GDC Application Security Exam - 在线考试测评模板

Q1:姓名

填空1

Q2:日期

日期

Q3:Which phase(s) of the Software Development Lifecycle (SDLC), one should consider Application Security? Select the correct answer from options below.

A: Development

B: Requirements & Design

C: QA

D: All of the above

Q4:What is the best way to maintain Web Application Security?

A: Input validation is enforced within the code security QA testing.

B: Configuration is done in such a way to display generic error messages.

C: Remove or protect hidden files and directories.

D: All of the above

Q5:Project Manager should finish the threat modeling using ___________ tool?

A: Microsoft SDL Threat Modeling Tool.

B: GE Threat Modeling Tool.

C: Chinasoft Threat Modeling Tool.

D: All of above.

Q6:Before move the design to next step, the threat modeling design should be approved by Delivery Manager or corresponding Security Expert of ___________.

A: Microsoft.

B: GE.

C: Chinasoft International.

D: All of above.

Q7:What can a Fault Induction attack cause?

A: Information Disclosure & Parameter Tampering

B: Denial of Service & Information Disclosure

C: Parameter Tampering & Denial of Service

D: Parameter Tampering & SQL Injection

Q8:Who will responsible with the solution of Mitigation Threat? ___________

A: Project Manager.

B: Developers.

C: Testers.

D: GE Security Expert.

Q9:Complete the following statement: Configuration Management attacks can be mitigated through disabling ____ services.

A: public

B: important

C: critical

D: unused

Q10:The nutshell of threat modeling is include _____.

A: Diagram.

B: Identify Threats.

C: Mitigate.

D: Validate.

E: All of the above.

Q11:Which one of the following options is NOT a recommended way within Input Validation? ___________

A: Centralize and automate your approach

B: Use regular expressions for checking input

C: Set a codepage

D: Use SQL stored procedures of custom views

Q12:Complete the following statement: Input validation refers to the process of validating all of the input to an application before using or accepting it. It is ______ to application security, and is the ______ of most application security vulnerabilities.

A: important, source

B: critical, source

C: important, basis

D: All of the above