CSS quiz 4 aktu

 

Q:1. If we talk about control hijacking, which of the following is true ?

1.In Buffer overflow attacks, stack based attacks are more common than heap based attack.

2.->Integer overflow attacks is not a type of control hijacking.

3.Format string vulnerabilities are used to prevent control hijacking.

4.All of the above

Reason :   Integer overflow occurs when you attempt to store inside an integer variable a value that is larger than the maximum value the variable can hold. 

Q:2. If we mark the stack and heap segement as non executable,

1.No code will execute.

2.return-oriented programming will also not be able to exploit it.

3.->we can prevent overflow code execution.

4.All of the above.

Reason: If we mark the stack and heap segement as non executable, we can prevent overflow code execution. because Overflow code execution can be prevented by marking the stack and heap segments as non-executable .

Q:3. If we talk about Return Oriented Programming, which of the following statement is true ?

1.It is a computer security exploit technique that allows an attacker to execute code in the presence of security defences such as DEP and code signing

2.These types of attacks arise when an adversary manipulates the call stack by taking advantage of a bug in the program, often a buffer overflow.

3.->Return-oriented programming is an advanced version of a stack smashing attack.

4.All of the above

Reason :  If we talk about Return Oriented Programming the right answer is All of the above because this statement is true .

Q:4. An hardware device's interrupt request invokes ____ , which handles this interrupt.

1.Instruction Set Randomization

2.Information Storage and Retrieval

3.->Interrupt Service Routine

4.Intermediate Session Routing

Reason : An ISR (also called an interrupt handler) is a software process invoked by an interrupt request from a hardware device. It handles the request and sends it to the CPU, interrupting the active process. When the ISR is complete, the process is resumed .

Q:5. Which of the following is a method of randomization?

1.ASLR

2.Sys-call randomization

3.Memory randomization

4.->All of the above.

Reason : ASLR , Sys-call randomization , Memory randomization   is a method of randomization and ISR is not a randomization .