IBM C2150-139 Online Practice Questions and Exam Preparation

IBM C2150-139 Online Questions & Answers

• Question 41:

  How do you test a Web service with AppScan?

  A. interact with the Web service methods manually and then runAppScan to send the generated tests automatically
  B. explore the Web service automatically and then manually sends the generated tests one by one
  C. create a Python script for testing the service
  D. explore the Web service automatically and then runAppScan to send the generated tests automatically
  A. interact with the Web service methods manually and then runAppScan to send the generated tests automatically

• Question 42:

  Why is it important to encrypt the HTTP traffic for an authenticated connection between a client and Web server?

  A. to prevent SQL injection
  B. to prevent sensitive information from being stolen
  C. to prevent Cross-site Scripting
  D. to prevent Web site defacement
  B. to prevent sensitive information from being stolen

• Question 43:

  Which type of vulnerability allows an attacker to browse files that shouldn be accessible (e.g. *.bak, "Copy of", *.inc, etc.) or pages restricted forWhich type of vulnerability allows an attacker to browse files that shouldn? be accessible (e.g. *.bak, "Copy of", *.inc, etc.) or pages restricted for users with higher privileges?

  A. Insecure Cryptographic Storage
  B. Injection Flaw
  C. Failure to Restrict URL Access
  D. Insecure Communication
  C. Failure to Restrict URL Access

• Question 44:

  In the AppScan Application Data view, what can help you determine if your application was fully explored? (Choose two.)

  A. Visited URLs B. JavaScripts
  C. Cookies
  D. Broken links
  A. Visited URLs B. JavaScripts
  D. Broken links

• Question 45:

  After 30 minutes your scan stops with an out-of-session error. What is a possible cause of this error?

  A. Redundant path limit was too low.
  B. A parameter was not tracked.
  C. Flash parsing was turned off.
  D. Platform authentication was not configured.
  B. A parameter was not tracked.

• Question 46:

  Which statement is true about application-specific vulnerabilities?

  A. They exist in third-party components and are fixed by applying security patches.
  B. They are caused by insecure coding and are fixed by modifying the application code.
  C. They are detected using application security scanners and exist in third-party components.
  D. They are known vulnerabilities and are fixed by modifying the application code.
  B. They are caused by insecure coding and are fixed by modifying the application code.

• Question 47:

  How does in-session detection work?

  A. checks if the in-session pattern is present in every test response you receive from the site
  B. pings the application every 5 seconds and verifies the connection
  C. sends the in-session detection request every 5 seconds and verifies that the in-session pattern exists
  D. updates the session token values to ensure that the user is still logged in
  C. sends the in-session detection request every 5 seconds and verifies that the in-session pattern exists

• Question 48:

  What happens when AppScan generates an Industry Standard report?

  A. It generates and executes industry-specific tests.
  B. It maps the discovered vulnerabilities to a set of industry-specific checkpoints.
  C. It provides industry-specific advisories.
  D. It applies an industry-specific test policy.
  B. It maps the discovered vulnerabilities to a set of industry-specific checkpoints.

• Question 49:

  Which type of vulnerability can occur when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter?

  A. Cross-site Scripting
  B. Insecure Direct Object Reference
  C. Injection Flaw
  D. Cross Site Request Forgery
  B. Insecure Direct Object Reference

• Question 50:

  Directories containing sensitive files must be hidden from the user. What is the best way to hide the existence and content of such a directory?

  A. configure your Web server to issue a response:403 ?Access forbidden
  B. configure your Web server to issue a response: 302 - Redirect to home
  C. list the directory contents
  D. configure your Web server to issue a response: 404 - Not Found
  D. configure your Web server to issue a response: 404 - Not Found