Vulnerabilities and Attacks Flashcards

Question

Scenario: A hospital’s unpatched medical devices suddenly crash and spread malware to nearby Bluetooth-enabled equipment. Which attack is this? A. BlueBorne B. Bluesmack C. Bluebugging D. On-Path Attack

Answer 1

Answer: A. BlueBorne Explanation: BlueBorne spreads malware wirelessly via Bluetooth without user interaction, infecting multiple devices. B. Bluesmack: Denial-of-service attack, not malware propagation. C. Bluebugging: Device control, not airborne spread. D. On-Path Attack: Intercepts data but doesn’t spread malware.

Answer 2

Answer: B. Set devices to non-discoverable Explanation: Non-discoverable mode hides devices from nearby Bluetooth scans, reducing unsolicited connection attempts. A. Use encryption: Protects data but doesn’t hide visibility. C. Update firmware: Patches vulnerabilities but unrelated to visibility. D. Turn off Bluetooth: Disables connectivity entirely, which isn’t the case here.

Answer 3

Answer: A. Bluesmack Explanation: Bluesmack is a denial-of-service attack that overwhelms devices with data, causing crashes. B. Bluejacking: Sends messages but doesn’t crash devices. C. BlueBorne: Spreads malware, not DoS. D. Bluebugging: Controls devices, doesn’t crash them.

Answer 4

Answer: B. Update firmware Explanation: Firmware updates patch vulnerabilities, such as flaws in Bluetooth protocols. A. Use encryption: Protects data but doesn’t fix firmware flaws. C. Non-discoverable: Hides devices but doesn’t address vulnerabilities.

Answer 5

Answer: A. On-Path Attack Explanation: An on-path attack intercepts and alters Bluetooth communications between devices. B. Device Spoofing: Impersonates a device, doesn’t reroute data. C. Insecure Pairing: No authentication during pairing, unrelated to interception.

Answer 6

Answer: B. Use encryption Explanation: Encryption scrambles data during transfers, preventing eavesdropping. A. Update firmware: Patches flaws but doesn’t protect data in transit. C. Non-discoverable: Hides devices but doesn’t secure data.

Answer 7

Answer: C. Bluejacking Explanation: Bluejacking involves sending unsolicited messages to Bluetooth devices, often for pranks or testing vulnerabilities. A. Bluesnarfing: Steals data (e.g., contacts), which isn’t described here. B. Bluebugging: Grants full device control, which isn’t occurring. D. BlueBorne: Spreads malware automatically, unrelated to spam messages.

Answer 8

Answer: B. Bluesnarfing Explanation: Bluesnarfing involves unauthorized access to steal data (e.g., contacts, logs) via Bluetooth. A. Bluejacking: Sends messages but doesn’t steal data. C. Device Spoofing: Impersonates a device, not data theft. D. Bluesmack: Overloads devices to crash them.

Answer 9

Answer: B. Bluebugging Explanation: Bluebugging allows attackers to take full control of a device (e.g., sending messages). A. Bluesnarfing: Steals data but doesn’t grant control. C. BlueBorne: Spreads malware silently, unrelated to device control. D. Insecure Pairing: Refers to weak authentication during pairing.

Answer 10

Answer: A. Bluesmack Explanation: Bluesmack is a DoS attack that overwhelms devices with Bluetooth pings (L2CAP requests), causing crashes. B. Bluejacking: Sends messages but doesn’t crash devices. C. Device Spoofing: Impersonates devices, unrelated to DoS. D. BlueBorne: Spreads malware, not DoS.

Answer 11

Answer: B. BlueBorne Explanation: BlueBorne spreads malware automatically via Bluetooth, infecting devices like a worm. A. Bluebugging: Requires device control, not silent spreading. C. Bluesnarfing: Involves data theft, not malware. D. Insecure Pairing: Refers to weak authentication during pairing.

Answer 12

Answer: C. Insecure Pairing Explanation: Insecure pairing occurs when devices connect without proper authentication (e.g., no PIN). A. Device Spoofing: Impersonates a device, but the issue here is weak pairing. B. On-Path Attack: Intercepts communication, unrelated to pairing. D. Bluejacking: Sends unsolicited messages, not pairing exploitation.

Answer 13

Answer: B. Device Spoofing Explanation: Device spoofing mimics legitimate devices (e.g., duplicate "CarAudio") to trick users into connecting. A. On-Path Attack: Intercepts data between devices, not impersonation. C. BlueBorne: Spreads malware automatically, unrelated to spoofing. D. Bluesmack: Overloads devices to crash them.

Answer 14

Answer: C. Set to non-discoverable Explanation: Non-discoverable mode hides devices from Bluetooth scans, reducing unsolicited connections. A. Update firmware: Patches vulnerabilities but doesn’t hide visibility. B. Use encryption: Protects data but doesn’t prevent discovery. D. Turn off Bluetooth: Disables connectivity entirely, which isn’t the case here.

Answer 15

Answer: B. On-Path Attack Explanation: An on-path attack intercepts and modifies Bluetooth communications between devices. A. Device Spoofing: Impersonates a device, doesn’t alter data. C. Bluebugging: Grants device control, not communication interception. D. Bluesnarfing: Steals data, doesn’t alter communications.

Answer 16

Answer: B. Update firmware Explanation: Firmware updates patch vulnerabilities (e.g., Bluetooth flaws) to enhance security. A. Use encryption: Protects data but doesn’t fix firmware flaws. C. Non-discoverable: Hides devices but doesn’t patch vulnerabilities.

Answer 17

Correct Answer: A) The app contained malware that compromised her device Explanation: Sideloading apps from unofficial sources bypasses security checks enforced by official app stores. This increases the risk of installing malware, which can cause data leaks, unauthorized access, and system instability. B is incorrect because app stores don’t block apps randomly. They follow strict security guidelines. C is incorrect because sideloading doesn’t directly affect Wi-Fi access. D is incorrect because excessive permissions alone do not indicate that an app is completely unusable.

Answer 18

Correct Answers: B) His device is more vulnerable to malware and exploits & C) He can no longer receive official security updates from the manufacturer Explanation: B is correct because rooting/jailbreaking removes built-in security protections, making devices vulnerable to malware and exploits. C is correct because rooting often disables automatic updates, preventing security patches that fix vulnerabilities. A is incorrect because while rooting provides more control, it also removes essential security protections, making the device less secure. D is incorrect because rooting actually makes sideloading easier, rather than preventing it.

Answer 19

Correct Answer: A) A man-in-the-middle (MitM) attack intercepted her login credentials Explanation: A is correct because public Wi-Fi networks without encryption can be exploited by attackers to intercept communications and steal credentials. B is incorrect because slow Wi-Fi does not impact encryption security. C is incorrect because while security systems may flag unusual logins, the core issue was the insecure Wi-Fi connection. D is incorrect because cellular networks are generally more secure than open Wi-Fi.

Answer 20

Correct Answers: A) Use a VPN when connecting to public Wi-Fi, B) Only connect to known and trusted networks, and D) Turn off Bluetooth discoverability when not in use Explanation: A is correct because a VPN encrypts internet traffic, preventing attackers from intercepting data. B is correct because connecting only to trusted networks minimizes exposure to rogue hotspots and malicious actors. D is correct because disabling Bluetooth discoverability prevents unauthorized pairing attempts and potential exploits. C is incorrect because weak passwords make networks vulnerable to unauthorized access. E is incorrect because prioritizing speed over security can expose the device to risks.

Answer 21

Correct Answers: A) Automatically patch security updates on all devices, C) Detect and block jailbroken or rooted devices, and D) Force the use of a VPN for secure corporate access Explanation: A is correct because MDM solutions ensure that security patches are installed to protect against vulnerabilities. C is correct because MDM can detect and restrict access for jailbroken/rooted devices. D is correct because MDM can enforce VPN usage for secure corporate network access. B is incorrect because MDM typically restricts unauthorized app installations rather than allowing full freedom. E is incorrect because removing encryption weakens security, and MDM solutions focus on enhancing security rather than reducing it.

Answer 22

Correct Answer: A) Zero-day Vulnerability Explanation: A is correct: A zero-day vulnerability is an unknown flaw that is exploited before the developer or vendor has issued a patch. B is incorrect: The zero-day exploit is the method used by the attacker to take advantage of this vulnerability—not the vulnerability itself. C is incorrect: Zero-day malware refers to malicious software that leverages a zero-day exploit; it is not the underlying flaw. D is incorrect: The flaw is unknown to the vendor, so it is not a “known” vulnerability.

Answer 23

Correct Answer: B) Zero-day Exploit Explanation: A is incorrect: The vulnerability is the underlying flaw in the software, not the program itself. B is correct: The zero-day exploit is the method (or program) that takes advantage of the zero-day vulnerability. C is incorrect: Zero-day malware would be the malicious payload delivered as a result of the exploit; here, the program is used to trigger the vulnerability rather than serve as the payload. D is incorrect: A zero-day patch would be a corrective update, which is not applicable in this scenario.

Answer 24

Correct Answer: B) Zero-day Vulnerability and Zero-day Malware Explanation: A is not fully complete: While there is indeed a zero-day vulnerability exploited, the ransomware acting as the harmful payload is best described as zero-day malware. B is correct: The incident involves an unknown (zero-day) vulnerability, and the ransomware is the zero-day malware that takes advantage of that flaw. C is incorrect: There is no “zero-day patch” in the scenario; patches are released after the vulnerability is known. D is incorrect: Again, no patch is involved; the focus is on the unpatched vulnerability and the malicious payload.

Answer 25

Correct Answer: B) The high monetary and strategic value of zero-day vulnerabilities and exploits Explanation: A is incorrect: The scenario is about selling an undisclosed flaw, not about patching known vulnerabilities. B is correct: Zero-day vulnerabilities and exploits can be extremely valuable, as evidenced by their sale to high-value buyers such as government agencies. C is incorrect: Alex does not publicly disclose the flaw; instead, Alex sells the exploit, highlighting its value when kept secret. D is incorrect: The scenario does not involve generic, off-the-shelf malware; it centers on a unique, undisclosed flaw and its exploitation.

Answer 26

Correct Answer: B) Zero-day exploits are new and do not have established signatures Explanation: A is incorrect: Even if the software were updated, a zero-day exploit remains undetected because no signature exists yet. B is correct: Zero-day exploits take advantage of unknown vulnerabilities before signatures can be developed, rendering signature-based detection ineffective. C is incorrect: There is no indication that the operating system is unsupported; the issue lies in the novelty of the attack. D is incorrect: Antivirus software is designed to work on software vulnerabilities, not hardware vulnerabilities; the failure is due to the absence of a signature for a zero-day exploit

Answer 27

Correct Answer: B) They are typically reserved for high-value or high-impact targets. Explanation: A is incorrect: The scenario shows a selective use of zero-day exploits rather than indiscriminate usage. B is correct: Cybercriminals often save zero-day exploits for targets where the impact or financial gain is greatest. C is incorrect: The zero-day exploit is deployed precisely because generic malware was ineffective; it’s considered more potent for high-value targets. D is incorrect: Zero-day exploits are defined by the fact that they are used before the vulnerability is publicly known or patched.

Answer 28

Correct Answer: B) Known vulnerability Explanation: A is incorrect: A zero-day vulnerability is an unknown flaw not yet disclosed or patched. B is correct: The flaw in the web server is documented and publicly known; attackers are leveraging an existing exploit to take advantage of it. C is incorrect: There is no indication that the issue is due to improper configuration settings. D is incorrect: The problem is not caused by an update containing malicious code.

Answer 29

Correct Answer: B) They are vulnerable because of unpatched, known vulnerabilities. Explanation: A is incorrect: Zero-day vulnerabilities are unknown to the vendor, whereas these vulnerabilities are already known and have patches available. B is correct: Unpatched systems remain at risk because known vulnerabilities are not fixed, and attackers can use available exploits against them. C is incorrect: Although misconfigurations can also be risky, this scenario specifically describes outdated patches. D is incorrect: There is no mention of a malicious update; the issue is simply the lack of patching.

Answer 30

Correct Answer: C) Zero-day vulnerability Explanation: A is incorrect: The flaw is not known to the vendor or the public, so it isn’t a known vulnerability. B is incorrect: There is no indication that the problem is due to a misconfiguration. C is correct: A zero-day vulnerability is one that is exploited before the vendor becomes aware of it and can issue a patch, which fits this scenario. D is incorrect: The attack is not the result of an update that turned malicious.

Answer 31

Correct Answer: C) Misconfiguration Explanation: A is incorrect: The issue isn’t due to missing security patches. B is incorrect: The vulnerability is not unknown; it is a configuration oversight. C is correct: Leaving unnecessary services enabled is a classic misconfiguration issue that exposes systems to attack. D is incorrect: There is no update involved, malicious or otherwise.

Answer 32

Correct Answer: B) Data exfiltration Explanation: A is incorrect: Configuration drift refers to unauthorized or unintended changes in system settings over time. B is correct: Data exfiltration is the unauthorized transfer of data from within an organization to an external destination, which is exactly what happened here. C is incorrect: Although the attacker may have used an exploit, the key action here is the unauthorized data transfer. D is incorrect: The scenario does not involve an issue with application allowlisting.

Answer 33

Correct Answer: C) Malicious update Explanation: A is incorrect: The system was updated, but the update itself was compromised. B is incorrect: Although the vulnerability might have been exploited, the defining characteristic is that the update was malicious. C is correct: A malicious update masquerades as a legitimate patch but contains harmful code, which fits this scenario. D is incorrect: There is no indication that improper configuration caused the issue.

Answer 34

Correct Answer: B) Configuration management tools Explanation: A is incorrect: Endpoint protection tools focus on detecting and blocking malware and suspicious activity on endpoints, not on automating configuration. B is correct: Configuration management tools automate and standardize system configurations, perform remediation, and track changes—exactly as described. C is incorrect: Application allowlisting only permits pre-approved applications to run and does not manage system configurations. D is incorrect: A host-based IPS monitors and blocks suspicious activity, but it does not automate configuration management.

Answer 35

Correct Answer: A) Endpoint protection tools Explanation: A is correct: Endpoint protection tools provide comprehensive security for devices by blocking malware, monitoring activity, and preventing unauthorized actions, which fits this scenario perfectly. B is incorrect: Configuration management tools deal with automating and standardizing system settings, not real-time protection against malware. C is incorrect: Application allowlisting restricts the execution of unapproved programs but does not actively monitor for malware or data transfers. D is incorrect: Zero-day vulnerability scanners are not the focus here; the scenario describes blocking malware and monitoring endpoints.

Answer 36

Correct Answer: B) Application allowlisting Explanation: A is incorrect: While endpoint protection helps block malware, it does not restrict execution based on an approved list. B is correct: Application allowlisting permits only approved applications to run, thereby preventing unauthorized or potentially dangerous software from executing. C is incorrect: Configuration management ensures consistent settings across systems but does not control which applications can run. D is incorrect: Although preventing data exfiltration is important, it is not the focus of this scenario.

Answer 37

Correct Answer: D) Vulnerability → Exploit → Malware Explanation: A is incorrect: The vulnerability exists first; an exploit cannot function without a vulnerability. B is incorrect: The malware is delivered after the exploit takes advantage of the vulnerability. C is incorrect: The exploit is the means to deliver the malware and cannot come after the malware. D is correct: The chain starts with the vulnerability (the flaw in the browser), then the exploit (code that triggers the flaw), and finally the malware (ransomware delivered as a payload).

Answer 38

Explanation: A is incorrect: Although improper input handling can cause syntax issues, the injected code (' OR 1=1; --) is designed to produce a valid query by closing the password string and adding a condition that is always true. B is correct: The injected OR 1=1 makes the WHERE clause always evaluate to true, regardless of the actual password. This allows the attacker to bypass authentication. C is incorrect: The injection does not limit the result to only the "admin" record; instead, it returns records (or at least satisfies the authentication check) because of the always-true condition. D is incorrect: While some applications may have error logging or account lockout mechanisms, the primary effect of this injection is to bypass authentication rather than trigger a defensive block.

Answer 39

Correct Answer: B) Implement a Web Application Firewall (WAF) between clients and the web server. Explanation: A is partially correct: Input validation and sanitization are essential; however, modifying legacy code to ensure proper validation everywhere might be time-consuming. B is correct: A WAF can filter out malicious requests (including SQL injection attempts) without modifying the existing code, providing a quick layer of defense. C is incorrect: Changing the database engine will not automatically sanitize input, and the vulnerability lies in how the SQL is constructed. D is incorrect: Disabling dynamic queries may not be feasible in a legacy system, and even static queries require safe handling of parameters.

Answer 40

Correct Answer: B) These are different attack vectors used for SQL injection. Explanation: A is incorrect: XSS attacks target client-side script execution, not database queries. B is correct: Attackers can inject SQL code via URL parameters, form fields, cookies, POST data, and HTTP headers. C is incorrect: These vectors are used for injecting malicious SQL commands rather than for overwhelming the server with traffic as in DDoS. D is incorrect: While search engine bots crawl URL parameters, they do not inject malicious SQL code intentionally.

Answer 41

Correct Answer: B) It indicates a potential SQL injection attempt. Explanation: A is incorrect: The pattern (such as ' OR 1=1 --) is too structured to be a mere typo. B is correct: Inputs containing apostrophes and always-true conditions (like 1=1) are classic signs of SQL injection attempts. C is incorrect: XML injection involves malformed XML data, not SQL Boolean conditions. D is incorrect: Parameterized queries would prevent SQL injection, and their use would typically not result in log entries showing raw injection attempts.

Answer 42

Correct Answer: C) XML Bomb (Billion Laughs Attack) Explanation: A is incorrect: An XXE attack involves external entity references to access local resources, not merely exponential expansion. B is incorrect: While XML injection might involve malformed XML, the hallmark of an XML bomb is its exponential resource consumption. C is correct: An XML bomb (or Billion Laughs Attack) uses nested entity references to consume excessive memory, leading to a denial-of-service. D is incorrect: SQL injection is unrelated to XML processing and does not involve nested XML entities.

Answer 43

Correct Answer: C) XML External Entity (XXE) attack; prevention by disabling external entity processing and input validation. Explanation: A is incorrect: SQL injection targets database queries, not XML processing. B is partially correct: XML injection is a broader term, but this specific attack is an XXE, and encryption alone does not prevent the parser from processing external entities. C is correct: The attack is a textbook XXE attack. Disabling external entity processing in the XML parser (or configuring it securely) along with strict input validation is the proper countermeasure. D is incorrect: XSS involves injecting scripts into web pages viewed by other users and is not related to XML external entities.

Answer 44

Correct Answer: B) Validate and sanitize all XML input before processing, and ensure that the XML parser is securely configured (e.g., disabling external entity resolution). Explanation: A is incorrect: While encryption protects data in transit, it does not prevent the malicious content from being processed once it reaches the server. B is correct: Rigorous input validation and sanitization combined with secure parser configurations (such as disabling external entities) are key measures to prevent XML injection. C is incorrect: A WAF can help, but it should not be the sole line of defense against XML injection. D is incorrect: Converting data formats may be part of a solution, but it does not inherently protect against injection if proper validation is not performed.

Answer 45

Correct Answer: A) Validation ensures the data is of the correct type, while sanitization ensures that harmful characters are removed or escaped, thereby reducing the risk of SQL injection. Explanation: A is correct: Input validation confirms that the input matches expected criteria (e.g., data type, length, format), and sanitization cleans the input by escaping or removing dangerous characters. Using both together provides stronger protection against injection attacks. B is incorrect: Relying solely on validation does not remove harmful characters that can be used for injection. C is incorrect: Sanitization alone may not enforce proper data format or length, which validation provides. D is incorrect: A WAF can help filter requests, but it is not a substitute for proper coding practices like input validation and sanitization.

Answer 46

Correct Answer: B) Evidence of an SQL injection attempt targeting the database. Explanation: A is incorrect: The specific pattern (' OR '1'='1) is a common injection string, not a typical logging error. B is correct: Such patterns are strong indicators of SQL injection attempts where the attacker is trying to manipulate the query logic. C is incorrect: The pattern is not related to XML syntax; XML injections use tags and structured markup. D is incorrect: While logging misconfigurations can occur, the presence of typical injection patterns should trigger an investigation into potential SQL injection attacks.

Answer 47

Correct Answer: A) The first targets a database via SQL injection, while the second targets XML data processing via an XML External Entity (XXE) attack. Explanation: A is correct: The string ' OR 1=1; -- is a classic SQL injection payload meant to manipulate database queries, whereas the XML snippet is designed to perform an XXE attack by exploiting the XML parser’s handling of external entities. B is incorrect: The two attacks target different systems and use different techniques. C is incorrect: The roles are reversed in this option. D is incorrect: Neither attack is primarily about misconfigurations in the web server or client-side scripts; they target the back-end processing of SQL queries and XML data respectively.

Answer 48

Correct Answer: B) Stored (Persistent) XSS Explanation: A is incorrect: Reflected XSS requires the victim to click a malicious link and does not involve storing the payload on the server. B is correct: In Stored XSS, the malicious script is saved in the website’s backend (database) and is later rendered for all users, making the attack persistent. C is incorrect: DOM-Based XSS happens entirely in the client’s browser and involves dynamic DOM manipulation without server-side involvement. D is incorrect: CSRF tricks an authenticated user into submitting a request unknowingly; it does not involve injecting and storing malicious scripts.

Answer 49

Correct Answer: B) Reflected (Non-Persistent) XSS Explanation: A is incorrect: Stored XSS involves the payload being saved on the server; here, the script is not stored but immediately reflected. B is correct: Reflected XSS occurs when the malicious input is immediately returned by the server in its response, typically after the user clicks a malicious link. C is incorrect: DOM-Based XSS manipulates the Document Object Model on the client side rather than relying on server responses. D is incorrect: Although XSS can lead to session hijacking by stealing cookies, session hijacking is the outcome—not the method of the attack.

Answer 50

Correct Answer: C) DOM-Based XSS Explanation: A is incorrect: The payload isn’t stored on the server; it is manipulated and executed entirely in the client’s browser. B is incorrect: Although the attack is initiated via a URL, it is not immediately reflected by the server but handled by client-side JavaScript. C is correct: DOM-Based XSS occurs when the client-side script processes data (such as the URL fragment) unsafely, leading to execution of malicious code in the browser. D is incorrect: CSRF involves tricking a user into performing an unwanted action on a site where they’re authenticated and does not directly involve DOM manipulation.

Answer 51

Correct Answer: B) Session Hijacking Explanation: A is incorrect: Although XSS can be used for defacement, the key action here is stealing cookies. B is correct: Stealing the cookie enables the attacker to impersonate the user by hijacking the session. C is incorrect: Remote code execution typically refers to executing code on the server, not stealing client-side cookies. D is incorrect: CSRF forces a victim's browser to perform actions, but this attack is specifically about reading cookie data via injected script.

Answer 52

Correct Answer: A) Session Hijacking via Prediction Explanation: A is correct: Predictable session tokens can be guessed by an attacker, allowing them to hijack another user’s session. B is incorrect: Stored XSS involves malicious script injection into persistent storage, which is not the case here. C is incorrect: Reflected XSS is not related to session token predictability. D is incorrect: CSRF relies on tricking a user into submitting a request; it does not involve predicting session tokens.

Answer 53

Correct Answer: C) CSRF (Cross-Site Request Forgery) Explanation: A is incorrect: Stored XSS involves persistent malicious code injection, not unauthorized actions triggered by a user’s session. B is incorrect: Reflected XSS requires user interaction with a malicious link but does not leverage the victim’s authenticated session for unauthorized actions. C is correct: CSRF tricks the victim’s browser into sending an authenticated request (using their session cookie) without their explicit consent. D is incorrect: DOM-Based XSS pertains to client-side script manipulation and does not involve unauthorized form submissions.

Answer 54

Correct Answer: B) Use user-specific, random CSRF tokens in all form submissions Explanation: A is incorrect: While HTTPS secures data in transit, it does not prevent the browser from automatically including session cookies in forged requests. B is correct: CSRF tokens are unique per session and are verified on the server side, ensuring that the request originates from the legitimate user. C is incorrect: Input sanitization is important for XSS prevention, but it does not protect against CSRF attacks. D is incorrect: Disabling cookies is impractical for session management and would break normal website functionality.

Answer 55

Correct Answer: C) The payload is handled entirely by client-side JavaScript, affecting the DOM. Explanation: A is incorrect: Stored XSS involves persistent storage of the payload, which is not the case here. B is incorrect: Reflected XSS relies on the server reflecting the input; here, the manipulation occurs solely on the client side. C is correct: The attack exploits client-side JavaScript (using methods like document.write) to manipulate the DOM, which is the hallmark of DOM-based XSS. D is incorrect: Forcing unauthorized requests describes CSRF, not DOM-based XSS.

Answer 56

Correct Answer: B) Persistent cookies, because they are stored on the user's device for a longer period. Explanation: A is incorrect: Session cookies are typically cleared when the browser closes, limiting the window for exploitation. B is correct: Persistent cookies remain on the device until they expire or are manually deleted, giving an attacker a larger window of opportunity to hijack the session. C is incorrect: While both types can lead to immediate hijacking if stolen, persistent cookies pose a longer-term risk. D is incorrect: Even if cookies are encrypted during transit, once stolen (or if encryption is not applied at rest), they can be used for session hijacking.

Answer 57

Correct Answer: B) A CSRF attack exploiting the absence of CSRF tokens Explanation: A is incorrect: The absence of CSRF tokens on sensitive endpoints is a red flag, not typically explained by glitches. B is correct: CSRF attacks often occur when requests lack proper CSRF tokens, allowing attackers to forge requests that appear legitimate because they use the victim’s active session. C is incorrect: Stored XSS would involve malicious scripts embedded in persistent data, not the absence of CSRF tokens. D is incorrect: Session token refreshes normally include valid tokens and do not result in missing CSRF tokens on sensitive endpoints. ## Footnote What are CSRF Tokens? CSRF (Cross-Site Request Forgery) tokens are unique, randomly generated values that web applications use to prevent CSRF attacks. These tokens are included in every user request to ensure that the request was intended and authorized by the legitimate user.

Answer 58

Correct Answer: C) The extra digits overflow into adjacent memory, potentially corrupting data. Explanation: A is incorrect: Standard buffers in languages like C and C++ do not dynamically resize unless explicitly programmed to do so. B is incorrect: Without proper input validation or bounds checking, the extra data is written beyond the allocated memory. C is correct: Writing more data than the buffer can hold causes a buffer overflow, which may overwrite adjacent memory (such as other variables or control data like the return address). D is incorrect: In many vulnerable applications, lack of input validation (or use of unsafe functions) leads to an overflow rather than input rejection.

Answer 59

Correct Answer: C) The return address stored in the stack frame. Explanation: A is incorrect: The heap is separate from the stack; an overflow in a stack buffer does not affect heap memory. B is incorrect: Global variables are stored in a different memory segment, not on the stack. C is correct: In a typical stack frame layout, local variables (including buffers) are stored near the saved return address; overflowing the buffer can overwrite the return address, thereby altering the control flow when the function returns. D is incorrect: The code segment is generally read-only, and an overflow in the stack will not directly overwrite the program instructions.

Answer 60

Correct Answer: C) To overwrite the return address so that the program jumps to the attacker’s code (shellcode). Explanation: A is incorrect: While crashing the program can be a side effect of an overflow, the typical goal in exploitation is to redirect program execution. B is incorrect: Although data theft can occur, the primary focus here is on altering program control flow. C is correct: By overwriting the return address with a pointer to malicious code (often located within the overflowing input), the attacker diverts the program’s execution to run the attacker’s code. D is incorrect: C does not support automatic reallocation in this context; the overflow simply writes beyond the allocated space.

Answer 61

Correct Answer: C) To provide a “landing zone” so that slight inaccuracies in the overwritten return address still lead to execution of the shellcode. Explanation: A is incorrect: NOPs do not cause a pause; they are instructions that do nothing and simply pass control to the next instruction. B is incorrect: While NOPs may obscure the exact location of the shellcode, their primary purpose is not to avoid detection but to ensure reliable execution. C is correct: The NOP slide allows the program’s execution to “slide” down into the shellcode even if the return address does not point precisely to its beginning. D is incorrect: NOPs do not provide encryption; they simply act as placeholders to smooth the transition to the payload.

Answer 62

Correct Answer: A) New stack frames are added at lower memory addresses than previous frames. Explanation: A is correct: In many system architectures, the stack grows from higher addresses toward lower addresses. Each new frame is placed at a lower address than the one before it. B is incorrect: Growing into higher memory addresses would be “upward,” which is not the conventional behavior for the stack on most systems. C is incorrect: The heap and the code segment are separate from the stack; the growth direction of the stack is unrelated to these segments. D is incorrect: The growth of the stack is related to function calls and returns, not loops per se.

Answer 63

Correct Answer: B) ASLR randomizes memory addresses to make it harder to predict where the shellcode resides, and stack canaries detect if the return address has been overwritten. Explanation: A is incorrect: ASLR does not encrypt memory contents, and stack canaries do not resize buffers. B is correct: ASLR makes it difficult for an attacker to guess the location of critical code or data (like the shellcode), while stack canaries serve as a guard value that, if altered by an overflow, will trigger detection and abort the program. C is incorrect: Neither technique eliminates the need for safe coding practices nor prevents recursion. D is incorrect: These techniques do not force the use of safe functions or disable unsafe ones; they are additional layers of protection.

Answer 64

Correct Answer: A) The program may crash instead of executing the attacker’s code. Explanation: A is correct: If an attacker writes far beyond the intended boundary, the overwritten memory might contain critical data or cause an invalid memory access, leading to a crash (segmentation fault) rather than a successful exploit. B is incorrect: Standard buffers do not automatically truncate data; they simply write into adjacent memory if bounds checking is absent. C is incorrect: The operating system does not automatically expand fixed-size buffers in this context. D is incorrect: Overwritten data is not redirected to a safe memory segment; it corrupts adjacent memory.

Answer 65

Correct Answer: C) gets() does not perform bounds checking, allowing an attacker to write more data than the buffer can hold. Explanation: A is incorrect: gets() does not encrypt input; it simply reads data. B is incorrect: gets() does not reallocate buffers; it blindly writes into the memory provided. C is correct: The lack of bounds checking means that an attacker can supply an input longer than the buffer’s capacity, causing a buffer overflow. D is incorrect: gets() accepts character input (including strings), not just numeric values.

Answer 66

Correct Answer: B) It directs the program to execute the attacker’s malicious code instead of returning to the original caller. Explanation: A is incorrect: Although an incorrect return address can cause a crash, the attacker’s goal is usually to execute controlled malicious code rather than random data. B is correct: By overwriting the return address, the attacker diverts execution to their shellcode, effectively hijacking the program’s control flow. C is incorrect: Without proper defenses (like stack canaries), the overwritten return address is used as-is when the function returns. D is incorrect: There is no automatic reset to a safe address unless additional security mechanisms are in place.

Answer 67

Correct Answer: C) 85% Explanation: A and B are incorrect: These percentages underestimate the prevalence of buffer overflow attacks. C is correct: According to the provided notes, approximately 85% of data breaches have used buffer overflows as the initial attack vector, emphasizing their importance in security. D is incorrect: While buffer overflows are very common, they are not used in every single data breach.

Answer 68

Correct Answer: C) The program will crash or behave unpredictably due to a null pointer dereference. Explanation: A is incorrect: A null pointer does not contain a valid address, so no default value is retrieved. B is incorrect: Standard C does not automatically allocate memory when dereferencing a null pointer. C is correct: Dereferencing a null pointer (an address that points to nothing) typically causes a crash (segmentation fault) or unpredictable behavior, which is a common vulnerability. D is incorrect: The pointer remains null unless explicitly changed by the program.

