Vulnerabilities and Attacks

Question 1

Security flaws or weakness inherent in a device’s physical components or design that that can be exploited to compromise the integrity, confidentiality, or availability of the system and its data.

Answer 1

Hardware Vulnerabilities

Question 2

Specialized form of software stored on hardware devices, like a router or a smart thermstat, that provides low-level control for the device’s specific hardware.

Answer 2

Firmware

Question 3

Refers to hardware or software products that have reached the end of their life cycle.

Answer 3

End-of-Life Systems

Question 4

Outdated computing software, hardware, or technologies that have been largely superseded by newer and more efficient alternative

Answer 4

Lagacy Systems

Question 5

Hardware or software products that no longer received official technical support, security updates, or patches from their respective vendors or developers.

Answer 5

Unsupported Systems

Question 6

Device, application, or piece of software that has not been updated with the latest security patches so that it remains vulnerable to known exploits and attacks

Answer 6

Unpatched System

Question 7

Occurs when a device’s setting, parameters, or options are not optimally set up, and this can cause vulnerabilities to exist, a decrease in performance, or unintended behavior of device or systems

Answer 7

Hardware Misconfiguration

Question 8

Involved tightening the security of a system

Answer 8

Hardening

Question 9

Involved the regular updating of the software, firmware, and applications with

Answer 9

Patching

Question 10

Used to ensure all devices and systems adhere to a standard secure configuration

Answer 10

Configuration Enforcement

Question 11

Means that the system is retired and removed from the network

Answer 11

Decommissioning

Question 12

Used to limit the potential damage that might occur from a potential security breach

Answer 12

Isolation

Question 13

Used to divide the network into segments

Answer 13

Segmentation

Question 14

Wireless technology standard used for exchanging data between fixed and mobile devices over short distance without the need for an internet connection

Answer 14

Bluetooth

Question 15

Occur when Bluetooth devices establish a connection without proper authentication

Answer 15

Insure Device Pairing

Question 16

Occurs when an attacker impersonates a device to trick a user into connecting

Answer 16

Device Spoofing

Question 17

The practice of installing application on a device from unofficial source which actually bypasses the device’s default app store

Answer 17

Sideloading

Question 18

Process that gives users escalated privileges on the devices and allows users to circumvent the built-in security measures provided by the devices

Answer 18

Jailbreaking/Rooting

Question 19

Used to conduct patching of the devices by pushing any necessary updates to the devices to ensure that they are always equipped with the latest security patches

Answer 19

MDM Solution

Question 20

Any vulnerability that’s discovered or exploited before the vendor can issue a patch for it

Answer 20

Zero-day Vulnerabilities

Question 21

Any unknown exploit in the wild that exposes a previously unknown vulnerability in the software or hardware.

Answer 21

Zero-day Exploit

Question 22

OS that have not been updated with the latest security patches or fixes

Answer 22

Unpatched Systems (Unpatched)

Question 23

Occurs when the system’s settings are not properly configured, and this leaves the system vulnerable to exploitation

Answer 23

Misconfiguration

Question 24

Unauthorized data transfers from within an organization to an external location

Answer 24

Data Exfiltration

Question 25

Occurs when an attacker has been able to craft a malicious update to a well-known and trusted program in order to compromise the systems of the program's end users.

Answer 25

Malicious Updates

Question 26

The insertion of additional information or code through a data input form from a client to an application

Answer 26

Code Injection

Question 27

Used by applications for authentication, authentication, and other types of data exchange

Answer 27

XML

Question 28

XML encodes entities that expand to exponential sizes, consuming memory on the host and potentially crashing it.

Answer 28

XML Bomb (Billion Laughs Attack)

Question 29

An attack that embeds a requestfor a local resource

Answer 29

XML External Entity ( XXE )

Question 30

Occurs when data exceeds allocated memory, potentially enabling unauthorized access or code execution

Answer 30

Buffer Overflow

Question 31

A temporary storage area where a program stores its data

Answer 31

Buffer

Question 32

A security measure that randomizes memory addresses, making buffer overflow attacks harder for attackers

Answer 32

Address Space Layout Randomization ( ASLR )

Question 33

Software vulnerabilities where the outcome depends on the timing of events, not matching the developer's intended order

Answer 33

Race Condition

Question 34

A fundamental operation in programming, and the vulnerabilities arise from unsafe or concurrent usage, particularly in scenarios involving race conditions

Answer 34

Deferencing

Question 35

Popular 2016 exploit, showcasing a race condition exploitation

Answer 35

Dirty Cow

Question 36

Type of race condition where an attacker can alter a system resource after an application checks its state but before the operation is performed

Answer 36

Time - of - Check ( TOC)

Question 37

Type of race condition that occurs when an attacker can change the state of a system resource between the time it is checked and the time it is used

Answer 37

Time - of - Use ( TOU )

Question 38

Type of race condition that involves the manipulation of data or resources during the time window when a system is making a decision or Eval

Answer 38

Time of - Evaluation ( TOE )

Question 39

Mutually exclusive flags that act as a gatekeeper to a selection of code, so that only one threat can be processed at a time

Answer 39

Mutex

Question 40

Occurs when two or more processes are unable to proceed because each is waiting for the other to release a resource

Answer 40

Deadlock

Question 41

Injects a malicious script into a trusted site to compromise the site's visitors

Answer 41

Cross-Site-Scripting ( XSS)

Question 42

This type of attack only occurs when it's launched and happens once

Answer 42

Non-persistent XSS

Question 43

Exploits the client's web browser using client-site scripts to modify the content and layout of the web page

Answer 43

Document Object Model (DOM) XSS

Question 44

Enables web applications to uniquely identify a user across several different action and requests

Answer 44

Session Management

Question 45

Known as a session cookie, which resides in memory and is used for a very short period of time

Answer 45

Non-persistent cookies

Question 46

Stored in the browser cache unit either deleted by a user or expired

Answer 46

Persistent Cookie

Question 47

Type of spoofing attacker where the attacker disconnects a host and then replaces it with his or her own machine by spoofing the original host IP

Answer 47

Session Hijacking

Question 48

Type of spoofing attack where the attacker attempts to predict the session token in order to hijack the session

Answer 48

Session Prediction

Question 49

Malicious script is used to exploit a session started on another site within the same web browser

Answer 49

Cross-Site Request Forgery