Application Security

An organization's directory services are currently transmitting authentication credentials in cleartext, exposing sensitive operations to network eavesdropping. Which secure protocol configuration should they implement to encrypt directory access?

A network administrator discovers that their monitoring tools are using community strings "public" and "private" to query device statistics, sending this data across the network without encryption or authentication. Which protocol version should they migrate to?

A healthcare organization needs to transfer large patient database files via a secure channel. Which solution should they implement to ensure both authentication credentials and file contents remain confidential during transmission?

A company's email server is currently accepting messages without requiring encryption, allowing credentials and message content to be intercepted. Which configuration should they implement as a solution?

A large hospital uses email for communication. However, to ensure security, they want to ensure that sensitive information like Excel spreadsheets cannot leave the hospital's network and be exposed to the public. What security function would accomplish this need?

An organization is experiencing widespread phishing attacks where attackers are spoofing their domain to send malicious emails that appear to originate from legitimate company addresses. Which email authentication framework should they implement to specify handling policies for messages that fail sender verification and enable reporting of authentication failures?

A large company uses Bluetooth technology for short-range personal area networking. The organization has a security concern with bluesnarfing. What is the attacker doing to the organization?

An attacker has poisoned a DNS cache, redirecting users to a malicious site when they attempt to access the company's legitimate banking portal. Which security component would prevent this kind of attack?

A development team is releasing a new software update but users are receiving warnings that the publisher cannot be verified and the code may have been tampered with since distribution. Which security practice should they implement to verify software integrity?

A company wants to identify security flaws in their web application before deployment by analyzing the source code for hardcoded credentials and vulnerabilities, without running the program. Which testing methodology should they implement?

During a penetration test, an attacker bypasses client-side JavaScript validation that restricts special characters in a form field and submits malicious SQL commands directly to the server. Which security control should be implemented to prevent this attack?

An application is displaying detailed database error messages, including table names and column structures, to the public. This helps an attacker map the database schema for further attacks. Which secure coding practice should be implemented to prevent this information leakage?

A development team is manually reviewing a critical codebase before merging it into the main application. They discover a logic flaw that could allow unauthorized access to administrative functions. Which secure development practice enabled this discovery?

Which of the following statements is generally true of protocol security?

A penetration tester wishes to target a local DNS cache file on a Linux system, aiming to use their administrative privileges to edit the file and poison the DNS cache, redirecting users to a fake website. Which file would the penetration tester target?

An organization needs to test their production web application for vulnerabilities by simulating attacks against the application live in real time, while it is running. Which security testing methodology should they employ to identify runtime vulnerabilities?

An organization is told by its customers that many of the organization's emails end up in the "Spam" or "Junk" folders. What should the company's analysts check first?

An email gateway administrator notices a surge in messages claiming to be from the company's domain but originating from unauthorized IP addresses. Which DNS record type should they verify is properly configured to specify authorized mail servers for their domain?

A developer wishes to isolate a Linux process in a sandbox-like environment, ensuring that it is confined from the rest of the system to enhance security. Which command would be used?