Oliver, a Server Administrator (Tomcat), has set configuration in web.xml file as shown in the following screenshot. What is he trying to achieve?

He wants to transfer the entire data over encrypted channel

He wants to transfer only response parameter data over encrypted channel

He wants to transfer only request parameter data over encrypted channel

He wants to transfer only Session cookies over encrypted channel

Alice works as a Java developer in Fygo software Services Ltd. He is given the responsibility to design a bookstore website for one of their clients. This website is supposed to store articles in .pdf format. Alice is advised by his superior to design ArticlesList.jsp page in such a way that it should display a list of all the articles in one page and should send a selected filename as a query string to redirect users to articledetails.jsp page.Alice wrote the following code on page load to read the file name.String myfilename = request.getParameter('filename');String txtFileNameVariable = myfilename;String locationVariable = request.getServletContext().getRealPath('/');String PathVariable = '';PathVariable = locationVariable + txtFileNameVariable;BufferedInputStream bufferedInputStream = null;Path filepath = Paths.get(PathVariable);After reviewing this code, his superior pointed out the security mistake in the code and instructed him not repeat the same in future. Can you point the type of vulnerability that may exist in the above code?

Directory Traversal vulnerability

In a certain website, a secure login feature is designed to prevent brute-force attack by implementing account lockout mechanism. The account will automatically be locked after five failed attempts. This feature will not allow the users to login to the website until their account is unlocked. However, there is a possibility that this security feature can be abused to perform __________ attack.

Unvalidated Redirects and Forwards

Which of the following Spring Security Framework configuration setting will ensure the protection from session fixation attacks by not allowing authenticated user to login again?

session-fixation-protection ='.

session-fixation-protection ='newSessionlD'

session-fixation-protection ='.

session-fixation-protection ='enabled'

session-fixation-protection ='.

During his secure code review, John, an independent application security expert, found that the developer has used Java code as highlighted in the following screenshot. Identify the security mistake committed by the developer?

He is trying to use Non-parametrized SQL query

He is trying to use Whitelisting Input Validation

He is trying to use Non-parametrized SQL query

He is trying to use Blacklisting Input Validation

He is trying to use Parametrized SQL Query

Sam, an application security engineer working in INFRA INC., was conducting a secure code review on an application developed in Jav

He is attempting to use regular expression for validation

He found that the developer has used a piece of code as shown in the following screenshot. Identify the security mistakes that the developer has coded?

He is attempting to use client-side validation

He is attempting to use whitelist input validation approach

He is attempting to use regular expression for validation

He is attempting to use blacklist input validation approach

According to secure logging practices, programmers should ensure that logging processes are not disrupted by:

Multiple catching of incorrect exceptions

Re-throwing incorrect exceptions

Alice, a Server Administrator (Tomcat), wants to ensure that Tomcat can be shut down only by the user who owns the Tomcat process. Select the appropriate setting of the CATALINA_HOME/conf in server.xml that will enable him to do so.

< server port='-1' shutdown-*' >

< server port='-1' shutdown='SHUTDOWN' >

< server port='8080' shutdown='SHUTDOWN' >

Which of the following elements in web.xml file ensures that cookies will be transmitted over an encrypted channel?

< connector SSLEnabled='true' / >

< connector lsSSLEnabled='Yes' / >

< connector EnableSSL='true' / >

< connector SSLEnabled='false' / >

< connector SSLEnabled='true' / >

Identify the type of attack depicted in the figure below:

Cross-Site Request Forgery (CSRF) attack

Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp< form Id='form1' method='post' action='SearchProperty.jsp' >< input type='text' id=''txt_Search' name='txt_Search' placeholder='Search Property...' / >< input type='Submit' Id='Btn_Search' value='Search' / >< /form >However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?

He should write code like out-Write ('You Searched for:' +ESAPI.encoder().encodeForHTML(search));

He should write code like out.write ('You Searched for:' + request.qetParameter('search'l.toStrinq(ll;

He should write code like out.write ('You Searched for:' + request.qetParameterf'txt Search'));

He should write code like out.write (('You Searched for:' +(search));

Alice, a security engineer, was performing security testing on the application. He found that users can view the website structure and file names. As per the standard security practices, this can pose a serious security risk as attackers can access hidden script files in your directory. Which of the following will mitigate the above security risk?

