Exploit Techniques CCOA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team is hardening a Windows application server that hosts a custom application known to have a memory corruption vulnerability. The team wants to implement a mitigation that makes it harder for an attacker to predict the memory addresses of system libraries and thus more difficult to exploit the buffer overflow. Which mitigation technique should the team enable?

   • AApplication sandboxing
   • BAddress Space Layout Randomization (ASLR)
   • CCode signing
   • DData Execution Prevention (DEP)
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An attacker exploits a vulnerability in a web server that is directly accessible from the internet, without any user interaction. This is best classified as which type of exploit?

   • AClient-side exploit
   • BLocal exploit
   • CRemote exploit
   • DDenial-of-service exploit
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A software developer is reviewing a vulnerability report for a legacy web application. The report states that an attacker can submit a specially crafted input string in a search field that causes the application to execute arbitrary SQL commands against the backend database. Which exploit execution mechanism is being described, and which mitigation would be most effective to prevent this specific attack?

   • ACross-site scripting; sanitize all HTML output.
   • BBuffer overflow; enable ASLR on the database server.
   • CUse-after-free; implement DEP on the web server.
   • DSQL injection; use parameterized queries in the application code.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An incident responder is analyzing a compromised workstation. The responder finds that the attacker used a vulnerability in a local service to gain SYSTEM privileges. The attacker then used those privileges to disable the antivirus software. Which exploit category and post-exploitation action are being demonstrated?

   • AClient-side exploit; lateral movement.
   • BLocal exploit; exfiltration.
   • CRemote exploit; persistence.
   • DLocal exploit; privilege escalation.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is investigating an alert where an attacker exploited a vulnerability in a web server to gain a shell. The analyst then observes the attacker using the compromised server to scan and connect to other servers on the internal network. Which exploit category was used for the initial compromise, and which post-exploitation action is the attacker performing?

   • AClient-side exploit; persistence.
   • BLocal exploit; privilege escalation.
   • CRemote exploit; lateral movement.
   • DRemote exploit; exfiltration.
   Reveal Solution Discussion Select an answer first