Free 312-95 sample questions

Correct answer: XML External Entity (XXE) Injection

XML External Entity (XXE) injection is a direct application-layer attack that exploits poorly configured XML parsers in the application code, allowing attackers to view files on the application server filesystem or interact with backend systems. SYN Flood and BGP Hijacking are network-layer attacks, while ARP Spoofing targets the data link layer. Understanding this distinction is critical for deploying appropriate defense-in-depth strategies at the application level.

Correct answer: Using approved tools, deprecating unsafe functions, and performing static analysis

In the Microsoft SDL, the Implementation phase strictly requires developers to use approved tools/compilers, deprecate unsafe functions (like older cryptographic algorithms or unmanaged unsafe code), and perform Static Application Security Testing (SAST). Threat modeling belongs to the Design phase. Dynamic analysis and fuzz testing belong to the Verification phase. Incident Response planning belongs to the Release phase. flowchart LR A[Design] -->|Transitions to| B[Implementation] B --> C[Use Approved Tools] B --> D[Deprecate Unsafe Functions] B --> E[Static Analysis]

Correct answers: Remote Code Execution (RCE) via malicious object graphs; Denial of Service (DoS) through resource exhaustion

BinaryFormatter is notoriously unsafe and is heavily deprecated in modern .NET because it can instantiate arbitrary types present in the application's loaded assemblies. An attacker can craft a malicious serialized payload that, when deserialized, executes arbitrary code (RCE). Additionally, it can lead to Denial of Service (DoS) by allocating massive objects or causing infinite loops during the deserialization process. It does not inherently cause SQL injection or direct DOM-based XSS.

BinaryFormatter is notoriously unsafe and is heavily deprecated in modern .NET because it can instantiate arbitrary types present in the application's loaded assemblies. An attacker can craft a malicious serialized payload that, when deserialized, executes arbitrary code (RCE). Additionally, it can lead to Denial of Service (DoS) by allocating massive objects or causing infinite loops during the deserialization process. It does not inherently cause SQL injection or direct DOM-based XSS.

Correct answer: False

False. Defining RBAC matrices and specifying encryption algorithms are explicitly security activities (or security requirements). Functional activities describe what the system should do for the user (e.g., 'The system must allow a user to add items to a cart'), whereas security activities dictate how the system must protect itself and its data (e.g., 'The system must encrypt cart data using AES-256').

Correct answer: Perform risk assessment

The SQUARE methodology consists of 9 steps. Step 1 is Agree on definitions. Step 2 is Identify security goals. Step 3 is Develop artifacts. Step 4 is Perform risk assessment. After developing the artifacts, the team must assess the risks to identify vulnerabilities and threats before selecting elicitation techniques (Step 5) and actually eliciting the security requirements (Step 6).

Correct answer: The OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) Model

The OCTAVE model is specifically designed as a self-directed information security risk evaluation methodology. It focuses on organizational risk and strategic practice rather than just technological flaws. Phase 1 builds asset-based threat profiles (organizational view), Phase 2 identifies infrastructure vulnerabilities (technological view), and Phase 3 develops security strategies and plans. SQUARE is focused on eliciting requirements rather than organizational risk profiling. STRIDE is a technical threat modeling tool, not an organizational risk assessment framework. flowchart TD A[Phase 1: Build Asset-Based Threat Profiles] --> B[Phase 2: Identify Infrastructure Vulnerabilities] B --> C[Phase 3: Develop Security Strategy and Plans]