_________ ensures that the enforcement of organizational security policy does not rely on
voluntary web application user compliance. It secures information by assigning sensitivity labels
on information and comparing this to the level of security a user is operating at.

Say that “abigcompany.com” had a security vulnerability in the javascript on their website in the
past. They recently fixed the security vulnerability, but it had been there for many months. Is there
some way to 4go back and see the code for that error?
Select the best answer.

Which of the following is the best way an attacker can passively learn about technologies used in
an organization?

Which of the following is most effective against passwords?

The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort
reported Unicode attacks from 213.116.251.162. The file Permission Canonicalization vulnerability
(UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to
run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.
He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious
user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS
server. He does a quick query to discover that the directory exists, and a query to msadcs.dll
shows that it is functioning correctly. The attacker makes a RDS query which results in the
commands run as shown below:

What can you infer from the exploit given?

Bill is attempting a series of SQL queries in order to map out the tables within the database that he
is trying to exploit.

Choose the attack type from the choices given below.

Exhibit:

You are conducting pen-test against a company’s website using SQL Injection techniques. You
enter “anuthing or 1=1-“ in the username filed of an authentication form. This is the output returned
from the server.
What is the next step you should do?

Your boss Tess King is attempting to modify the parameters of a Web-based application in order
to alter the SQL statements that are parsed to retrieve data from the database. What would you
call such an attack?

When a malicious hacker identifies a target and wants to eventually compromise this target, what
would be among the first steps that he would perform? (Choose the best answer)

A particular database threat utilizes a SQL injection technique to penetrate a target system. How
would an attacker use this technique to compromise a database?