stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
Ethical Hacking 9 Web App Security Flashcards | StudBud
Explore
/
Ethical Hacking 9 Web App Security
Ethical Hacking 9 Web App Security
49 terms
·
StudBud Administration
·
136 plays
Imported from external platform
Flashcards
49 cards
F
Practice quiz
P
Host live
L
Questions
49
Answers
1
What do Certificate Signing Request (CSR) contain? (3 answers)
AES private key
Organization name
RSA public key
Name
2
Before CSS, all font colors, styles, and other design elements had to be explicitly described in HTML.
False
True
3
Which step of the Handshake Process would the client receives a positive answer from the third party?
3
2
4
5
4
Hypertext Transfer Protocol (HTTP) is a what OSI layer?
5
6
4
7
5
Method names, headers, & HTTP are all case-sensitive.
False
True
6
Which HTTP Status Code is Redirection: the server redirects to another URI?
3XX
2XX
5XX
1XX
7
The digital certificate guarantees what? (3 answers)
Integrity
Reliability
Encryption
Availability
8
The .css extension allows programmers to define the style of elements only on individual pages.
False
True
9
HTML and CSS define the webpage's what?
base logic
vulcan logic
standard logic
dynamic logic
10
What is true about Cascading Style Sheets (CSS)? (3 answers)
a language used to create the style of a doc written in a markup language
sets the parameters for visual elements like fonts, layout & color schemes
behind the scenes code that drives the presentation of a webpage or website
CSS2 is the most common version used today
11
The Secure Sockets Layer protocol was developed to add security to web apps.
True
False
12
What is not a Web Server?
CGI
Apache
XAMPP
Nginx
13
A client-server computer program relies on what? (2 answers)
extranet
2 main computers w/different roles
2 main computers w/the same roles
internet
14
What method could an attacker potentially use to gain sensitive information?
TRACE
CONNECT
INVOKE
OPTIONS
15
The main format used for the PKI certificate is what, which is the most common certificate type used today?
U.820
A.495
Z.607
X.509
16
In the Burp Suite Hacking toolbar, this section contains a neat list of all the packages sent and returned.
Intercept
Dashboard
Proxy
Target
17
How can information disclosure be discovered using Apache?
using the command a2enmod ssl
generating a server error message
adding Options –Indexes to .htaccess
using a BURP cert
18
What is not true about Open Web Application Security Project (OWASP)?
works to improve the security of software in general
online comm that produces free printed material, and info on web app sec
closed sourced
a large number of members leading educational and training conferences
19
What is true about XAMPP? (3 answers)
can be easily installed on MAC IOS
has interpreters for Perl
contains an Apache server with MariaDB
most commonly used PHP development environment
20
Apache is software that connects the client with the server using what protocol?
SMB
HTTPS
HTTP
POP
21
What is not a language used on the server-side to translate information?
SLA
PHP
JSP
ASP.NET
22
What was not an OWASP Top 10 Web Application Security Risks for 2017?
Injection
Insecure Deserialization
XSS
XEX
23
To implement JavaScript in a webpage, what tags are used?
java and /java
start and /start
logic and /logic
script and /script
24
What is a web server designed for Windows servers & is considered the second most common web server on the market?
NoSQL
X-XSS
RFC
IIS
25
What are the two main versions of Burp Suite? (2 answers)
Professional Edition
Public Edition
Private Edition
Community Edition
26
What is true about the head and /head tags? (2 answers)
content includes metadata
title and style appear in this section
needs a declaration
it extends browser capabilities
27
What is not a traffic interception tool ?
Burp Suite
OWASP Zap
Fiddler
SOP
28
What is good about software framework? (2 answers)
go-between for data and the programming languages
language is based on the .NET framework
uses shorter commands
helps developers to more efficiently write code
29
What server is used mainly as a proxy?
Nginx
CGI
PHP
XAMPP
30
In the Burp Suite, to intercept traffic from the attacker's browser, what tab should you select first?
Sequencer
Options
Proxy
Repeater
31
What method could an attacker potentially upload a large file to initiate DDoS?
POST
PUT
PING
PATCH
32
What tool in the Burp Suite is used to perform a brute-force attack?
Project
Intruder
Repeater
Burp
33
HTTP Headers can be enabled using the following command?
a5enmod headers
a3enmod headers
a2enmod headers
a4enmod headers
34
What is an open-source WAF in Apache, that includes features to prevent information disclosure?
NaN
ModSecurity
DOM
XSS
35
What is not included in the basic options of Burp Suite?
Scanner
Proxy server
Decoder
Intruder
36
What is true about asymmetric encryption in protocols? (2 answers)
supports AES, the RC family, IDEA, DES, and 3DES algorithms
it is more efficient than symmetric encryption
it is less efficient than symmetric encryption
supports RSA, Diffie- Hellman, and DSA algorithms
37
What method is this an example of: http://www.example.com/login.php?username=john&password=123123
CONNECT
TRACE
HEAD
GET
38
The Public Key Infrastructure (PKI) produces what, to verify that an entity is indeed who they say they are? (2 answers)
ServerTokens
digital IDs
Information disclosure
certificates
39
What is true about JavaScript (3 answers)
object-oriented programming language
includes standard input & output functionalities
enhances the dynamic functionality of script-based applications & webpages
extends browser capabilities
40
.pem file format has a Base64 encoded DER cert, enclosed between the tags ALPHA CERTIFICATE and OMEGA CERTIFICATE.
True
False
41
What is a markup language designed to create the visual display in a web browser?
HTTPS
HMLT
HTML
HLMT
42
What computer is responsible for the website logic calculations and for storing sensitive information
client
server
Windows
IOS
43
What method could an attacker could potentially use it to change information on the server?
Porch
MEET
BARGE
PATCH
44
JavaServer Pages are web containers that are also known as what?
servlets
jslets
javlets
piglets
45
The HEAD method asks for a response that is identical to a GET request.
False
True
46
What tools generate digital signed certificates? (2 answers)
XCA
3DES
OpenSSL
DSC
47
What HTTP Security Headers would prevent On-Path (MITM) attacks?
X-XSS-PROTECTION
STRICT-TRANSPORT-SECURITY
X-Frame-OPTION
X-CONTENT-TYPE-OPTIONS
48
What is the OWASP Top 10?
10 most common opportunities discovered in the last three years
10 most common threats discovered in the last three years
10 most common discoveries discovered in the last three years
10 most common vulnerabilities discovered in the last three years
49
What tag defines what the document is in HTML5?
!DOCTYPE html
#LINKTYPE html
?DOCTYPE html
*LINKTYPE html
