All of these are examples of DOS Attacks that render application unavailable or reasonably slow to respond

You must use java.sql.PreparedStatement to prevent SQL Injection as it performs string type checking of user inputs. They increase performance of the code in case of repeated SQL statements

In a Session Fixation attack , attacker assumes the identify of the vicitim using his sessionId and exploits their credentials at the server

True, Refer https://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/http/HttpSession.html#invalidate()

Tampering causes threat to Integrity

java.security Refer https://docs.oracle.com/javase/7/docs/api/java/security/package-summary.html

True. Refer https://docs.oracle.com/javaee/6/tutorial/doc/bnbxj.html

Spoofing causes threat to authentication

Abuse cases are derived from uses cases of the software system which are abnormal

Refer https://owasp.org/www-community/vulnerabilities/CRLF_Injection

WAF. A traditional firewall cannot secure webservers froma malicious traffic attack as the attack occurs at layer 7 of the network stack.

Operationally Critical Threat, Asset and Vulnerability Evaluation (OCTAVE) ian an information risk evaluation method the enables organization to determine the risk factors affeting the confidentiality, integrity and availability of assets

True.Elements of KMS include Keys, Certificates and Identities

AutoCloseable. Refer https://docs.oracle.com/javase/8/docs/api/java/lang/AutoCloseable.html

DBMS_CRYPTO. Refer https://docs.oracle.com/database/121/ARPLS/d_crypto.htm#ARPLS664

Due to Insecure Direct Object References, attacker gets the idea about internal implementation and may use the objects as part of URL to access and modify sensitive information without any authorization

Manual Secure Code Review has less chance of getting false-postive and false-negatives but is time consuming

Security requirements are negative requirements specifying what the software should not do

DAST. Refer https://www.microfocus.com/en-us/products/webinspect-dynamic-analysis-dast/overview

Session is used track the information of a web user as HTTP is a stateless protocol. Refer https://en.wikipedia.org/wiki/Session_(computer_science)

java.util.logging Refer https://docs.oracle.com/javase/7/docs/api/java/util/logging/package-summary.html

Information disclosure is aimed to read a file that one was not granted access to, or to read data in transit

A system that does not perform auditing can be exploited by repudiation

SDLC consists of Requirement, Design, Development, Testing , Deployment and Maintenance

True. Printinting the stack trace can provide information to attacker about the structure and state of the process

True. An attacker can send any file and execute a command from the file

Application recieves inputs form various sources asuch as human users, browsers and network devices that can be suspicious or untrusted and hence you must validate it

Security Quality Requirements Engineering (SQUARE) provides means fo eliciting, categorizing and priortizing security requiremetns for information technology systems and applications

Refer https://docs.oracle.com/javase/8/docs/api/javax/crypto/SecretKey.html

True. If the time period of session is set for a shorter duration, then the attacker gets less time to steal the cookies, thus reducing the risk of stolen cookies

Tampering is aimed to maliciously change/modify persitent data, such as persistent data in a database, alteration of data in transit between two computers over an open network such as the internet

Errors. Refer https://docs.oracle.com/javase/7/docs/api/java/lang/Error.html

Maintenace and monitoring includes set of activites that are being carried out to continously maintain the security of the web hosting environment.

All of these annotations can beused for error handling in Spring MVC. Refer https://spring.io/blog/2013/11/01/exception-handling-in-spring-mvc

False. Checked Exceptions are compile time exceptions and can be handled by programmers

SAST must be used in Development phase of SDLC

True. Server Banner gives out the product and version details which leads to information disclosure vulnerability

Remember the Confidentiality, Integrity and Availability (CIA) Triad

In CSRF attack the user, who is the victim holds an active session with a trusted site and simulatenously visits a malicious site which injects an HTTP request for the trusted site into the victim user’s session

False. Leaving trace enable in production may expose critical infromation and allow attackers to alter and manipulate the application. Refer https://tomcat.apache.org/tomcat-9.0-doc/config/http.html#Common_Attributes

Log levels available in log4j are Debug, Warn, Info, Fatal, Error and Off

Invalida Data Input can cause HTML Splitting, XFS, XSS, LDAP Injection, SQL Injection, Xpath Injection, XML Injection, XXE Injection, Buffer Overflows and File uploads

Using the information received from an error message, an attacker identifies vulnerabilities for launching various web application attacks

Refer https://owasp.org/www-project-enterprise-security-api/

Security requirements act as an input for Secure Design

setMaxInactiveInterval() . Refer https://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/http/HttpSession.html#setMaxInactiveInterval(int)

Software Assurance Maturity Model (SAMM)

Refer https://docs.oracle.com/javase/7/docs/technotes/guides/security/jaas/JAASRefGuide.html

All of these. Refer https://www.baeldung.com/spring-security-session

Finally block. Refer https://docs.oracle.com/javase/tutorial/essential/exceptions/finally.html