Chapter 7: Protecting Against Advanced Attacks

Question 1

A ____ attack is an attack launched from a single system and attempts to disrupt services.

Answer 1

DoS

Question 2

____ attacks are DoS attacks from multiple computers. DDoS attacks typically include sustained, abnormally high network traffic.

Answer 2

DDoS

Question 3

_____ attacks attempt to impersonate another system.

Answer 3

Spoofing

Question 4

MAC address spoofing changes the ___ ___ ____ and IP spoofing changes the ____ ____ ____.

Answer 4

source MAC address

source IP address

Question 5

____ ____ attacks attempt to mislead computers or switches about the actual MAC address of a system. They can be used to launch a man-in-the-middle attack.

Answer 5

ARP poisoning

Question 6

____ ____ attacks modify DNS data and can redirect users to malicious sites. Many DNS servers use DNSSEC to protect DNS records and prevent these attacks.

Answer 6

DNS poisoning

Question 7

____attacks send increased traffic to, or request additional traffic from, a victim.

Answer 7

Amplification

Question 8

_____ attacks attempt to discover passwords.

Answer 8

Password

Question 9

A _____ ____ attack attempts to guess all possible character combinations and a _____ attack uses all the words and character combinations stored in a file.

Answer 9

brute force

dictionary

Question 10

____ ____ policies thwart online brute force attacks and complex passwords thwart offline password attacks.

Answer 10

Account lockout

Question 11

Passwords are often stored as a____. Weak hashing algorithms are susceptible to collisions, which allow different passwords to create the same hash.

Answer 11

hash

Question 12

In a ___ ___ ___ attack, the attacker discovers the hash of the user’s password and then uses it to log on to the system as the user.

Answer 12

pass the hash

Question 13

In a____ attack, an attacker is able to create a password that produces the same hash as the user’s actual password. This is also known as a hash collision.

Answer 13

birthday

Question 14

A ____ ____ occurs when the hashing algorithm creates the same
hash from different passwords.

Answer 14

hash collision

Question 15

Password_____ adds additional characters to passwords before hashing them and prevents many types of attacks, including dictionary, brute force, and rainbow table attacks.

Answer 15

salting

Question 16

____attacks capture data in a session with the intent of using information to impersonate one of the parties. Timestamps and sequence numbers thwart these attacks.

Answer 16

Replay

Question 17

A known plaintext attack is possible if an attacker has both the _____ and the ____ created by encrypting the plaintext. It makes it easier to decrypt other data using a similar method.

Answer 17

plaintext and the ciphertext

Question 18

Attackers buy domain names with minor typographical errors in ____ ____(also called URL hijacking) attacks. The goal is to attract traffic when users enter incorrect URLs. Attackers can configure the sites with malware to infect visitors or configure the site to generate ad revenue for the attacker.

Answer 18

typo squatting

Question 19

____tricks users into clicking something other than what they think they’re clicking.

Answer 19

Clickjacking

Question 20

Attackers utilize the user’s session ID to ____ the user in a session ID attack.

Answer 20

impersonate

Question 21

____ ____ attacks allow an attacker to change the registration
of a domain name without permission from the owner.

Answer 21

Domain hijacking

Question 22

A ___-___-___-____ is a proxy Trojan horse that exploits vulnerable web browsers. When successful, it allows attacks to capture keystrokes and all data sent to and from the browser.

Answer 22

man-in-the-browser

Question 23

A ____ ____ is additional code that can be run instead of the original driver.

Answer 23

driver shim

Question 24

Attackers exploiting unknown or undocumented vulnerabilities are taking advantage of ___-____ vulnerabilities. The vulnerability is no longer a ___-____ vulnerability after the vendor releases a patch to fix it.

Answer 24

zero-day

Question 25

____ ____ occur when an application receives more data, or unexpected data, than it can handle and exposes access to system memory. Integer overflow attacks attempt to use or create a numeric value bigger than the application can handle.

Answer 25

Buffer overflows

Question 26

Buffer overflow attacks exploit buffer overflow vulnerabilities. A common method uses NOP instructions or NOP sleds such as a string of ___ commands. Two primary protection methods against buffer overflow attacks are ____ ____ and keeping a system ___ ___ ___.

Answer 26

x90

input validation and keeping a system up to date

Question 27

____ code has been optimized by an application and converted into an executable file.____ code is code that is evaluated, interpreted, and executed when the code is run.

Answer 27

Compiled

Runtime

Question 28

A common coding error in web-based applications is the lack of ____ ____.

Answer 28

input validation

Question 29

____ ____ checks the data before passing it to the application and prevents many types of attacks, including buffer overflow, SQL injection, command injection, and cross-site scripting attacks.

Answer 29

Input validation

Question 30

___-____ input validation is the most secure.

Answer 30

Server-side

Question 31

Attackers can bypass ___-____ input validation, but not server-side input validation.

Answer 31

client-side

Question 32

____ conditions allow two processes to access the same data at the same time, causing inconsistent results. Problems can be avoided by locking data before accessing it.

Answer 32

Race

Question 33

____-_____ routines within applications can prevent application failures and protect the integrity of the operating systems. Error messages shown to users should be generic, but the application should log detailed information on the error.

Answer 33

Error-handling

Question 34

___ ____ uses a digital signature within a certificate to authenticate and validate software code.

Answer 34

Code signing

Question 35

Code ___ and ____ techniques include static code analysis, dynamic analysis (such as fuzzing), stress testing, sandboxing, and model verification.

Answer 35

quality and testing

Question 36

Software development life cycle (SDLC) models provide structure for software development projects._____ uses multiple stages with each stage feeding the next stage._____ is a more flexible model and it emphasizes interaction with all players in a project.

Answer 36

Waterfall

Agile

Question 37

Secure DevOps is an____-aligned methodology. It stresses security throughout the lifetime of the project.

Answer 37

agile

Question 38

Common web servers are Apache (running on ____) and Internet Information Services (running on _____ servers).

Answer 38

Linux

Microsoft

Question 39

Databases are optimized using a process called ______. A database is considered normalized when it conforms to the first three normal forms.

Answer 39

normalization

Question 40

___ ____ attacks provide information about a database and can allow an attacker to read and modify data within a database. Input validation and stored procedures provide the best protection against these attacks.

Answer 40

SQL injection

Question 41

___-___ ___ allows an attacker to redirect users to malicious web sites and steal cookies. It uses HTML and JavaScript tags with < and > characters.

Answer 41

Cross-site scripting (XSS)

Question 42

___-____ ___ ___ causes users to perform actions on web sites without their knowledge and allows attackers to steal cookies and harvest passwords.

Answer 42

Cross-site request forgery (XSRF)

Question 43

___ and ___ attacks are mitigated with input validation techniques.

Answer 43

XSS and XSRF

Question 44

_____ are references that provide a foundation. They typically use a structure of basic concepts and provide guidance on how to implement security.

Answer 44

Frameworks

Question 45

_____ frameworks are based on relevant laws and regulations. A non-regulatory framework is not required by any law.

Answer 45

Regulatory

Question 46

Some frameworks are used within a single country (and referred to as ____ frameworks), while others are used internationally.

Answer 46

national

Question 47

Some frameworks only apply to certain industries. As an example, organizations that handle credit cards typically comply with the ___ ___ ___ ___ ___ ___.

Answer 47

Payment Card Industry Data Security Standard (PCI DSS)

Question 48

____-specific guides should be used when configuring specific systems.

Answer 48

Vendor