Chapter 11

Front 1

1. “Failure to Preserve SQL Query Structure” is in the __________ CWE/SANS software error category.

Back 1

Insecure Interaction Between Components

Front 2

2. __________ programming is a form of design intended to ensure the continuing function of a piece of software in spite of unforeseeable usage of the software.

Back 2

Defensive

Front 3

3. Program _______ refers to any source of data that originates outside the program and whose value is not explicitly known by the programmer when the code was written.

Back 3

input

Front 4

4. Two key areas of concern for any input are the _______ of the input and the meaning and interpretation of the input.

Back 4

size

Front 5

5. A number of widely used standard C _________ compound the problem of buffer overflow by not providing any means of limiting the amount of data transferred to the space available in the buffer.

Back 5

library routines

Front 6

6. Program input data may be broadly classified as textual or ______.

Back 6

binary

Front 7

7. In the ________ attack the user supplied input is used to construct a SQL request to retrieve information from a database.

Back 7

SQL injection

Front 8

8. _________ attacks are most commonly seen in scripted Web applications.

Back 8

Cross-site scripting

Front 9

9. A variant where the attacker includes malicious script content in data supplied to a site is the __________ vulnerability.

Back 9

XSS reflection

Front 10

10. The process of transforming input data that involves replacing alternate, equivalent encodings by one common value is called _________.

Back 10

canonicalization

Front 11

11. The major advantage of ________ is its simplicity and its freedom from assumptions about the expected input to any program, service, or function.

Back 11

fuzzing

Front 12

12. A ________ occurs when multiple processes and threads compete to gain uncontrolled access to some resource.

Back 12

race condition

Front 13

13. UNIX related systems provide the chroot system function to limit a program’s view of the file system to just one carefully configured section that is known as a ________.

Back 13

chroot jail

Front 14

14. If privileges are greater than those already available to the attacker the result is a _________.

Back 14

privilege escalation

Front 15

15. The principle of ________ strongly suggests that programs should execute with the least amount of privileges needed to complete their function.

Back 15

least privilege