Windows Execution and Memory Foundations GXPN Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security researcher is analyzing a kernel exploit and needs to understand how a virtual address is translated to a physical address. Which structure is used to store the physical page frame number for a given virtual page?

   • APage Table Entry (PTE)
   • BImport Address Table (IAT)
   • CProcess Environment Block (PEB)
   • DThread Information Block (TIB)
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You are reverse engineering a 64-bit Windows binary and have found a stack overflow in a function that uses stack cookies. The function has a local buffer and a stack cookie placed between the buffer and the saved return address. You have an arbitrary read primitive that allows you to read the stack cookie. What is the most effective way to exploit the overflow?

   • AOverwrite the return address directly without touching the stack cookie.
   • BUse a ROP chain to call the stack cookie check function and bypass it.
   • COverwrite the stack cookie with a known value and hope the check is not performed.
   • DRead the stack cookie and include it in the overflow payload to preserve it.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security team is hardening a Windows application against return-oriented programming (ROP) attacks. They have enabled DEP and ASLR. Which additional mitigation would specifically prevent an attacker from redirecting execution to an unintended indirect call target?

   • AHeap metadata encoding
   • BControl Flow Guard (CFG)
   • CStack canaries (/GS)
   • DSafeSEH
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the purpose of free lists in the Windows heap?

   • ATo map virtual addresses to physical addresses
   • BTo store the contents of freed data for debugging
   • CTo track which chunks are available for allocation
   • DTo protect against heap overflow attacks
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of Data Execution Prevention (DEP)?

   • ATo encrypt the contents of memory pages.
   • BTo prevent code execution from non-executable memory pages.
   • CTo validate indirect call targets at runtime.
   • DTo randomize the base addresses of loaded modules.
   Reveal Solution Discussion Select an answer first