< int param > < param-name>directorv-listinqs < param-value>false < /init-param >

< int-param > < param-name>directory-listinqs < param-value>true < /init-param >

< int param > < param-name>directorv-listinqs < param-value>false < /init-param >

< int-param > < param-name>listinqs < param-value>true < /init-param

< int-param > < param-name>listinqs < param-value>false < /init-param >

Identify the formula for calculating the risk during threat modeling.

RISK = PROBABILITY * DAMAGE POTENTIAL

IRISK = PROBABILITY * VULNERABILITY

Ted is an application security engineer who ensures application security activities are being followed during the entire lifecycle of the project. One day, he was analyzing various interactions of users depicted in the use cases of the project under inception. Based on the use case in hand, he started depicting the scenarios where attacker could misuse the application. Can you identify the activity on which Ted is working?

Ted was depicting abstract use cases

Ted was depicting lower-level use cases

Ted was depicting security use cases

A US-based ecommerce company has developed their website www.ec-sell.com to sell their products online. The website has a feature that allows their customer to search products based on the price. Recently, a bug bounty has discovered a security flaw in the Search page of the website, where he could see all products from the database table when he altered the website URL http://www.ec-sell.com/products.jsp?val=100 to http://www.ec-sell.com/products.jsp?val=200 OR '1'='1 -. The product.jsp page is vulnerable to

Cross Site Request Forgery attack

Suppose there is a productList.jsp page, which displays the list of products from the database for the requested product category. The product category comes as a request parameter value. Which of the following line of code will you use to strictly validate request parameter value before processing it for execution?

public boolean validateUserName() { Pattern p = Pattern.compile('[a-zA-Z0-9]*$'); Matcher m = p.matcher(request.getParameter(CatId')); boolean result = m.matches(); return result;}

public boolean validateUserName() {String CategoryId= request.getParameter('CatId');}

public boolean validateUserName() { Pattern p = Pattern.compile('[a-zA-Z0-9]*$'); Matcher m = p.matcher(request.getParameter(CatId')); boolean result = m.matches(); return result;}

public boolean validateUserName() { if(request.getParameter('CatId')!=null ) String CategoryId=request.getParameter('CatId');}

public.boolean validateUserName() { if(!request.getParamcter('CatId').equals('null'))}Answer: B

A developer has written the following line of code to handle and maintain session in the application. What did he do in the below scenario?

Maintained session by creating a Session variable user with value stored in uname variable.

Maintained session by creating a HTTP variable user with value stored in uname variable.

Maintained session by creating a Cookie user with value stored in uname variable.

Maintained session by creating a hidden variable user with value stored in uname variable.

Which of the following configuration settings in server.xml will allow Tomcat server administrator to impose limit on uploading file based on their size?

< connector... maxPostSize='file size' / >

< connector... maxFileLimit='file size' / >

< connector... maxPostSize='0'/>

< connector... maxFileSize='file size' / >

< connector... maxPostSize='file size' / >

Oliver is a web server admin and wants to configure the Tomcat server in such a way that it should not serve index pages in the absence of welcome files. Which of the following settings in CATALINA_HOME/conf/ in web.xml will solve his problem?

< servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > disable < /param-value> < /init-param > < load-on-startup > 1 < /load-on-startup> < /servlet >

< servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > false < /param-value > < /init-param > < load-on-startup > 1 < /load-on-startup > < servlet >

< servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > disable < /param-value> < /init-param > < load-on-startup > 1 < /load-on-startup> < /servlet >

< servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name>< param-value> 0 < /param value>< /init-param > < init-param > < param-name> listings < /param-name > < param-value > enable < /param-value > < /init-param > < load-on-startup> 1 < /load-on-startup > < /servlet >

< servlet > < servlet-name > default < servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name> < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > true < /param-value > < /init-param > < load-on-startup > l < /load-on-startup > < /servlet >