App Attack Quiz: Can You Master Buffer Overflow & Injection?

Submit

3. What is the primary purpose of fuzzing in application security testing?

Sending invalid or unexpected input to discover vulnerabilities

Encrypting sensitive data before transmission

Monitoring user behavior for suspicious activity

Patching known security flaws automatically

4. Race condition vulnerabilities in applications occur when the outcome depends on the timing of events. True or False?

True

False

5. Which of the following is a characteristic of a zero-day application vulnerability?

It is unknown to the vendor and has no published patch

It only affects legacy systems from the year 2000

It requires administrative privileges to exploit

It is immediately patched upon discovery

Submit

7. Path traversal attacks exploit insufficient input validation to access files outside intended directories. True or False?

True

False

8. Which encoding technique is most appropriate for preventing XSS attacks in HTML context?

HTML entity encoding

Base64 encoding

URL encoding only

Hexadecimal encoding

9. Address Space Layout Randomization (ASLR) makes buffer overflow exploitation more difficult by doing what?

Randomizing memory addresses at runtime

Encrypting all user input before processing

Blocking all network connections

Limiting the size of allocated buffers

10. A stack canary is a security mechanism that detects buffer overflow attempts. True or False?

True

False

11. What is a buffer overflow attack?

Writing data beyond allocated memory boundaries to overwrite adjacent memory

Flooding a network with excessive traffic to cause denial of service

Intercepting unencrypted data in transit between systems

Exploiting weak password policies to gain unauthorized access

12. Which mitigation strategy is MOST effective against SQL injection attacks?

Using parameterized queries or prepared statements

Increasing network bandwidth

Disabling all database error messages

Running the application on a dedicated server

13. LDAP injection attacks target directory services by manipulating LDAP query syntax. True or False?

True

False

14. A developer uses the following code: `system($_GET['filename'])`. This is vulnerable to which type of attack?

Command injection

Buffer overflow

Cross-site request forgery

Man-in-the-middle attack

Submit

16. What is the primary difference between stored XSS and reflected XSS?

Stored XSS persists in the database; reflected XSS returns malicious code immediately in the response

Reflected XSS is more dangerous than stored XSS

Stored XSS only affects mobile browsers

Reflected XSS requires direct user interaction with a malicious link

17. Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by other users. True or False?

True

False

18. In a classic SQL injection attack, an attacker modifies a SQL query by inserting malicious code. What is the typical goal?

Bypass authentication or extract unauthorized data

Increase server processing speed

Improve database indexing performance

Validate user credentials more securely

Submit

20. Which of the following is a primary consequence of a successful buffer overflow?

Loss of confidentiality only

Arbitrary code execution and system compromise

Increased network latency

Database schema corruption

App Attack Quiz: Can You Master Buffer Overflow & Injection?

1. Input validation and output encoding are key defenses against ____ attacks.

2.

What first name or nickname would you like us to use?

2. Pointer arithmetic vulnerabilities in C/C++ applications can lead to ____ attacks.

3. What is the primary purpose of fuzzing in application security testing?

4. Race condition vulnerabilities in applications occur when the outcome depends on the timing of events. True or False?

5. Which of the following is a characteristic of a zero-day application vulnerability?

6. In a path traversal attack, sequences like ____ are used to navigate the directory structure.

7. Path traversal attacks exploit insufficient input validation to access files outside intended directories. True or False?

8. Which encoding technique is most appropriate for preventing XSS attacks in HTML context?

9. Address Space Layout Randomization (ASLR) makes buffer overflow exploitation more difficult by doing what?

10. A stack canary is a security mechanism that detects buffer overflow attempts. True or False?

11. What is a buffer overflow attack?

12. Which mitigation strategy is MOST effective against SQL injection attacks?

13. LDAP injection attacks target directory services by manipulating LDAP query syntax. True or False?

14. A developer uses the following code: `system($_GET['filename'])`. This is vulnerable to which type of attack?

15. Command injection vulnerabilities occur when user input is passed unsanitized to a(n) ____ function or system call.

16. What is the primary difference between stored XSS and reflected XSS?

17. Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by other users. True or False?

18. In a classic SQL injection attack, an attacker modifies a SQL query by inserting malicious code. What is the typical goal?

19. SQL injection attacks exploit vulnerabilities in how applications handle ____.

20. Which of the following is a primary consequence of a successful buffer overflow?