NEW
Font size
S
M
L
XL
WorksheetsComptia Security+ Understanding Application Attacks and security
Total questions: 30
Worksheet time: 15mins
Name
Class
Date
1.
Which of the following accurately describes a SQL injection attack?
a)
An attacker exhaustively tries every possible combination of input to a system in order to bypass its security measures
b)
An attacker exploits vulnerabilities in a web application's authentication mechanism to gain unauthorized access
c)
An attacker injects malicious SQL code into a web application's database query to manipulate its behavior
d)
An attacker intercepts and modifies data between a client and a server
e)
An attacker analyzes network traffic to capture and replay authentication credentials
2.
What is the main purpose of a cross-site scripting (XSS) attack?
a)
To perform unauthorized actions on a web server by manipulating its user interface
b)
To inject malicious code into a web application and execute it on other users' browsers
c)
To intercept and decrypt sensitive information transmitted over a network
d)
To bypass authentication mechanisms and gain unauthorized access to a web application
e)
To gain unauthorized access to a system by exploiting vulnerabilities in its network protocols
3.
Which of the following is a characteristic of a zero-day exploit?
a)
It is a type of social engineering attack that tricks users into revealing their login credentials
b)
It targets a vulnerability that is already known and for which a patch has been released
c)
It uses cryptographic techniques to guess or reverse engineer passwords
d)
It takes advantage of a software vulnerability that has not yet been discovered or patched
e)
It exploits vulnerabilities in a network's protocols to gain unauthorized access
4.
Which of the following techniques can be used to mitigate the risk of a distributed denial of service (DDoS) attack?
a)
Secure coding practices and input validation
b)
Traffic filtering and rate limiting at the network level
c)
Intrusion detection and prevention systems
d)
Encryption and public key infrastructure
e)
Network segmentation and access control lists
5.
Which of the following correctly defines privilege escalation?
a)
An attacker manipulates a web application's user interface to perform unauthorized actions on a web server
b)
An attacker gains unauthorized access to a system by exploiting vulnerabilities in its network protocols
c)
An attacker injects malicious SQL code into a web application's database query to manipulate its behavior
d)
An attacker intercepts and modifies data between a client and a server
e)
An attacker gains additional privileges or access rights in a system beyond what they were originally granted
6.
What is the main objective of a DNS spoofing attack?
a)
To gain unauthorized access to a system by exploiting vulnerabilities in its network protocols
b)
To redirect the traffic of a legitimate website to a malicious one
c)
To intercept and modify data between a client and a server
d)
To inject malicious code into a web application and execute it on other users' browsers
e)
To perform unauthorized actions on a web server by manipulating its user interface
7.
What is the main purpose of input validation in an application's security?
a)
To gain unauthorized access to a system by exploiting vulnerabilities in its network protocols
b)
To perform unauthorized actions on a web server by manipulating its user interface
c)
To intercept and modify data between a client and a server
d)
To prevent malicious input from being processed and executed
e)
To encrypt and decrypt sensitive information transmitted over a network
8.
Which of the following accurately describes a phishing attack?
a)
An attacker manipulates a web application's user interface to perform unauthorized actions on a web server
b)
An attacker intercepts and modifies data between a client and a server
c)
An attacker gains unauthorized access to a system by exploiting vulnerabilities in its network protocols
d)
An attacker captures network traffic to eavesdrop on sensitive information transmitted between two parties
e)
An attacker sends fraudulent emails or messages to deceive users and obtain their sensitive information
9.
Which of the following accurately describes a man-in-the-middle (MITM) attack?
a)
An attacker injects malicious code into a web application and executes it on other users' browsers
b)
An attacker intercepts and modifies data between a client and a server
c)
An attacker captures network traffic to eavesdrop on sensitive information transmitted between two parties
d)
An attacker gains unauthorized access to a system by exploiting vulnerabilities in its network protocols
e)
An attacker manipulates a web application's user interface to perform unauthorized actions on a web server
10.
