Questions

1. Which of the following is not the input of whitebox review?
   1. Source code
   2. Threat-modeling documents
   3. Automated static code analysis results
   4. Antivirus scanning results
2. What are the tools doxygen and naturaldocs used for?
   1. Generating documents directly from source code
   2. Static code scanning
   3. Dynamic code scanning
   4. Reverse engineering
3. Which of the following are high-risk modules?
   1. Authentication
   2. Authorization
   3. API interfaces
   4. All of the above
4. Which one of the following APIs is not related to buffer overflow?
   1. strcpy
   2. strncat
   3. memcpy
   4. fwrite
5. What can cause missing authentication?
   1. The uses of partial URL match API to determine the need for authentication such as StartsWith and EndsWith
   2. No path canonicalization before validation
   3. No data normalization before validation
   4. All of the above