Transcender Sec + Tests

Question 1

A hacker has used a design flaw in an application to obtain unauthorized access to the application. Which type of attack has occurred?

Answer 1

escalation of privileges

Question 2

There are two type of privilege escalation:__________________.

Answer 2

vertical and horizontal

Question 3

With ___________ privilege escalation, the attacker obtains higher privileges by performing operations that allow the attacker to run unauthorized code.

Answer 3

vertical

Question 4

With _________ privilege escalation, the attacker obtains the same level of permissions as he already has but uses a different user account to do so.

Answer 4

horizontal

Question 5

A _______ is a term for lines of code that are inserted into an application to allow developers to enter the application and bypass the security mechanisms.

Answer 5

backdoor

Question 6

______________ are also referred to as maintenance hooks

Answer 6

Backdoors

Question 7

backdoor

Answer 7

term for lines of code that are inserted into an application to allow developers to enter the application and bypass the security mechanisms.

Question 8

escalation of privileges

Answer 8

An example would be when a hacker has used a design flaw in an application to obtain unauthorized access to the application.

Question 9

This hacker technique detects vulnerabilities through techniques such as social engineering, accessing supposedly confidential information on publicly available databases, dumpster diving, and shoulder surfing.

Answer 9

Passive reconnaissance

Question 10

Passive reconnaissance is an attempt to gain information about targeted computers and networks _________ actively engaging with the systems.

Answer 10

without

Question 11

In _________ reconnaissance the attacker engages with the target system, typically conducting a port scan to determine find any open ports.

Answer 11

active

Question 12

Active reconnaissance accesses the system ___________ to detect vulnerabilities. Tools and techniques such as network mapping, port scans, and network sniffing are used to test the system and identify potential sources of attack.

Answer 12

directly

Question 13

________ use a compromised system to attack another system.

Answer 13

Pivots

Question 14

Pivots

Answer 14

Using a compromised system to attack another system.

Question 15

Initial exploitation _________ one system so that it can be used in a pivot test against another system.

Answer 15

compromises

Question 16

Persistence is when the compromised system is used in an attack at some point ______ the initial exploitation occurred.

Answer 16

after

Question 17

An example of __________ would be when a student’s notebook computer contracts malware at a coffee shop, but the school network is not affected until the student logs in to the school network.

Answer 17

persistence

Question 18

What are maintenance hooks

Answer 18

Maintenance hooks are another name for back doors- hole in coding that a programmer adds so that he can get in and bypass security

Question 19

__________ can be caused by a programmer failing to free up memory once the process using that memory has been completed. C and C++ are particularly prone to ___________.

Answer 19

Memory leaks

memory leaks

Question 20

Integer overflows happen when a number _________ to fit into the data type “integer” is not rejected and is allowed to corrupt the program.

Answer 20

is too large

Question 21

Pointer differences occur when

Answer 21

a pointer (which points to the proper memory location) has the reference changed. This results in the pointer pointing to an inaccurate value

Question 22

Integer overflows

Answer 22

happens when a number is too large to fit into the data type “integer” is not rejected and is allowed to corrupt the program.

Question 23

A buffer overflow is an example of improper ______________________, and the impact can include ___________.

Answer 23

• input handling being allowed by the
  application code
• crashing the application

Question 24

Examples of improper input handling include failure to validate the _________ _________, the length of the data, proper date ranges.

Answer 24

type of data in an input field