Why are hardware vulnerabilities a growing security concern?

More devices are connecting to networks, increasing the attack surface

Why are vulnerabilities in applications a security risk?

Fthat attackers can exploit, even if they haven't been discovered yet

How does a SQL injection (SQLi) attack work?

Inserting malicious SQL code into input fields to manipulate the database

What is the primary risk of a buffer overflow attack?

Overwrite memory and allow attackers to execute malicious code

What is a major security concern with virtualization?

Local privilege escalations, command injection, and information disclosure

How does memory injection work?

Adding code into the memory of an existing process to hide malware

What is one way to detect malware running in memory?

Performing memory forensics to examine running processes

What does End of Service Life (EOSL) mean for a product?

The product is no longer sold, and no more security updates are provided

Which of the following is an example of an attack on a cloud service?

Denial of Service (DoS), authentication bypass, and remote code execution

What is a race condition in programming?

Timing of events can be exploited to cause unintended behavior

What makes a zero-day attack difficult to defend against?

There is no existing patch or fix for the vulnerability

Vulnerability that allows VM to break out and interact with host system

Why is securing mobile devices particularly challenging?

They are small, always connected, and frequently move between networks

What is a security concern when using third-party service providers?

Service providers may have access to internal systems

What is a major challenge with firmware security?

Vendors provide patches for vulnerabilities but may not prioritize them

Why are operating systems a major target for attackers?

Widely used, many lines of code, increasing the chances of vulnerabilities

How does sideloading increase security risks on mobile devices?

It allows apps to be installed manually, bypassing security controls

How can attackers exploit vulnerabilities in web applications hosted in the cloud?

By performing SQL injection and XSS attacks

Why is it important to keep your operating system updated?

To ensure security patches and bug fixes are applied

What is an important security step when installing software?

Verifying the software's digital signature to confirm its authenticity

Why is it important to manage open ports and services?

To prevent unauthorized access by controlling which services are exposed

What is a major security concern with cloud adoption?

Not implementing basic security practices

What is a best practice when downloading and installing updates?

Download updates only from trusted sources

How can organizations secure network communications?

By using encrypted protocols like SSH, SFTP, and IMAPS

What is a security risk of jailbreaking or rooting a mobile device?

It disables built-in security features and mobile device management tools

What is a major risk of open permissions in cloud storage?

Hackers can find and access unsecured data repositories

How does resource reuse impact virtualization security?

Allows attackers to exploit shared system resources between VMs

What is the main cause of code injection vulnerabilities?

Improper input validation by applications

What is a best practice when managing OS vulnerabilities?

Disable updates to prevent compatibility problems with older software

How can organizations secure legacy platforms that cannot be replaced?

Implementing security measures like firewalls and IPS

What is a common security issue with default settings on devices?

They often use default login credentials, making them easy to exploit

Why are unsecured administrator accounts dangerous?

They can allow unauthorized users to gain full control over a system

What is the primary goal of a Cross-Site Scripting (XSS) attack?

Exploit browser vulnerabilities, execute malicious scripts in user session

How does a persistent (stored) XSS attack differ from a non-persistent (reflected) XSS attack?

Persistent stores the malicious script on a website, affecting all visitors

Why are supply chain attacks a major security risk?

Compromise any step in the supply chain, affecting multiple organizations

How can organizations reduce hardware supply chain risks?

