Website Security

Name: _____________________

Date: _____________________

Instructions: Answer all questions. Write your answers clearly in the space provided.

Question 1:

Which one of the following statements should be used to disable just the fopen(), and file() functions?

A. disable_functions = fopen(), file()
B. disable_functions = fopen, file
C. functions_disable = fopen(), file()
D. functions_disable = fopen, file
Answer: _________
Question 2:

Which one of the following statements should be used to disable the use of two classes administrator and janitor?

A. disable_classes = “administrator, janitor”
B. disable_classes = class administrator, class janitor
C. disable_classes = class “administrator”, class “janitor”
D. disable_class = class “administrator”, class “janitor”
Answer: _________
Question 3:

What is the default value of max_execution_time directive? This directive specifies how many seconds a script can execute before being terminated.

A. 10
B. 20
C. 30
D. 40
Answer: _________
Question 4:

The memory_limit is only applicable if _______ is enabled when you configure PHP. Fill in the blank.

A. –enable-limit
B. -enable-memory-limit
C. –enable-memory-limit
D. -memory-limit
Answer: _________
Question 5:

Suppose all web material is located within the directory /home/www. To prevent users from viewing and manipulating files such as /etc/password, which one of the following statements should you use?

A. open_dir = “/home/www/”
B. open_dir = /home/www/
C. open_basedir = /home/www/
D. open_basedir = “/home/www/”
Answer: _________
Question 6:

Which Apache directive outputs Apache’s server version, server name, port and compile-in modules?

A. ServerSignature
B. ServerName
C. ServerDetails
D. ServerInfo
Answer: _________
Question 7:

Which directive determines which degree of server details is provided if the ServerSignature directive is enabled?

A. ServerAddons
B. ServerExtra
C. ServerTokens
D. ServerDetails
Answer: _________
Question 8:

Which directive should we disable to obscure the fact that PHP is being used on our server?

A. show_php
B. expose_php
C. print_php
D. info_php
Answer: _________
Question 9:

Say I want to change the extension of a PHP file, which of the following statements should I edit to change from .php to .html in the httpd.conf file?

A. AddType application/x-httpd-php .php
B. AddType application/x-httpd-php .asp
C. AddType application/x-httpd-asp .php
D. AddType application/x-httpd-asp .asp
Answer: _________
Question 10:

The developers of PHP deprecated the safe mode feature as of which PHP version.

A. PHP 5.1.0
B. PHP 5.2.0
C. PHP 5.3.0
D. PHP 5.3.1
Answer: _________

Answer Key

1: B
Solution: You can set disable_functions equal to a comma-delimited list of function names that you want to disable.
2: A
Solution: There may be classes inside the libraries that you’d rather not make available. You can prevent the use of these classes with the disable_classes directive.
3: C
Solution: This can be useful to prevent users’ scripts from consuming too much CPU time. If max_execution_time is set to 0, no time limit will be set.
4: C
Solution: This directive specifies, in megabytes, how much memory a script can use. Default value: 128M.
5: D
6: A
Solution: It is capable of displaying output like: Apache/2.2.11 (Ubuntu) Server at localhost Port 80.
7: C
Solution: Six options are available: Full, Major, Minimal, Minior, OS, and Prod. If it is set to Full ‘Apache/2.2.11 (Ubuntu) PHP/5.3.2 Server’ will be displayed.
8: B
Solution: Using the expose_php directive we can prevent PHP version details from being appended on our web server signature. When expose_php is disabled, the server signature will look like: Apache/2.2.11 (Ubuntu) Server.
9: A
Solution: Just change the .php to .html and your extension will change. This is used for security purpose.
10: C
Solution: This happened because safe mode often creates many problems as it resolves, largely due to the need for enterprise applications to use many of the features safe mode disables.