Quiz
4337 Final Practice Quiz
Crie uma conta grátis para terminar este quiz
Salve seu progresso e veja sua nota final.
Já tem uma conta? Inicie sessão
Perguntas do quiz (89)
1
The RAD compiler solution can prevent against code injections.- ATrue
- BFalse
2Buffer-overflow attack can take place if a machine can execute a code that resides in the data/stack segment.
- ATrue
- BFalse
3Which of the following programming languages is not susceptible to a stack-based buffer overflow attack?
- AC
- BAssembler
- CC++
- DJava
4What can be overwritten by a buffer overflow that causes a security problem?
- ASecurity-sensitive data
- BA return pointer
- CAny kind of pointer
- DAnything that will make the program crash
- EAll of the above
5In an application that uses heap, the memory for data is allocated ____________
- Alogical
- Bdynamically
- Cstatically
- Dat the beginning of the program
6For strongly-typed languages
- AOnly static type checking is done
- BOnly dynamic checking is done
- CBoth static and dynamic checking are done
- DNo type checking is done
7What typically happens when a buffer is overflowed?
- AThe memory space that comes after the buffer holds the extra data as well as keeping the data that it contained before
- BWhatever is in the memory space that comes after the buffer is overwritten
- CThe memory chip in the computer gets too big and explodes
- DElectrons fall out of the memory chip and start a fire
8Variables that get created dynamically when a function (such as malloc()) is called is created in the form of _______ data structure.
- Aarray
- Bqueue
- Cstack
- Dheap
9Buffer-overflow may remain as a bug in apps if __________ are not done fully.
- Aboundary hacks
- Bmemory checks
- Cboundary checks
- Dbuffer checks
10Which one of the following languages supports dynamic type binding? _____________
- AC++
- BJava
- CPython
- DNone of the above
11Where can an attacker who is trying to "smash the stack" put their attack code if the buffer to be overflowed is on the stack? (5)
- AOn the stack before the return pointer
- BOn the stack after the return pointer
- CIn the stack frame of another function
- DOn the heap
- EALL OF THE ABOVE
12Which one of the following is an example of an explicit heap-dynamic variable?
- Aint x;
- Bstatic int x;
- Cscores = [91, 92, 93];
- Dint *p = (int*) malloc(50);
13If you declare an array as A[100] in C and you try to write data to A[555], what will happen?
- ANothing
- BThe C compiler will give you an error and won't compile
- CThere will always be a runtime error
- DWhatever is at A[555] will be overwritten
14What is a strong type system?
- Athe type system in which only built-in data types are allowed.
- Bthe type system in which only user-defined data types are allowed.
- Cthe type system that guarantees not to generate type errors.
- Dnone of these
15Why apps developed in languages like C, C++ is prone to Buffer-overflow?
- ANo string boundary checks in predefined functions
- BNo storage check in the external memory
- CNo processing power check
- DNo database check
16Which kinds of operations are most likely to lead to buffer overflows in C?
- AFloating point addition
- BIndexing of arrays
- CPointer arithmetic
- DIndexing of arrays and Pointer arithmetic
- Enone of the above
17Which programming language is vulnerable to stack buffer overflow?
- AC
- BJava
- CAssembly
18Stack canaries are used to detect stack buffer overflows.
- ATrue
- BFalse
19Stack canaries will prevent any attack that overflows local variables from executing injected code.
- ATrue
- BFalse
20Using strnccpy instead strcpy of eliminates completely all string-based buffer overflows.
- ATrue
- BFalse
21How can a stack buffer overflow hijack the control flow of the program?
- AOverwriting the return address on the stack
- BOverwriting a function pointer on the stack
- Call of the above
- Dnone of the above
22Which of the following are common defenses against stack buffer overflow?
- AAddress Space Layout Randomization (ASLR)
- BNon-executable stack
- Call of the above
- Dnone of the above
23ASLR is a defense against buffer overflow attacks.
- ATrue
- BFalse
24Negative length overflows can result in executing the follwong segment of C code:
char buf[128];
int i, len;
int fd = open("foo.txt", O_RDONLY);
read(fd, &len, sizeof(len));
if (len < 128)
buf = malloc(len);- ATrue
- BFalse
25Which of the following types of locations in a process address space that buffer overflow attacks typically target?
- AStack
- BHeap
- Ccode
- Dnone of the above
26In Control Flow Integrity (CFI), an in-line reference monitor is a rewriting of the program by inserting instructions to check whether the CFI property is maintained.
- ATrue
- BFalse
27Control flow integrity (CFI) is a security mechanism that allows changes to the original control flow graph of a compiled binary.
- ATrue
- BFalse
28How can a stack buffer overflow hijack the control flow of the program?
- AOverwriting the return address on the stack
- BOverwriting a function pointer on the stack
- CAll of the above
- DNone of the above
29In Control Flow Integrity (CFI), the detailed labeling method will allow a return from a function to any other function as long as it exists in the same program.
