Section 5: Vulnerabilities Flashcards
(41 cards)
Type: Question & Answer
Question: What is a weakness in a system that can be exploited by a threat actor to gain unauthorised access or perform unauthorised actions on a system?
Answer: Vulnerability
Type: Question & Answer
Question: What security technique involves an attacker injecting their code into an organisation’s infrastructure to run harmful instructions?
Answer: Memory Injection
Type: Multiple Choice Question (Select ALL that apply)
Question: Which of the following are examples of Memory Injection vulnerabilities?
A) Code injection
B) Buffer Overflow
C) Denial of Service
D) DLL (Dynamic Link Libraries) Injections
Answer: A, B, D
Type: Question & Answer
Question: What vulnerability occurs when data intended for a buffer exceeds its storage capacity, overwriting adjacent memory locations?
Answer: Buffer Overflow
Type: True/False
Question: A buffer overflow can lead to malicious instructions being executed or corruption of important data.
Answer: True
Type: Question & Answer
Question: What programming conundrum occurs when the outcome of an operation depends on the sequence or timing of other uncontrollable events, potentially leading to security flaws?
Answer: Race Condition
Type: Multiple Choice Question (Select ONE answer)
Question: If a computer tries to do multiple things at once, and the result depends on the exact timing or order in which it happens, this indicates a:
A) Buffer overflow
B) Memory injection
C) Race condition
D) Malicious update
Answer: C) Race condition
Type: Question & Answer
Question: What vulnerability occurs when an attacker attempts to install a fake update to the Operating System (OS) that causes a weakness in its security?
Answer: Malicious Update
Type: True/False
Question: Malicious updates can be protected using code signing from the OS maker.
Answer: True
Type: Question & Answer
Question: What is a weakness in the OS that can be exploited to gain unauthorised access, change permissions, or perform unauthorised actions?
Answer: Operating System (OS)-based Vulnerability
Type: True/False
Question: Using unsupported operating systems like Windows XP or Windows 7 makes systems more secure due to their age.
Answer: False (Unsupported OS are easier to exploit due to a lack of updates.)
Type: Question & Answer
Question: What type of attack involves an attacker typing malicious SQL code into an input field on a website to interact with its database?
Answer: Structured Query Language Injection (SQLI)
Type: True/False
Question: SQL injection vulnerabilities are primarily caused by strong programming practices and robust input validation.
Answer: False (They are caused by bad programming that doesn’t properly handle input.)
Type: Multiple Choice Question (Select ONE answer)
Question: An attacker typing admin’ OR ‘1’=’1 into a username field to bypass a login page is an example of a:
A) Cross-site scripting attack
B) Buffer overflow
C) SQL injection attack
D) Malicious update
Answer: C) SQL injection attack
Type: Question & Answer
Question: What web application vulnerability involves an attacker injecting nasty code (like JavaScript) into a webpage that then runs in other users’ browsers?
Answer: Cross-Site Scripting (XSS)
Type: True/False
Question: Cross-site scripting (XSS) occurs because a website carelessly displays user input without proper validation or cleaning.
Answer: True
Type: True/False
Question: Input validation is key to fixing Cross-Site Scripting vulnerabilities.
Answer: True
Type: Question & Answer
Question: Weaknesses in low-level software that runs on hardware devices are known as:
Answer: Firmware Vulnerabilities
Type: Question & Answer
Question: Devices that are no longer supported by their manufacturers, resulting in unpatched vulnerabilities, are referred to as:
Answer: End-of-life Hardware
Type: Question & Answer
Question: Older hardware that may no longer be compatible with current security measures is called:
Answer: Legacy Hardware
Type: Question & Answer
Question: What major security concern in virtualisation allows an attacker to break out of a virtual machine and interact with the host system?
Answer: Virtual Machine (VM) Escape
Type: Question & Answer
Question: What vulnerability in virtual environments allows sensitive data to remain within system resources and be accessed by other processes?
Answer: Resource Re-use
Type: Question & Answer
Question: What cloud-specific vulnerability occurs when data stored on cloud servers is targeted by hackers, potentially exposing sensitive information?
Answer: Data Breaches
Type: Question & Answer
Question: Weak authentication processes, inadequate credential management, and insufficient access controls leading to unauthorised access to cloud resources are referred to as:
Answer: Insufficient Identity, Credential, and Access Management
