QUESTION 18
Identify the type of encryption depicted in the following figure.

QUESTION 19
Which line of the following example of Java Code can make application vulnerable to a session attack?

QUESTION 20
Which of the following configuration settings in server.xml will allow Tomcat server administrator to impose limit on uploading file based on their size?

QUESTION 21
A developer to handle global exception should use _________ annotation along with @ExceptionHandler method annotation for any class

QUESTION 22
Oliver, a Server Administrator (Tomcat), has set configuration in web.xml file as shown in the following screenshot. What is he trying to achieve?

QUESTION 23
Sam, an application security engineer working in INFRA INC., was conducting a secure code review on an application developed in Jav a. He found that the developer has used a piece of code as shown in the following screenshot. Identify the security mistakes that the developer has coded?

QUESTION 24
A developer has written the following line of code to handle and maintain session in the application. What did he do in the below scenario?

QUESTION 25
Which of the following relationship is used to describe security use case scenario?

QUESTION 26
Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp
< form Id=”form1″ method=”post” action=”SearchProperty.jsp” >
< input type=”text” id=”txt_Search” name=”txt_Search” placeholder=”Search Property…” / >
< input type=”Submit” Id=”Btn_Search” value=”Search” / >
< /form >
However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?

QUESTION 27
Which of the threat classification model is used to classify threats during threat modeling process?

QUESTION 28
Thomas is not skilled in secure coding. He neither underwent secure coding training nor is aware of the consequences of insecure coding. One day, he wrote code as shown in the following screenshot. He passed ‘false’ parameter to setHttpOnly() method that may result in the existence of a certain type of vulnerability. Identify the attack that could exploit the vulnerability in the above case.

QUESTION 29
Identify what should NOT be catched while handling exceptions.

QUESTION 30
Which of the following can be derived from abuse cases to elicit security requirements for software system?

QUESTION 31
Identify the formula for calculating the risk during threat modeling.

QUESTION 32
Which of the following state management method works only for a sequence of dynamically generated forms?

QUESTION 33
Jacob, a Security Engineer of the testing team, was inspecting the source code to find security vulnerabilities.
Which type of security assessment activity Jacob is currently performing?

QUESTION 34
Which of the following method will you use in place of ex.printStackTrace() method to avoid printing stack trace on error?

QUESTION 35
Which of the following DFD component is used to represent the change in privilege levels?

QUESTION 36
Suppose there is a productList.jsp page, which displays the list of products from the database for the requested product category. The product category comes as a request parameter value. Which of the following line of code will you use to strictly validate request parameter value before processing it for execution?