Kevin has been asked to write a short program to gather user input for a web application. He likes to keep his code neat and simple. He chooses to use printf(str) where he should have ideally used printf(?s? str). What attack will his program expose the web application to?

• A. Unicode Traversal Attack
• B. Cross Site Scripting
• C. Format String Attack
• D. SQL injection Attack

NTP allows you to set the clocks on your systems very accurately, to within 100ms and sometimes-even 10ms. Knowing the exact time is extremely important for enterprise security. Various security protocols depend on an accurate source of time information in order to prevent "playback" attacks. These protocols tag their communications with the current time, to prevent attackers from replaying the same communications, e.g., a login/password interaction or even an entire communication, at a later date. One can circumvent this tagging, if the clock can be set back to the time the communication was recorded. An attacker attempts to try corrupting the clocks on devices on your network. You run Wireshark to detect the NTP traffic to see if there are any irregularities on the network. What port number you should enable in Wireshark display filter to view NTP packets?

• A. TCP Port 124
• B. UDP Port 123
• C. TCP Port 126
• D. UDP Port 125

The following exploit code is extracted from what kind of attack?

• A. Distributed Denial of Service
• B. Remote password cracking attack
• C. Buffer Overflow
• D. SQL Injection
• E. Cross Site Scripting

The Open Web Application Security Project (OWASP) testing methodology addresses the need to secure web applications by providing which one of the following services?

• A. A security certification for hardened web applications
• B. Web application patches
• C. A list of flaws and how to fix them
• D. An extensible security framework named COBIT

What are the two basic types of attacks? (Choose two.

• A. DoS
• B. Sniffing
• C. Passive
• D. Active
• E. Cracking