AP®︎ Cybersecurity: Topic 5.1 Flashcards

Files with no cryptographic barrier; an adversary with access to the device or drive can read their contents even if operating-system permissions are bypassed

A standard user has limited permissions for routine tasks; an administrative user has elevated privileges to control settings and typically access any files or applications

Permissions that allow more users or applications than necessary to view, edit, execute, or delete resources

A program stored as executable data whose instructions a computer runs; it may run locally or on a server as a web application accessed over a network

Verifying before processing that user input meets expected criteria such as type, length, range, format, or allowed characters

Supplying an unexpected character string that an application interprets as instructions, altering the program’s intended behavior

A computer language used to request information from databases and create, change, or delete database entries

Placing SQL commands or control characters in application input so a database query discloses, changes, adds, or deletes unintended data

The markup language used to describe the structure and content of web pages

A scripting language used for dynamic web content whose commands commonly execute in a website visitor’s browser

Injecting malicious code into a website so that a visitor’s browser executes it in the website’s context

XSS in which malicious code in a crafted link or request is reflected by a vulnerable website and executed by the victim’s browser

XSS in which malicious code is saved in website content and executed by the browsers of users who later view that content

A designated section of computer memory with a fixed size for holding data such as application input

Feeding more data into a buffer than it can hold, overwriting adjacent memory and potentially causing crashes or unauthorized code execution

A request sent using Hypertext Transfer Protocol that asks a server for the resource identified by a URL or path

Modifying a URL or GET request, often with ../ parent-directory components, to access server files outside the intended directory

Risk often involving highly sensitive or regulated data and a highly likely or easily performed exploit with severe consequences

Risk often involving sensitive data protected by encryption that is too weak or access controls that are not strict enough

Risk often involving less sensitive information with weak encryption or loose access controls and relatively limited likely harm