Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which executable file format is commonly used on Linux systems?

   • AELF (Executable and Linkable Format)
   • BPE (Portable Executable)
   • CMach-O
   • DCOFF (Common Object File Format)
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Why is ROP often used when DEP/NX is enabled?

   • ABecause it randomizes the stack address to avoid detection
   • BBecause it allows code execution without injecting new code, using existing executable code
   • CBecause it encrypts the payload to avoid signature detection
   • DBecause it uses the heap to store the shellcode
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A security researcher is fuzzing a custom file parser that is part of a larger application. The parser takes a specific binary file format. The researcher wants to maximize code coverage and find deep bugs efficiently. The researcher has access to a corpus of valid sample files. Which fuzzing approach is most appropriate?

   • AUse a dumb fuzzer that randomly mutates bytes in the sample files without any feedback.
   • BUse a grammar-based fuzzer that generates inputs from a formal specification of the file format, ignoring the sample files.
   • CUse a network-based fuzzer to send random data to the application's network interface, bypassing the file parser.
   • DUse a coverage-guided fuzzer like AFL, providing the sample files as the initial seed corpus and compiling the target with instrumentation.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A malware analyst is examining a Windows PE executable that is packed. The analyst wants to understand the unpacking routine and the original code. Which approach is most effective?

   • AUse a debugger to step through the unpacking routine and then dump the process memory once the original code is unpacked.
   • BUse a static disassembler like IDA Pro to analyze the packed binary directly, ignoring the packer.
   • CUse the 'strings' utility to extract strings from the packed binary to understand its functionality.
   • DUse a PE parser like pefile to analyze the import table and identify the packer's imports.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A security analyst is analyzing a firmware image from an IoT device. The analyst has extracted the filesystem and identified a web service binary. The analyst wants to perform dynamic analysis of the web service, but the binary is compiled for a MIPS architecture. The analyst's host machine is x86_64. Which approach is most effective?

   • AUse a disassembler to analyze the binary statically and infer its behavior without running it.
   • BUse QEMU full-system emulation to boot the entire firmware, including the kernel and filesystem, and then interact with the web service.
   • CUse a cross-compiler to recompile the binary for x86_64 and then run it natively.
   • DUse QEMU user-mode emulation to run the binary directly, providing the extracted filesystem as the root.
   Reveal Solution Discussion Select an answer first