What is the main goal of a buffer overflow attack?
a)
To intercept and modify data between a client and a server
b)
To overwrite a computer program's memory and execute arbitrary code
c)
To perform unauthorized actions on a web server by manipulating its user interface
d)
To gain unauthorized access to a system by exploiting vulnerabilities in its network protocols
e)
To inject malicious code into a web application and execute it on other users' browsers
11.
Which of the following is NOT an example of an application attack?
a)
Cross-site scripting (XSS)
b)
Buffer overflow
c)
SQL injection
d)
None of the above
e)
Denial of Service (DoS)
12.
What is the primary goal of a remote code execution attack?
a)
None of the above
b)
To crash the targeted application
c)
To overload the network and deny service to legitimate users
d)
To gain unauthorized access to a remote system
e)
To steal sensitive information from the targeted system
13.
Which security measure can help prevent a session hijacking attack?
a)
Regularly patching and updating applications
b)
Implementing two-factor authentication
c)
None of the above
d)
Using strong encryption algorithms for data transmission
e)
Configuring a web application firewall (WAF)
14.
Which of the following is an example of a file inclusion attack?
a)
Cross-site scripting (XSS) attack
b)
SQL injection attack
c)
Local file inclusion (LFI) attack
d)
Remote code execution (RCE) attack
e)
None of the above
15.
Which security mechanism can help prevent a brute force attack?
a)
Limiting the number of login attempts
b)
None of the above
c)
Encrypting data during transmission
d)
Implementing multi-factor authentication
e)
Blocking suspicious IP addresses
16.
What is the main purpose of a buffer overflow attack?
a)
To gain unauthorized access to a remote system
b)
None of the above
c)
To steal sensitive information from the targeted system
d)
To execute malicious code on the targeted system
e)
To crash the targeted application
17.
What is the main purpose of a distributed denial of service (DDoS) attack?
a)
None of the above
b)
To gain unauthorized access to a remote system
c)
To inject malicious code into a web application
d)
To overload the network and deny service to legitimate users
e)
To steal sensitive information from the targeted system
18.
What is the primary purpose of a cross-site scripting (XSS) attack?
a)
To overload the network and deny service to legitimate users
b)
To inject malicious scripts into a web page
c)
None of the above
d)
To gain unauthorized access to a remote system
e)
To steal sensitive information from the targeted system
19.
Which of the following is an example of a privilege escalation attack?
a)
Man-in-the-middle (MitM) attack
b)
SQL injection attack
c)
Brute force attack
d)
Local file inclusion (LFI) attack
e)
Social engineering attack
20.
Which of the following is a mitigation technique for a SQL injection attack?
a)
Using complex passwords for database accounts
b)
Input validation and sanitization
c)
None of the above
d)
Implementing a firewall to block suspicious traffic
e)
Regularly backing up the database
21.
Understanding Application Attacks is an easy topic to comprehend.
a)
True
b)
False
22.
Cross-Site Scripting (XSS) attacks exploit vulnerabilities in web applications.
a)
True
b)
False
23.
Denial of Service (DoS) attacks aim to make a system or network unavailable to its intended users.
a)
True
b)
False
24.
Input validation is not important in preventing application attacks.
a)
True
b)
False
25.
Remote Code Execution (RCE) attacks give an attacker control over a targeted system.
a)
True
b)
False
26.
Password cracking is an example of a web application attack.
a)
True
b)
False
27.
XML External Entity (XXE) attacks can only be executed on server-side applications.
a)
True
b)
False
28.
SQL Injection attacks target the database layer of an application.
a)
True
b)
False
29.
Buffer Overflow attacks occur when a program attempts to write data outside of the memory allocated for it.
a)
True
b)
False
30.
Clickjacking attacks involve tricking the user into clicking on a malicious link.
a)
True
b)
False
Reset
