QuiztudyPREMIUM
🌍 All Study Guides📰 Blog💡 About
IBM Cybersecurity Analyst Professional Certificate • STUDY MODE

PRACTICE QUIZ

QUESTION 1 OF 41

Which operating system is susceptible to OS Command Injection attacks? Correct, all operating systems are susceptible.

A
Linux
B
Windows
C
MacOS
D
All operating systems are susceptible.Correct Answer
QUESTION 2 OF 41

What is a possible impact of running commands thought OS shell interpreters such as sh, bash, cmd.exe and powershell.exe? Correct! It makes it easier for a hacker to inject additional commands or arguments.

A
It makes it more difficult for a hacker to inject additional commands or arguments.
B
Powershell.exe is resistant to OS Injection attacks but sh, bash and cmd.exe have no built-in security.
C
It makes it easier for a hacker to inject additional commands or arguments.Correct Answer
QUESTION 3 OF 41

True or False: Safe coding practice avoides using OS commands when it can be avoided. Correct, Safe coding practice avoides using OS commands when it can be avoided.

A
TrueCorrect Answer
B
False
QUESTION 4 OF 41

True or False: Safe coding practice always runs commands through a shell interpreter. Correct! Safe coding practice does not always runs commands through a shell interperter.

A
True
B
FalseCorrect Answer
QUESTION 5 OF 41

True or False: Safe coding practice uses library functions when running OS commands. Correct, Safe coding practice uses library functions when running OS commands.

A
TrueCorrect Answer
B
False
QUESTION 6 OF 41

True or False: Safe coding practice uses blacklists and avoids the use of whitelists. Correct! Safe coding practice does not use blacklists but prefers the use of whitelists. SQL INJECTION

A
True
B
FalseCorrect Answer
QUESTION 7 OF 41

A hacker tailoring his actions based on the database errors the application displays is an example of which type of SQL Injection attack?

A
Blind injection
B
Error-basedCorrect Answer
C
UNION-based
D
Out of Band
QUESTION 8 OF 41

True or False: Use of prepared statements is an effective mitigation against SQL Injection attacks because it seperates the query structure from the query parameters. Correct, Use of prepared statements is an effective mitigation against SQL Injection attacks because it seperates the query structure from the query parameters.

A
TrueCorrect Answer
B
False
QUESTION 9 OF 41

True or False: Native database errors should be hidden from the user to prevent hackers from gaining insight into the internal structure of your application. Correct, Native database errors should be hidden from the user to prevent hackers from gaining insight into the internal structure of your application.

A
TrueCorrect Answer
B
False
QUESTION 10 OF 41

True or False: The use of object-relational mapping (ORM) libraries is a dangerous practice that can help hackers conduct successful SQL Injection attacks. Correct, The use of object-relational mapping (ORM) libraries is not a dangerous practice that can help hackers conduct successful SQL Injection attacks. SOFTWARE VULNERABILITIES

A
True
B
FalseCorrect Answer
QUESTION 11 OF 41

What happens in a file inclusion attack? Correct. A file inclusion attack is when an attacker uploads a file to a web application without proper validation. The attacker tricks the web application into showing or running files that should not be publicly visible or available.

A
An attacker uses a web application to send a browser-side script to another user.
B
An attacker sends more data to a web application than the memory buffer can handle.
C
An attacker uploads a file to a web application without proper validation.Correct Answer
D
An attacker places malicious code into an SQL statement through a web page.
QUESTION 12 OF 41

How can you view a complete list of an application’s pages and subpages that OWASP ZAP indexed during a scan? Correct. To view the URLs that ZAP scanned, first, expand Sites in the Tree window. Next, expand other sites to view more URLs discovered and explored.

A
Click the History tab in the Information window.
B
Click the Quick Start tab in the Workspace window.
C
Expand Sites in the Tree window.Correct Answer
D
Select ATTACK Mode from the list of modes.
QUESTION 13 OF 41

You and a team of developers are creating an application and collaborating on the project using a GitHub repository. You edited the code for one of the project’s files and committed your change. What should you do next? Correct. After committing a change, you should issue a pull request. Doing so notifies your team members that your changes are ready for review.

