During testing

During development

During design

During all phases of application development

An insecure J2EE web application

A framework for analyzing applications that communicate using the HTTP and HTTPS, most common usage is an intercepting proxy

Static Source Code Analyser

Penetration Testing Tool

LiveHTTPHeaders

Sqlninja

Bobcat

WebGoat

Ounce

WebInspect

IBM RAD

None of the above

Ounce

DevInspect

AppScan

FXCop

Web Proxy

XSS Scanner

An insecure J2EE web application

None of the above

White-box testing is performed by an independent programmer team

Black-box testing uses the bottom-up approach

Black-box testing involves the business units

White-box testing examines the program internal logical structures

Grey-box testing

Black-box testing

White-box testing

None of these

A penetration test enumerates resources, and a vulnerability assessment enumerates vulnerabilities

They are one and the same

A penetration test identifies running services, and vulnerability assessments provide a more in-depth understanding of vulnerabilities

A penetration test exploits vulnerabilities, and a vulnerability assessment finds vulnerabilities

Acquiring, Testing, Installing

Testing, Remediation, Peer Review

Determine needs, Acquire resources, Install the patch

Both A & B

Set autocomplete to “0”

Set autocomplete to “Off”

Set autocomplete to some other value

Set autocomplete to “no-store”

No. Because leads to insecure storage of private information of the customer

Yes. Because it is a good logging practice to log all relevant information during an exception

Yes. Because it will help in troubleshooting specific customer problems

No. Because its an additional over head

SQL Injection

Denial of Service

XML Injection

All of the above

Resources to become unavailable to legitimate users

Cross Site Tracing

Server Instability

Both A and B

Web Server configuration files

Application configuration files

Application error handlers

All of the above

Java sand box environment provides protection against decompilation

Java is compiled into ELF binaries and cannot be decompiled

Java byte code can always be decompiled, code obfuscators can make the reverse engineering process more time confusing but cannot prevent it

Java is difficult to decompile because the Just-In-Time compiler automatically perform string encryption by default

Equivalent to normal users

Less than those of normal users as all administrators are trustworthy

No authentication is required for administrators

Greater than those of normal users

Only be used on administrator accounts to ensure continuous access to users

Only be used on user accounts to ensure that administrators are not locked out of the application

Only be used when there is a secure process to unlock the account

None of the above

Cannot be treated as a secure practice

Is a good way to hide passwords from hackers

Is perfectly fine for internal applications

Is perfectly fine for external user facing applications

Commercial applications

Custom built applications

In house developed applications

All of the above