t

Internet Security: How to Defend Against Attackers on the Web, Seco... CHAPTER 6 ASSESSMENT 1. One way to verify if a system is attacked by a brute-force attack is to periodically check the log files. A. True B. False 2. Content spoofing tactics often include which of the following? A. Spam e-mail links B. Forum links C. Chatroom links D. A and C only E. All of the above 3. How do XSS attacks differ from CSRF attacks? 4. Which of the following attacks involve the use of CR and LF characters? (Select two.) A. HTTP request smuggling Internet Security: How to Defend Against Attackers on the Web, Seco... 4. Which of the following attacks involve the use of CR and LF characters? (Select two.) A. HTTP request smuggling B. HTTP response smuggling C. HTTP request splitting D. HTTP response splitting 5. A common path traversal attack uses which syntax sequence to attempt to locate restricted areas on a server? A. ../ B. **/ C. CR D. LF 6. During a session fixation attack, in which ways can an attacker obtain a valid session identifier? (Select three.) A. Prediction B. Capture C. Fixation D. Spoofing Internet Security: How to Defend Against Attackers on the Web, Seco... 6. During a session fixation attack, in which ways can an attacker obtain a valid session identifier? (Select three.) A. Prediction B. Capture C. Fixation D. Spoofing 7. Which attack allows the attacker to access, read, delete, and modify information held within a database and even take control of the server on which the database is operating? 8. Which of the following are actual XML-related attacks? (Select two.) A. XML attribute blowup B. XML internal entities C. XML entity expression D. XML injection 9. Which of the following are Web site weaknesses discussed in this chapter? (Select three.) A. OS commanding B. Improper file system permissions 11. To avoid improper input handling, which approaches can you use when handling user input? (Select three.) A. Stripping B. Sanitization C. Rejecting known bad input D. Accepting only known good input 12. Which of the following is a strategy for reducing the risk of data leakage? A. Sanitization B. Strong firewall controls C. Authorization D. Encryption