Chapter 3

Question 1

Acronym for API

Answer 1

Application Programming Interface

Question 2

DLL

Answer 2

Dynamic Link Library

Question 3

DOM

Answer 3

Document Object Model

Question 4

LDAP

Answer 4

Lightweight Directory Access Protocol

Question 5

RPC

Answer 5

Remote Procedure Call

Question 6

SAM

Answer 6

Windows Security Account Manager

Question 7

SQL

Answer 7

Structured Query Language

Question 8

SSL

Answer 8

Secure Socket Layer

Question 9

TLS

Answer 9

Transport Layer Security

Question 10

TOC/TOU

Answer 10

Time of Check / Time of Use

Question 11

XML

Answer 11

Extensible Markup Language

Question 12

XSRF

Answer 12

Cross Site Request Forgery

Question 13

XSS

Answer 13

Cross Site Scripting

Question 14

Most Cyber attacks begin at a ___ level associated with an ordinary user

Answer 14

Ordinary User

Question 15

Problem with weak validation?

Answer 15

1 cause behind most overflows, injection attacks and canonical structure errors

Question 16

Resource Exhaustion?

Answer 16

A state where a system doesn’t have the resources it needs to continue to function.

Question 17

Why did Microsoft reduce the number of processes and services that run in elevated mode in its operating systems?

Answer 17

Blocking privilege escalation is an important defensive step in a system.

Question 18

What is a memory leak?

Answer 18

When a program doesn’t dump it’s unused memory

Question 19

Another name for input validation?

Answer 19

Input Handling

Question 20

What are stored procedures?

Answer 20

Functions or SQL shortcuts or macros

Question 21

Three methods an attacker can use to achieve privilege escalation?

Answer 21

1. Use existing privileges to steal a better set of credentials 2. Exploiting vulnerabilities or weaknesses in processes that are running with escalated privileges. 3.

Question 22

SQL Injection attack?

Answer 22

Changing the where statement to ‘ or 1=1 -

Question 23

Persistent XSS attack?

Answer 23

Where XSS script is stored on the server

Question 24

Non Persistent XSS attack

Answer 24

Script is not stored on server but is injected and passed to the server

Question 25

DOM Based XSS attack

Answer 25

XSS script is executed in the browser as opposed to the server

Question 26

Pass the Hash attack?

Answer 26

Attacker grabs the hash used to authenticate and then passes or injects the hash in place of a password.

Question 27

What three languages make up the DOM

Question 28

What is TOC/TOU attack?

Answer 28

A time of check time of use attack is one that takes advantage of a separation between the time a program checks a value and when it uses a value.

Question 29

What is meant by the use of single or double quotes in SQL?

Answer 29

Double quotes are used to indicate identifiers within the database, which are objects like tables, column names, and roles. In contrast, single quotes are used to indicate string literals.

Question 30

What is a pointer?

Answer 30

A construct that refers to the memory location that holds the variable as opposed to a variable.

Question 31

What is pointer dereferencing?

Question 32

What is a race condition?

Question 33

How is a directory traversal performed?

Question 34

What is SSL stripping?

Question 35

What is shimming?

Question 36

What is refactoring?

Question 37

What is a memory leak?

Question 38

What is a buffer overflow?

Question 39

What is an integer overflow?

Question 40

What is a server-side request forgery?

Question 41

What is driver manipulation?

Question 42

Why do modern Microsoft operating systems perform driver signing?

Question 43

Provide an example of XSRF?

Question 44

What is an API attack?

Question 45

How does a replay attack occur?

Question 46

What is a DLL?

Question 47

What is a DLL injection?

Question 48

What is XML?

Question 49

What is an XML attack?