- ATrue
- BFalse
30A Web site that allows users to enter text, such as a comment or a name, and then stores it and later displays it to other users, is potentially vulnerable to a kind of attack what attack is it…
- ACross-site scoring scripting
- BCross-site request forgery
- CCross-site scripting
- DTwo-factor authentication
- ENone of these
31Reflected XSS occurs when an attacker gets a victim to send a request with malicious input to a server which includes the unsanitized input in the HTML output it produces.
- ATrue
- BFalse
32Which of the following is a challenge in program behavior-based detection:
- ADetermining the control flow graph of the program
- BDetecting deviations from the control flow graph of the program
- CAll of the above
- DNone of the above
33In return-oriented programming, a return from a hijacked function can not be controlled by the hijacker.
- ATrue
- BFalse
34Which of the following is wrong about Java Byte Code Verifier?
- AChecks that variables are initialized before they are used.
- BChecks that rules for accessing private data and methods are not violated.
- CChecks that the runtime stack does not overflow.
- DChecks that the computer resources are available
- ENone of the above
35Control flow integrity cannot be defeated by modifying the code labels to allow the desired control flow.
- ATrue
- BFalse
36In Control Flow Integrity (CFI), direct calls to functions do need to be monitored.
- ATrue
- BFalse
37HTML/JavaScript are the primary languages targeted by cross-site scripting attacks.
- ATrue
- BFalse
38Return-oriented programming may exploit shellcode or injected code
- ATrue
- BFalse
39In ROP, it is possible to invoke an arbitrary function simply by placing a fake frame in stack memory.
- ATrue
- BFalse
40Which of the following is not an example of an XSS attack?
- AStored XSS
- BDNS XSS
- CReflected XSS
- DDOM-based XSS
41Which statement is wrong about orchestrating gadgets in return-oriented programming:
- AGadgets can be pieced together to accomplish a task.
- BEvery gadget must end with a RET.
- CSome gadgets can be injected onto the stack.
- DGadget my return to another gadget.
42One common strategy to prevent XSS vulnerabilities is to (choose the best answer):
- AEducate your users to recognize safe vs. unsafe web pages.
- BEscape the user's input is valid as soon as possible.
- CAvoid using JavaScript on your site.
- DUse an interpreted programming language such as Java or C#.
- EMake sure your database is configured for strong security.
43The Same Origin Policy prevents XSS attacks if a browser implements it correctly.
- ATrue
- BFalse
44Return-oriented programming cannot defeat a non-executable stack.
- ATrue
- BFalse
45Singed by an untrusted principal remote java code has very restricted access to computer resources.
- ATrue
- BFalse
46Which of the following option leads to the portability and security of Java?
- ABytecode is executed by JVM
- BThe applet makes the Java code secure and portable
- CUse of exception handling
- DDynamic binding between objects
47It determines what resources a class can access such as reading and writing to the local disk.
- ABytecode Verifier
- BJVM
- CClassloader
- DSecurity Manager
48Which of the following checks the code fragments for illegal code that can violate access right to objects?
- ASecurity Manager
- BJVM
- CBytecode Verifier
- DClass loader
49Which element of Java sandbox associates permission with a particular code source?
- ACode source
- BKeystores
- CProtection Domain
- DPolicy file
50The server can trust cookie values in HTTP requests to be untampered since the cookies are set by the server.
- ATrue
- BFalse
51An attack on a website that stores and displays text to a user is known as _______ attack.
- ASQL attack
- BXSS attack
- CXRP attack
- DNone of the above
52Protection domains cannot be established by the class loader
- ATrue
- BFalse
53An attacker of return-oriented programming may overflow the buffer by
- Aappending only one fake calling frame
- Bappending one or more fake calling frames
- Cappending only the fake address of a system function.
- Dnone of the above
54Return-oriented programming may exploit a stack buffer overflow.
- ATrue
- BFalse
55The sandbox restrictions provide strict limitations on which system resources the applet can request or access.
- ATrue
- BFalse
56In hardware-enforced NX bit (non-executable bit)
- AThe EIP can jump to the Heap
- BThe EIP can jump to the Stack
- CThe EIP can jump to executable regions
- Dnone of the above
57Code injection is caused when untrusted user data unexpectedly becomes code.
- ATrue
- BFalse
58Which process makes two different Logical expressions look identical?
- AUnification
- BLifting
- CInference Process
- DNone of the above
59The cut (in Prolog) is a goal, written as !, which always succeeds, but cannot be backtracked.
- ATrue
- BFalse
60Which one from the options would return true/yes for the following prolog program?
boy(john,123).
girl(jane,234).
student(john,123).- A?- girl(jane,x).
- B?- boy('john',123).
- CAll of the above.
- DNone of the above
61In Prolog, in what manner is a state-space tree for a backtracking algorithm constructed?
- ADepth-first search
- BBreadth-first search
- CTwice around the tree
- DNearest neighbor first
62Backtracking is necessary for Prolog programs to provide multiple answers.
- ATrue
- BFalse
63A variable in Prolog must start with either an upper-case letter or an underscore (_).
- ATrue
- BFalse
64what is the use of 'is' in prolog programming?