A
Clone the project.
B
Fork the repository.
C
Issue a pull request.Correct Answer
D
Merge your code with the repository.
QUESTION 14 OF 41

You just used Snyk to scan several GitHub repositories. One of the repositories is named itsarepo, and you’re especially interested in the results from scanning a file in that repository named buggycode.py. Where in Snyk could you find a detailed breakdown of this file’s vulnerabilities such as “Container is running without privilege escalation control”? Correct. You can import and scan your repositories from the Projects page in Snyk. Once that process is complete, the project security report is displayed. Expand itsarepo, and then click buggycode.py. The file’s Overview page opens. Finally, scroll down to the Issues tab for a detailed breakdown of the detected vulnerabilities. DEEP DIVE - INJECTION VULNERABILITY

A
Integrations > Vulnerability management > Vulcan
B
Projects > itsarepo > buggycode.yaml > Settings icon > GitHub integration
C
Projects > itsarepo > buggycode.yaml > IssuesCorrect Answer
D
Integrations > GitHub > itsarepo > buggycode.py
QUESTION 15 OF 41

Which vulnerability is being exploited in an OS Command Injection attack?

A
Improperly configured security settings in the MySQL database.
B
Poor user input sanitation and unsafe execution of OS commands.Correct Answer
C
Vulnerabilities in the operating system shell interpreter.
D
Vulnerabilities in the operating system kernel.
QUESTION 16 OF 41

What is a simple but effective way to protect against DLL hijacking?

A
Avoid using DLL libraries in commercial applications where security is a concern.
B
Write-protect the folders that contain your libraries.
C
Always use explicit paths to the commands or library applications.Correct Answer
D
Use only hijack resistant open-source libraries whenever possible.
QUESTION 17 OF 41

True or False: Safe coding practice runs code with the least possible privilege.

A
TrueCorrect Answer
B
False
QUESTION 18 OF 41

True or False: Safe coding practice always specifies relative paths when running applications or using shared libraries.

A
True
B
FalseCorrect Answer
QUESTION 19 OF 41

True or False: Safe coding practice does not let user input reach an OS command unchanged.

A
TrueCorrect Answer
B
False
QUESTION 20 OF 41

A hacker exfiltrating data by injecting an HTTPrequest command is an example of which type of SQL Injection attack?

A
UNION-based
B
Blind injection
C
Error-based
D
Out of BandCorrect Answer
QUESTION 21 OF 41

True or False: Limiting database user permissions is an ineffective strategy in preventing SQL Injection attacks since the injected code will run directly against the database regardless of the permission levels that have been set.

A
True
B
FalseCorrect Answer
QUESTION 22 OF 41

Which of the following will help reduce the SQL Injection attack surface?

A
Direct use of native operating system commands.
B
Showing users the exact nature of database input errors.
C
Direct SQL execution from user input values.
D
Use of stored procedures.Correct Answer
QUESTION 23 OF 41

When developing an application, using NoSQL instead of MySQL will have what effect on the applications susceptibility to SQL Injection attacks?

A
It will have no impact on the risk of an injection attack.
B
It will eliminate the injection attack surface.
C
It will increase the risk of an injection attack.
D
It will reduce, but not eliminate, the injection attack surface.Correct Answer
QUESTION 24 OF 41

You work at a software development company. The development team incorporates security checks throughout software development, and all their code passes them. But you want extra assurance that the applications that they develop can withstand real-world cyberattacks. You want to simulate real hacking techniques to identify any remaining vulnerabilities. What cyberdefense method should you use?

A
Security monitoring
B
System information event management
C
Dynamic application security testing
D
Penetration testingCorrect Answer
QUESTION 25 OF 41

How can you view a complete list of all vulnerabilities that OWASP ZAP detected while scanning an application?

A
Click the Request tab in the Workspace window.
B
Expand Sites in the Tree window.
C
Select Protected Mode from the list of modes.
D
Click the Alerts tab in the Information window.Correct Answer
QUESTION 26 OF 41

You find a public GitHub repository for an application and would like to use and modify the application’s code for your own project. However, you need to do so without impacting the current repository. What should you do?

A
Access your list of GitHub repositories, and then click Projects.
B
Access the repository’s web page, and then click Pull requests.
C
Access the repository’s web page, and then click Fork.Correct Answer
D
Access your list of GitHub repositories, and then click Sort.
QUESTION 27 OF 41

You’re the project manager for a development team working on code in a GitHub repository. You use Snyk to scan the repository for vulnerabilities. Snyk identifies only one vulnerability, “Container has no CPU limit”, and marks the vulnerability as low severity. The fix for this issue is currently in development, but you don’t know when it will be ready. What should you do next on the file’s Overview page?

