QUESTION: 57 Topic: 1, Volume A

Annie has just succeeded in stealing a secure cookie via a XSS attack. She is able to replay the cookie even while the session is invalid on the server. Why do you think this is possible?

It works because encryption is performed at the application layer (single encryption key)
The scenario is invalid as a secure cookie cannot be replayed
It works because encryption is performed at the network layer (layer 1 encryption)
Any cookie can be replayed irrespective of the session status

Answer(s): A

Reveal Solution Next Question

QUESTION: 58 Topic: 1, Volume A

This attack technique is used when a Web application is vulnerable to an SQL Injection but the results of the Injection are not visible to the attacker.

Unique SQL Injection
Blind SQL Injection
Generic SQL Injection
Double SQL Injection

Answer(s): B

Reveal Solution Next Question

QUESTION: 59 Topic: 1, Volume A

A common technique for luring e-mail users into opening virus-launching attachments is to send messages that would appear to be relevant or important to many of their potential recipients. One way of accomplishing this feat is to make the virus-carrying messages appear to come from some type of business entity retailing sites, UPS, FEDEX, CITIBANK or a major provider of a common service.
Here is a fraudulent e-mail claiming to be from FedEx regarding a package that could not be delivered. This mail asks the receiver to open an attachment in order to obtain the FEDEX tracking number for picking up the package. The attachment contained in this type of e-mail activates a virus.

Vendors send e-mails like this to their customers advising them not to open any files attached with the mail, as they do not include attachments.
Fraudulent e-mail and legit e-mail that arrives in your inbox contain the fedex.com as the sender of the mail.
How do you ensure if the e-mail is authentic and sent from fedex.com?

Verify the digital signature attached with the mail, the fake mail will not have Digital ID at all
Check the Sender ID against the National Spam Database (NSD)
Fake mail will have spelling/grammatical errors
Fake mail uses extensive images, animation and flash content

Answer(s): A

Reveal Solution Next Question