Domain 4: Application Security

Question 1

API - 2 types

Answer 1

REST - Representative State Transfer:
Allows for cashing for for performance and scalability.
HTTP, JSON, XMF

SOAP - Simple Object Access Protocol
Structured Format. Only XML formatted data, no cashing, lower performance, no scalability
HTTP, FTP

Question 2

Cloud environment challenges

Answer 2

Modern programming languages and development methodologies

Question 3

OWASP Top 10

Answer 3

A1 - Broken Access Control
A2 - Cryptographic Failure
A3 - Injection
A4 - Insecure Design
A5 - Security MIsconfiguration
A6 - Vulnerable and Outdated Components
A7 - Identification and Authentication Failures
A8 - Software and Data Integrity Failures
A9 - Security Logging and Monitor Failures
A10 - Server Side Request Forgery (SSRF)

Question 4

Function Testing

Answer 4

Test against a particular function or component of a system or application

Question 5

Dynamic Application Security Testing (DAST)

Answer 5

• Black box

- Run against live systems

Question 6

Runtime Application Self-Protection (RASP)

Answer 6

Run against systems that have the ability to tune and focus their security measures based on actual environment variables and particular attack methods being used against them.

Question 7

Static Application Security Testing (SAST)

Answer 7

• White box - access to secure code
• Code is tested offline and not against production systems
• Particularly good for catching programming errors and vulnerabilities

Question 8

Approved APIs

Answer 8

Ensure they undergo evaluation and security testing

Ensure TLS or SSL encryption used properly meet guidelines.

Question 9

Software Development Lifecycle SDLC

Answer 9

1. Requirement Gather and Feasibility
2. Requirements Analysis
3. Design
4. Development and Coding
5. Testing
6. Maintenance

Question 10

STRIDE

Answer 10

Spoofing Identity
Tampering with Date
Repudiation
Information Disclosure
Denial of Service
Elevation of Privileges

Question 11

DREAD

Answer 11

Damage Potential
Reproducibility
Exploitability
Affected Users
Discoverability

Question 12

Web Application Firewall

Answer 12

Appliance or plug-in that parses and filters HTTP traffic from a browser or client and applies a set of rules before the traffic is allows to proceed to the actual application server

Question 13

XML Appliances

Answer 13

• used to specifically consume, manipulate, accelerate or secure XML transactions and transaction data.
• used to broker communications between cloud services and enterprise applications.
• XML firewall: used to validate XML traffic before it reaches the actual application
• XML accelerator: designed to offload the processing of XML from the actual application and systems

Question 14

Federated Identity

Answer 14

Each organization maintains its on identity and verification systems that are unique and separate from the other organizations, and only contains their population of users and information.

Two main components
- Identity Provider (IdP): holds authentication mechanism for its users to prove their identity to the system

• Relying Party (RP): take assertions provided by the IdP and uses it to make determinations whether to grant to a secure application and what type of access is granted.

Question 15

SAML

Answer 15

• XML based.
• used to exchange information used in the authentication and authorization process between parties.

-used for information exchange between identity providers and service providers and it contains within the XML block the required information that each system needs or provides

Question 16

OAuth

Answer 16

-authorization framework that enables a third-party application to obtain limited access to an HTTP services either on behalf of a resource owner by orchestrating an approval interaction between the resources owner and the HTTP service

Question 17

OpenID

Answer 17

• authentication protocol based on the OAuth specification.
• designed to provide developers with an easy and flexible mechanism to support authentication across organizations and utilize providers, alleviating the need to maintain their own password and stored system.

Question 18

WS-Federation

Answer 18

• specification defines mechanisms to allow different security reals to federate.
• authorized access to resources managed in one realm can be provided to security principals whose identities and attributes are managed in other realms.