to find vulnerabilities such as buffer overflows and database injections.

Question 8

What does SAST stand for?

Answer 8

Static Application Security Testing.

Question 9

True or False: Static code analysis can find all types of security vulnerabilities.

Answer 9

False.

Question 10

What is code signing?

Answer 10

A process that ensures the integrity and origin of an application by digitally signing the code.

Question 11

What does sandboxing do for an application?

Answer 11

Restricts the application to only access necessary data for its operation.

Question 12

What is the role of monitoring in application security?

Answer 12

To track application use and identify security concerns or unusual activities.

Question 13

Fill in the blank: The process of applying random data inputs to test applications is called _______.

Answer 13

fuzzing.

Question 14

What is the risk associated with installing applications?

Answer 14

Potential embedding of malware within the application.

Question 15

What does a static analyzer output help developers do?

Answer 15

Identify vulnerabilities and suggest corrections in code.

Question 16

What is the significance of a developer’s signed key in code signing?

Answer 16

It allows the developer to sign any code they distribute.

Question 17

What security measure can limit an application’s access to personal information on a mobile device?

Answer 17

Sandboxing.

Question 18

What type of encryption is used in code signing?

Answer 18

Asymmetric encryption.

Question 19

What can application developers monitor to detect SQL injection attempts?

Answer 19

Logs generated from monitoring services.

Question 20

True or False: Cookies can contain malware.

Answer 20

False.

Question 21

What is the expected format for input validation when entering a zip code?

Answer 21

A specific number of characters or a certain set of numbers.

Question 22

What happens if input validation fails?

Answer 22

The application prompts the user to correct the input.

Question 23

What type of issues can static code analyzers identify?

Answer 23

Buffer overflows, database injections, and other vulnerabilities.

Question 24

What is one limitation of static code analysis?

Answer 24

It may not detect vulnerabilities related to cryptography implementation.