HP Assessing Web Application Security Sample Questions:

1. What is a logout signature?

A) a user-supplied keyword that will be inserted into the WebInspect scan data to indicate each response where a logout occurred
B) a snapshot of the session state found when the user has lost session state
C) the toolbar feature in Web Macro Recorder which automatically determines the macros regular expression
D) a regular expression used to identify those responses that indicate session state has been lost

2. Which statement best describes the purpose and use of the Web Form Values file?

A) The Web Form Values file establishes and maintains "state" with the application by monitoring web form authentication methods.
B) The Web Form Values file acts as a proxy between WebInspect and the target application.
C) The Web Form Values file captures web form values for comparison to scan results.
D) The Web Form Values file establishes a set of static values to be used for crawling web forms.

3. Which statement best describes the Request Retry Count function?

A) The Request Retry Count indicates how much time WebInspect will spend on a request before marking the requested page as a null response.
B) The Request Retry Count indicates how long to wait for a response.
C) The Request Retry Count indicates how many times to attempt a request before marking it as a null response.
D) The Request Retry Count indicates how long to wait before re-requesting the same, non-responsive page.

4. The default installation of Apache often includes a /Manuals/ directory full of copies of the manual in various languages, for example, English, Spanish, and French. How would you configure WebInspect to scan the whole site, to save on the scan duration time, and to omit those static folders?

A) Enable the Smart Assessment feature so only Apache-centric checks will be sent.
B) Add a Session Exclusion for the URL = /Manuals/.
C) Create a customized policy with only the Apache web server branch enabled, omitting all those checks that pertain to non-Apache servers.
D) Specify a deep-linked folder in the Starting URL field. Enable the Restrict to Folder setting for that directory and all subdirectories.

5. What does the list of Discovered hosts within the Site view of WebInspect represent?

A) all possible hosts indicated by WebInspect license
B) all hosts that have been scanned by WebInspect
C) all hosts intended to be scanned by WebInspect
D) all hosts referenced anywhere within the target site

Solutions: