Domain 1.6 - Explain the impact associated with types of vulnerabilities.

Question 1

Embedded systems

Answer 1

These can be chips within Internet of Things (IoT) devices or controllers in manufacturing equipment.

Question 2

Improper Input Handling

Answer 2

Poorly handled input is a leading cause behind critical vulnerabilities that exist in systems and applications.

Question 3

Improper Error Handling

Answer 3

The most common problem is when detailed internal error messages such as stack traces, database dumps, and error codes are displayed to the user or attacker

Question 4

Misconfiguration/Weak Configuration

Answer 4

This can be as simple as failing to change default settings or default passwords. Can be a matter of not having the appropriate training.

Question 5

Default Configuration

Answer 5

In many cases this is one of the easiest vulnerabilities to exploit.

Question 6

What is a form of Denial-of-Service attack where you make a system continuously allocate additional resources until the system hangs or crashes?

Answer 6

Resource Exhaustion

Question 7

What is typically the weakest point in an organizations security posture?

Answer 7

Untrained Users

Question 8

Name a vulnerable business process.

Answer 8

Failure to perform background checks properly or to verify vendors is a vulnerability.

Acquiring software from suspect sources is a vulnerability.

Question 9

802.11i pertains to one thing for the test.

Answer 9

WPA2 - which is a form of encryption for wireless.

Question 10

Memory leak

Answer 10

It would not release the RAM.

Question 11

Buffer overflow

Answer 11

Someone is trying to send too many packets or too large of packets to your network.

Question 12

System Sprawl

Answer 12

As the network grows, it becomes more difficult to track all the equipment and software on the network. This can lead to undocumented assets.

Question 13

Zero Day

Answer 13

An exploit that has yet to be patched. whether exploited or not.

Question 14

Denise is testing an application that is multithreaded. Which of the following is a specific concern for multithreaded applications?

A. Input validation
B. Memory overflow
C. Race conditions
D. Unit testing

Answer 14

C. Race conditions

Question 15

A user downloaded and installed a new software application from a questionable source that resulted in the installation of a Trojan Horse. What vulnerability is MOST likely?

A. Business Process
B. Weak Encryption Cypher
C. Race conditions
D. Faulty Network Design

Answer 15

A. Business Process