Systems & Application Security Flashcards

Which technique tests an application by supplying random, unexpected, or malformed input to find vulnerabilities?

Answer: Fuzz testing

Fuzz testing (fuzzing) automatically generates large volumes of invalid or unexpected inputs to uncover crashes, memory leaks, and security vulnerabilities.

What is the OWASP Top 10 primarily used for?

Answer: Listing the ten most critical web application security risks

The OWASP Top 10 is a widely referenced awareness document listing the most critical security risks to web applications, used to guide secure development.

What does 'defense in depth' mean in the context of systems security?

Answer: Applying multiple overlapping security controls so no single failure compromises the system

Defense in depth layers multiple independent security controls so that if one layer fails, others continue to protect the system.

Which configuration management practice ensures that all changes to production systems are reviewed and approved before implementation?

Answer: Change control process

A change control process requires formal review and approval of system changes, reducing the risk of unauthorized or poorly planned modifications to production environments.

What is a 'sandbox' in the context of application security?

Answer: An isolated execution environment that restricts what a program can access or do

A sandbox confines an application to a restricted environment, limiting its access to system resources and preventing it from affecting other processes.

Which term describes the practice of keeping software current by applying vendor-released fixes for known vulnerabilities?

Answer: Patch management

Patch management is the systematic process of identifying, testing, and applying software updates (patches) to remediate known security vulnerabilities.

What is the purpose of a 'security baseline' for a system?

Answer: It defines the minimum acceptable security configuration that all systems must meet

A security baseline defines the minimum required security settings and configurations that a system must implement to be considered acceptably secure.