A
Click Ignore, click Not vulnerable, type a comment in the comment field, and then click Save.
B
Click Ignore, click Ignore permanently, and then click Save.
C
Click Ignore, click Ignore temporarily, select the Until fix is available checkbox, and then click Save.Correct Answer
D
Click Ignore, click Not vulnerable, and then click Save.
QUESTION 28 OF 41

Which operating system is susceptible to OS Command Injection attacks?

A
Linux
B
Windows
C
MacOS
D
All operating systems are susceptible.Correct Answer
QUESTION 29 OF 41

What is a possible impact of running commands thought OS shell interpreters such as sh, bash, cmd.exe and powershell.exe?

A
It makes it more difficult for a hacker to inject additional commands or arguments.
B
Powershell.exe is resistant to OS Injection attacks but sh, bash and cmd.exe have no built-in security.
C
It makes it easier for a hacker to inject additional commands or arguments.Correct Answer
QUESTION 30 OF 41

True or False: Safe coding practice avoides using OS commands when it can be avoided.

A
TrueCorrect Answer
B
False
QUESTION 31 OF 41

True or False: Safe coding practice always runs commands through a shell interpreter.

A
True
B
FalseCorrect Answer
QUESTION 32 OF 41

True or False: Safe coding practice uses library functions when running OS commands.

A
TrueCorrect Answer
B
False
QUESTION 33 OF 41

True or False: Safe coding practice uses blacklists and avoids the use of whitelists.

A
True
B
FalseCorrect Answer
QUESTION 34 OF 41

True or False: Use of prepared statements is an effective mitigation against SQL Injection attacks because it seperates the query structure from the query parameters.

A
TrueCorrect Answer
B
False
QUESTION 35 OF 41

True or False: Native database errors should be hidden from the user to prevent hackers from gaining insight into the internal structure of your application.

A
TrueCorrect Answer
B
False
QUESTION 36 OF 41

True or False: The use of object-relational mapping (ORM) libraries is a dangerous practice that can help hackers conduct successful SQL Injection attacks.

A
True
B
FalseCorrect Answer
QUESTION 37 OF 41

What happens in a file inclusion attack?

A
An attacker uses a web application to send a browser-side script to another user.
B
An attacker sends more data to a web application than the memory buffer can handle.
C
An attacker uploads a file to a web application without proper validation.Correct Answer
D
An attacker places malicious code into an SQL statement through a web page.
QUESTION 38 OF 41

How can you view a complete list of an application’s pages and subpages that OWASP ZAP indexed during a scan?

A
Click the History tab in the Information window.
B
Click the Quick Start tab in the Workspace window.
C
Expand Sites in the Tree window.Correct Answer
D
Select ATTACK Mode from the list of modes.
QUESTION 39 OF 41

You and a team of developers are creating an application and collaborating on the project using a GitHub repository. You edited the code for one of the project’s files and committed your change. What should you do next?

A
Clone the project.
B
Fork the repository.
C
Issue a pull request.Correct Answer
D
Merge your code with the repository.
QUESTION 40 OF 41

You just used Snyk to scan several GitHub repositories. One of the repositories is named itsarepo, and you’re especially interested in the results from scanning a file in that repository named buggycode.py. Where in Snyk could you find a detailed breakdown of this file’s vulnerabilities such as “Container is running without privilege escalation control”?

A
Integrations > Vulnerability management > Vulcan
B
Projects > itsarepo > buggycode.yaml > Settings icon > GitHub integration
C
Projects > itsarepo > buggycode.yaml > IssuesCorrect Answer
D
Integrations > GitHub > itsarepo > buggycode.py
QUESTION 41 OF 41

12. You find a public GitHub repository for an application and would like to use and modify the application’s code for your own project. However, you need to do so without impacting the current repository. What should you do?

A
Access your list of GitHub repositories, and then click Projects.
B
Access the repository’s web page, and then click Pull requests.
C
Access the repository’s web page, and then click Fork.Correct Answer
D
Access your list of GitHub repositories, and then click Sort.

Ready to test your recall?

Which operating system is susceptible to OS Command Injection attacks? Correct, all operating systems are susceptible.

A
Linux
B
Windows
C
MacOS
D
All operating systems are susceptible.

How confident are you in this answer?