Answer 69

Correct Answer: C) A race condition occurs, possibly allowing both withdrawals to go through, overdrawing the account. Explanation: A is incorrect: Without proper synchronization, the system might not block both transactions. B is incorrect: The scenario implies that proper concurrency control is missing, leading to simultaneous access. C is correct: When two processes try to update the same resource concurrently without locks, a race condition may occur, causing an unintended overdraft. D is incorrect: Automatic locking would prevent the race condition; the scenario states that synchronization is missing.

Answer 70

Correct Answer: B) Modify a file without proper permissions, potentially escalating privileges. Explanation: A is incorrect: Dirty COW is a local privilege escalation exploit; remote code execution is not its primary goal. B is correct: By exploiting the race condition in the copy-on-write mechanism, an attacker can modify files that should be read-only, which may lead to privilege escalation. C is incorrect: While the exploit may cause instability, its main effect is unauthorized file modification rather than simply crashing the system. D is incorrect: The vulnerability does not patch files; instead, it allows unauthorized changes.

Answer 71

Correct Answer: A) A race condition resulting in a TOCTOU (Time-of-Check to Time-of-Use) vulnerability. Explanation: A is correct: The scenario describes a classic TOCTOU issue where the state of the file changes between the check and its use, allowing an attacker to exploit the gap. B is incorrect: There is no dereferencing of an invalid pointer involved here. C is incorrect: The issue is not about deadlock but about the timing between checking and using a resource. D is incorrect: A buffer overflow involves writing more data than allocated; this scenario concerns file permission changes.

Answer 72

Correct Answer: A) By allowing only one thread at a time to access the critical section of code. Explanation: A is correct: A mutex (mutual exclusion) ensures that only one thread can execute the critical section at any given time, thereby preventing concurrent modifications that could lead to a race condition. B is incorrect: Mutexes do not correct data errors; they only coordinate access. C is incorrect: Creating multiple copies is not how mutexes work; that would be a different technique such as versioning. D is incorrect: Mutexes do not perform encryption; their purpose is to synchronize access.

Answer 73

Correct Answer: B) Deadlock Explanation: A is incorrect: A race condition involves timing issues where outcomes depend on the sequence of execution, not a permanent standstill. B is correct: A deadlock occurs when two or more processes are each waiting for resources held by the others, resulting in an indefinite wait. C is incorrect: Mutex starvation refers to a scenario where a thread never gets access to a mutex due to scheduling issues, which is different from a deadlock. D is incorrect: TOCTOU vulnerabilities are related to timing issues in resource checks and uses, not mutual resource locking.

Answer 74

Correct Answer: B) Thread A might dereference an invalid pointer, leading to a crash or exploit. Explanation: A is incorrect: Due to the race condition, Thread A’s dereference might occur before or after the pointer is changed, making the result unpredictable. B is correct: If Thread B changes the pointer at the wrong time, Thread A may attempt to access invalid or unintended memory, which can cause a crash or open an exploit window. C is incorrect: Without proper synchronization mechanisms, threads do not automatically correct shared pointer values. D is incorrect: In this scenario, no locks are mentioned; the lack of a mutex allows concurrent modification.

Answer 75

Correct Answer: B) It ensures that only one user can modify the document at any given time, preserving data integrity. Explanation: A is incorrect: The resource lock explicitly prevents simultaneous editing, not unlimited editing. B is correct: The lock guarantees that while one user edits the document, others can only view it, preventing conflicting changes. C is incorrect: The file is not converted to read-only; instead, write access is controlled through locking. D is incorrect: While encryption protects data, resource locks are used to control access and prevent race conditions, not for encryption.

Answer 76

Correct Answer: C) Time-of-Evaluation (TOE) vulnerability Explanation: A is incorrect: This scenario does not involve dereferencing a pointer. B is incorrect: There is no issue of writing beyond a buffer’s bounds here. C is correct: A TOE vulnerability occurs when data or resource conditions are manipulated during the system’s decision-making process, as seen when vote data is altered during evaluation. D is incorrect: A deadlock involves processes waiting indefinitely for each other’s resources, which is not the case here.

Answer 77

Correct Answer: C) They ensure that only one thread can write to the file at a time, thus preventing race conditions and potential data corruption. Explanation: A is incorrect: Concurrency controls do not encrypt data; they manage access timing. B is incorrect: Allowing simultaneous writes is what leads to race conditions; the purpose is to prevent that. C is correct: Mutexes and resource locks restrict access to shared resources so that only one thread can perform critical operations at a time, ensuring data consistency and integrity. D is incorrect: These mechanisms do not correct data errors; they only coordinate access to avoid conflicts.