Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A penetration tester receives a suspicious Linux binary from a client. The tester wants to identify the binary's architecture, linked libraries, and whether it is stripped without executing it. Which approach is most appropriate?

   • AExecute the binary in a debugger and break at the entry point
   • BUse `objdump -d` to disassemble the binary and infer the architecture
   • CRun `file` and `readelf -a` on the binary
   • DUpload the binary to VirusTotal for analysis
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A penetration tester is analyzing a Windows executable that is protected by an anti-debugging technique. The executable checks for the presence of a debugger using the IsDebuggerPresent API. The tester wants to bypass this check to continue dynamic analysis. Which approach is most effective?

   • ASet a breakpoint on the IsDebuggerPresent function and modify the return value to 0 (FALSE) when it is called.
   • BPatch the binary to replace the call to IsDebuggerPresent with a NOP instruction.
   • CUse a debugger that is not detected by the anti-debugging technique, such as a kernel-level debugger.
   • DRun the executable in a virtual machine and use a debugger outside the VM.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following best describes the reverse engineering process for a binary executable?

   • AUsing tools to inspect the binary's code and behavior to infer its functionality and weaknesses
   • BCompiling the binary from source code to understand its logic
   • CExecuting the binary in a sandbox and observing its network traffic only
   • DDeleting the binary's headers to prevent analysis
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the core idea behind Return-Oriented Programming (ROP)?

   • AOverwriting the return address to jump to a single function like system()
   • BInjecting shellcode onto the stack and executing it directly
   • CChaining together existing instruction sequences (gadgets) that end in 'ret' to perform arbitrary computations without injecting code
   • DUsing format string vulnerabilities to write arbitrary data to memory
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why is shellcode often written to avoid null bytes (0x00)?

   • ABecause null bytes can terminate strings and truncate the shellcode when copied via string functions
   • BBecause null bytes are illegal in all operating systems
   • CBecause null bytes cause the CPU to crash
   • DBecause null bytes are automatically removed by the compiler
   Reveal Solution Discussion Select an answer first