Security Ch.5

Which attack intercepts communications between a web browser and the underlying computer?

• man-in-the-middle (MITM)

• man-in-the-browser (MITB)

• replay

• ARP poisoning

Olivia was asked to protect the system from a DNS poisoning attack. What are the locations she would need to protect?

• Web server buffer and host DNS server

• Reply referrer and domain buffer

• Web browser and browser add-on

• Host table and external DNS server

Newton is concerned that attackers could be exploiting a vulnerability in software to gain access to resources that the user normally would be restricted from accessing. What type of attack is he worried about?

• Privilege escalation

• Session replay

• Scaling exploit

• Amplification

Which of the following adds new functionality to the web browser so that users can play music, view videos, or display special graphical images within the browser?

• Extensions

• Scripts

• Plug-ins

• Add-ons

An attacker who manipulates the maximum size of an integer type would be performing what kind of attack?

• integer overflow

• buffer overflow

• number overflow

• heap overflow

What kind of attack is performed by an attacker who takes advantage of the inadvertent and unauthorized access built through three succeeding systems that all trust one another?

• privilege escalation

• cross-site attack

• horizontal access attack

• transverse attack

Which statement is correct regarding why traditional network security devices cannot be used to block web application attacks?

• The complex nature of TCP/IP allows for too many ping sweeps to be blocked.

• Web application attacks use web browsers that cannot be controlled on a local computer.

• Network security devices cannot prevent attacks from web resources.

• Traditional network security devices ignore the content of HTTP traffic, which is the vehicle of web application attacks.

What is the difference between a DoS and a DDoS attack?

• DoS attacks are faster than DDoS attacks

• DoS attacks use fewer computers than DDoS attacks

• DoS attacks do not use DNS servers as DDoS attacks do

• DoS attacks user more memory than a DDoS attack

John was explaining about an attack that accepts user input without validating it and uses that input in a response. What type of attack was he describing?

• SQL

• XSS

• XSRF

• DDoS DNS

Which attack uses the user's web browser settings to impersonate that user?

• XDD

• XSRF

• Domain hijacking

• Session hijacking