Oliver is a web server admin and wants to configure the Tomcat server in such a way that it should not serve index pages in the absence of welcome files. Which of the following settings in CATALINA_HOME/conf/ in web.xml will solve his problem?

• A. < servlet > < servlet-name > default < servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug <
  /param-name> < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > true < /param-value > < /init-param > < load-on-startup > l <
  /load-on-startup > < /servlet >
• B. < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug <
  /param-name>< param-value> 0 < /param value>< /init-param > < init-param > < param-name> listings
  < /param-name > < param-value > enable < /param-value > < /init-param > < load-on-startup> 1 <
  /load-on-startup > < /servlet >
• C. < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug <
  /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > false < /param-value > < /init-param > < load-on-startup > 1
  < /load-on-startup > < servlet >
• D. < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug <
  /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > disable < /param-value> < /init-param > < load-on-startup > 1
  < /load-on-startup> < /servlet >

Which of the following method will you use in place of ex.printStackTrace() method to avoid printing stack trace on error?

• A. ex.getMessage();
• B. ex.StackTrace.getError();
• C. ex.getError();
• D. ex.message();

The software developer has implemented encryption in the code as shown in the following screenshot.

However, using the DES algorithm for encryption is considered to be an insecure coding practice as DES is a weak encryption algorithm. Which of the following symmetric encryption algorithms will you suggest for strong encryption?

• A. SHA-1
• B. AES
• C. Triple DES
• D. MD5

Ted is an application security engineer who ensures application security activities are being followed during the entire lifecycle of the project. One day, he was analyzing various interactions of users depicted in the use cases of the project under inception. Based on the use case in hand, he started depicting the scenarios where attacker could misuse the application. Can you identify the activity on which Ted is working?

• A. Ted was depicting security use cases
• B. Ted was depicting abuse cases
• C. Ted was depicting abstract use cases
• D. Ted was depicting lower-level use cases

Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp
< form Id="form1" method="post" action="SearchProperty.jsp" >
< input type="text" id=''txt_Search" name="txt_Search" placeholder="Search Property..." / >
< input type="Submit" Id="Btn_Search" value="Search" / >
< /form >
However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?

• A. He should write code like out.write (("You Searched for:" +(search));
• B. He should write code like out.write ("You Searched for:" + request.qetParameter("search"l.toStrinq(ll;
• C. He should write code like out.write ("You Searched for:" + request.qetParameterf'txt Search"));
• D. He should write code like out-Write ("You Searched for:" +ESAPI.encoder().encodeForHTML(search));