- Aunification
- Barithmetic evaluation
- Creduction
- DNone of above
65The scope of a variable in Prolog is a single clause (i.e., a fact or rule) or a single query.
- ATrue
- BFalse
66The inference engine in Prolog works on ______.
- AForward Chaining
- BBackward Chaining
- CBoth a and b
- DNone of the above
67What would the output of the following Prolog query be?
?- f(a,b) = f(Y,X)- AX=b. Y=a.
- BThis expression will not compile.
- CX=a. Y=b.
- DX=X. Y=Y.
68Prolog was developed primarily for applications in science and engineering.
- ATrue
- BFalse
69For the PROLOG goal:
?-[[X,Y],Z|R]=[[a,b],[1,2],[c,d]] .
Which binding apply?- AX=a Y=b Z=[1,2] R=[[c,d]]
- Bnone, because the goal fails
- CX=a Y=b Z=1 R=[2,c,d]
- DX=a Y=b Z=[c,d] R=[c,d]
70What is the output of the following statement?
(define p .6)
(cond ((> p .75) 'very-likely) ((> p .5) 'likely) ((> p .25) 'unlikely) (else 'very-unlikely))- AVery-likely
- BLikely
- CUnlikely
- DVery-unlikely
71The lambda special form can be used to define "anonymous" functions in Lisp.
- ATrue
- BFalse
72What is the output of the following statements?
(define (aaa-x x) (lambda(y)(+ x y)))
(define add-d (aaa-x 7))
(add-d 15)- A7
- B14
- C22
- Derror
73Functions are considered first-class citizens in the functional programming languages, implying that:
- AFunctions can be passed as arguments to other functions.
- BFunctions can be returned as results from other functions.
- CFactions can be assigned to names
- Dall of the above
74What will be the output of the following statement?
(cons (car '(a b)) (cdr '(p q)))- A'(p q)
- B'(a b)
- C'(a q)
- D'(a p)
75Every s-expression in Lisp returns a value when evaluated.
- ATrue
- BFalse
76What is the output of the given statements?
(define abc-list '(a b c))
(car (cdr abc-list))- Aa
- Bb
- Cc
- DNone of the mentioned
77What is the output of the following statements?
(define mystery (lambda (proc1 proc2 x) (proc2 (proc1 x))))
(mystery sqrt sqr 9)- A9
- B3
- C81
- Derror
78What is the output of the following LISP program?
(define (b p) (+ p p) )
(define z 1)
(b z)- A2
- B1
- C3
- Derror
79What is the output of the following statements?
(define thing 'sphere)
(define r 2)
(cond ((eq? thing 'circle) (* 3 r r)) ((* 4 3 r r)))- A6
- B12
- C24
- D48
80What is the output of the following statements?
(define meals '(breakfast lunch tea dinner))
(cons (first (rest meals)) '( ))- A'(breakfast)
- B'(lunch)
- C'(dinner)
- D'(lunch tea)
81What is the output of the following statements?
(define whole-list '(monday tuesday wednesday thursday friday))
(define (mystery) (cons (first whole-list) (last whole-list)))
(mystery)- A'(monday.friday)
- B'(monday friday)
- C'( )
- Derror
82Think of a way to write the addition of four numbers using the maximum possible braces?
- A(+ 1 2 3 4)
- B(+ (+ 1 2) (+ 3 4))
- C(+ 1 (+ 2 (+ 3 (4))))
- D(+ 1 2 (+ 3 4))
83Which of the following can be considered as a List?
- Anumber
- B#t
- Cnil
- Dempty
84What is the output of this racket program?
(define (multiply p q) (* p q))
(cons 4 (multiply 2 4))- A'(8 . 8)
- B'(4 . 4)
- C'(4 . 8)
- D'(8 . 4)
85Which of the following racket expressions would be interpreted as #f when evaluated:
- Anil;
- B-1;
- C(car '(0 1));
- D'();
- Enone of the above.
86What is the output of the following statement?
(define x 'outside)
(let ((x 'inside) (y x)) (list x y))- A'(outside)
- B'(inside)
- C'(inside outside)
- D'(outside inside)
87What S-expression consists of?
- AAtoms and Lists
- BNumeric only
- CLiterals only
- DAtoms only
88What distinguishes a purely "functional'' programming language from an "imperative'' one?
- AThere are no variables and hence no assignment operation in a purely functional language
- BA purely functional language lacks the "go to'' statement, but an imperative language always has such a command
- CAll subprograms must be declared with the keyword function in a purely functional language
- DThere is no real difference, only a difference in the recommended coding style
89What is the output of the given statements?
(define high 98)
(define temperature 102)
(when (> temperature high) high)- A98
- B102
- Cnew
- DError
Informações
- Descrição
- Quiz sobre 4337 Final Practice Quiz , criado por Saidarsh Tukkadi em 06-12-2023.
- Autor
- Saidarsh Tukkadi
- Idioma
- English
- Visualizações
- 16
- Avaliação
- Ainda sem avaliações Avalie este quiz