1. Which attack allows the attacker to take control of the application to execute an SQL query created by the attacker?
(A) SQL injection
(B) Direct
(C) SQL
(D) Application
2. A website that allows users to enter text, such as a comment or a name, and then stores it and later displays it to other users, is potentially vulnerable to what kind of attack?
(A) Cross-site scoring scripting
(B) Cross-site request forgery
(C) Cross-site scripting
(D) Two-factor authentication
3. Which attack forces a user (end user) to execute unwanted actions on a web application in which he/she is currently authenticated?
(A) Cross-site scoring scripting
(B) Cross-site request forgery
(C) Cross-site scripting
(D) Two-factor authentication
4. Even with two-factor authentication, users are vulnerable to which attacks?
(A) Man-in-the-middle
(B) Cross attack
(C) Scripting
(D) Radiant
5. Which factor is used in many applications, where two independent factors are used to identify a user?
(A) Cross-site scripting
(B) Cross-site request forgery
(C) Two-factor authentication
(D) Cross-site scoring scripting
6. The system that allows the user to be authenticated once and multiple applications can then verify the user’s identity through an authentication service without requiring reauthentication is:
(A) OpenID
(B) Sign-on system
(C) Security Assertion Markup Language
(D) Virtual Private Database
7. Which is a standard for exchanging authentication and authorization information between different security domains, to provide cross-organization authentication?
(A) OpenID
(B) Security Assertion Markup Language
(C) Sign-on system
(D) Virtual Private Database
8. Which ID standard is an alternative for single sign-on across organizations, and has seen increasing acceptance in recent years?
(A) OpenID
(B) Single-site system
(C) Security Assertion Markup Language
(D) Virtual Private Database
9. Which database allows a system administrator to associate a function with a relation, and the function returns a predicate that must be added to any query that uses the relation?
(A) OpenID
(B) Security Assertion Markup Language
(C) Single-site system
(D) Virtual Private Database
10. VPD (Virtual Private Database) provides authorization at the level of specific tuples, or rows, of a relation, and is therefore said to be a mechanism of:
(A) Row-level authorization
(B) Column-level authentication
(C) Authentication
(D) Authorization security