Implementing strict security policies, limiting number of hardware vendors

studbud

Security Vulnerabilities

36 termsStudBud Administration15 plays

Imported from external platform

Flashcards36 cardsFPractice quizPHost liveL

Questions 36

Answers

1
Why are hardware vulnerabilities a growing security concern?
More devices are connecting to networks, increasing the attack surface
Only traditional computers are vulnerable to security exploits
Most hardware does not require security updates
Vulnerabilities in hardware are always easy to patch
2
Why are vulnerabilities in applications a security risk?
They only affect outdated software with no active support
They only exist in open-source applications
They are always immediately patched once discovered
Fthat attackers can exploit, even if they haven't been discovered yet
3
How does a SQL injection (SQLi) attack work?
Inserting malicious SQL code into input fields to manipulate the database
By using a brute force attack to guess administrator passwords
By exploiting weak encryption algorithms in a database
By infecting SQL-based applications with ransomware
4
What is the primary risk of a buffer overflow attack?
It only affects outdated operating systems with no security updates
It causes minor system slowdowns without major consequences
Overwrite memory and allow attackers to execute malicious code
It allows attackers to encrypt system files remotely
5
What is a major security concern with virtualization?
Physical machines are always more vulnerable than virtual ones
Virtual machines cannot run different operating systems
Local privilege escalations, command injection, and information disclosure
Virtualization does not require any security measures
6
How does memory injection work?
Encrypting memory data to prevent detection
Disabling antivirus software before executing the attack
By modifying the boot sequence to load malware first
Adding code into the memory of an existing process to hide malware
7
What is one way to detect malware running in memory?
Performing memory forensics to examine running processes
Scanning USB drives for hidden malicious files
Checking software licenses for expired keys
Analyzing network traffic for unusual patterns
8
What does End of Service Life (EOSL) mean for a product?
The product is still supported but only for premium customers
The product is no longer sold, and no more security updates are provided
The manufacturer is legally required to provide updates indefinitely
The product is still sold, but support is limited
9
Which of the following is an example of an attack on a cloud service?
Denial of Service (DoS), authentication bypass, and remote code execution
Encrypting local files to prevent data breaches
Using brute-force attacks to guess administrator passwords
Only targeting physical infrastructure to compromise the system
10
What is a race condition in programming?
A method used to speed up code execution
An exploit that relies on executing code with maximum efficiency
Timing of events can be exploited to cause unintended behavior
An attack that only affects network communication
11
What makes a zero-day attack difficult to defend against?
There is no existing patch or fix for the vulnerability
They require physical access to the target device
Attackers only use known vulnerabilities
Zero-day attacks only target outdated operating systems
12
What is VM escape?
Vulnerability that allows VM to break out and interact with host system
A technique used to increase VM performance
A process of isolating a virtual machine from other VMs on the same host
A method of securely backing up virtual machines
13
Why is securing mobile devices particularly challenging?
They do not store sensitive data
They are often stationary and easy to track
They are small, always connected, and frequently move between networks
They only require basic security measures like passwords
14
What is a security concern when using third-party service providers?
Service providers may have access to internal systems
All service providers are required to pass cybersecurity audits
Service providers use the latest security protocols to prevent attacks
Only IT service providers pose a risk, while other providers are safe
15
What is a major challenge with firmware security?
Vendors provide patches for vulnerabilities but may not prioritize them
Firmware is rarely targeted by attackers due to its limited functionality
Firmware updates are automatically applied without user intervention
Users can freely modify and update firmware without restrictions
16
Why are operating systems a major target for attackers?
They are only used in large enterprises, making them an easy attack vector
Widely used, many lines of code, increasing the chances of vulnerabilities
They have built-in security features that hackers try to bypass
They are rarely updated, making them outdated and easy to exploit
17
How does sideloading increase security risks on mobile devices?
It requires all apps to be downloaded from official app stores
It automatically encrypts app data before installation
It blocks the installation of unauthorized applications
It allows apps to be installed manually, bypassing security controls
18
How can attackers exploit vulnerabilities in web applications hosted in the cloud?
By ensuring all cloud services have the latest security updates applied
By performing SQL injection and XSS attacks
By restricting access to administrative accounts using role-based policies
By deploying advanced firewall solutions to secure the application
19
Why is it important to keep your operating system updated?
To prevent software from using too much storage
To make the system run faster than before
To disable automatic update settings permanently
To ensure security patches and bug fixes are applied
20
What is an important security step when installing software?
Allowing updates from any source to ensure software stays current
Disabling automatic updates to prevent compatibility issues
Verifying the software's digital signature to confirm its authenticity
Only installing software that does not require internet access
21
Why is it important to manage open ports and services?
To allow all incoming connections for better connectivity
To improve system performance by closing unused applications
To ensure maximum network speed and efficiency
To prevent unauthorized access by controlling which services are exposed
22
What is a major security concern with cloud adoption?
Moving data to the cloud eliminates the need for best practices
Cloud services prevent unauthorized access without user intervention
Not implementing basic security practices
Cloud data is always encrypted, making it immune to attacks
23
What is a best practice when downloading and installing updates?
Click on pop-ups that suggest updates while browsing the web
Download updates only from trusted sources
Ignore update notifications to avoid possible malware
Disable security controls to allow unsigned applications to install
24
How can organizations secure network communications?
By enabling Telnet and FTP for faster data transfer
By capturing all network packets and storing them in plaintext
By allowing all network traffic to pass through without restrictions
By using encrypted protocols like SSH, SFTP, and IMAPS
25
What is a security risk of jailbreaking or rooting a mobile device?
It automatically encrypts all stored data
It ensures the device always has the latest updates
It disables built-in security features and mobile device management tools
It prevents the user from installing any apps
26
What is a major risk of open permissions in cloud storage?
Only internal employees can view files, making it a low security risk
It prevents legitimate users from accessing files
Hackers can find and access unsecured data repositories
Cloud storage services automatically detect and block unauthorized access
27
How does resource reuse impact virtualization security?
It increases system performance by blocking resource allocation between VMs
It prevents VMs from using shared storage space
It makes virtual machines completely independent from each other
Allows attackers to exploit shared system resources between VMs
28
What is the main cause of code injection vulnerabilities?
Strict access controls preventing unauthorized data entry
Strong encryption methods used to secure data
Improper input validation by applications
Automated security patches applied regularly
29
What is a best practice when managing OS vulnerabilities?
Update regularly, but test patches before deployment to avoid system issues
Wait until an operating system reaches end-of-life before applying patches
Only install updates if a security breach occurs
Disable updates to prevent compatibility problems with older software
30
How can organizations secure legacy platforms that cannot be replaced?
By ensuring they always run the latest operating system updates
By replacing them immediately with newer devices, regardless of cost
By completely disconnecting them from the network
Implementing security measures like firewalls and IPS
31
What is a common security issue with default settings on devices?
They require advanced encryption to be modified
They restrict network access to trusted users
They prevent unauthorized software from being installed
They often use default login credentials, making them easy to exploit
32
Why are unsecured administrator accounts dangerous?
They automatically disable accounts after multiple failed login attempts
They can allow unauthorized users to gain full control over a system
They are only a risk if used on personal computers
They prevent users from logging in with weak passwords
33
What is the primary goal of a Cross-Site Scripting (XSS) attack?
To bypass encryption protocols on a web server
To inject SQL commands into a website’s database
To disable JavaScript in the victim's browser
Exploit browser vulnerabilities, execute malicious scripts in user session
34
How does a persistent (stored) XSS attack differ from a non-persistent (reflected) XSS attack?
A non-persistent XSS attack remains permanently in a web application
A persistent XSS attack is removed from a website after execution
Persistent stores the malicious script on a website, affecting all visitors
A non-persistent XSS attack cannot steal session cookies
35
Why are supply chain attacks a major security risk?
They exploit vulnerabilities in a company's internal software
They require direct physical access to a company’s hardware
They only target small businesses with weak security
Compromise any step in the supply chain, affecting multiple organizations
36
How can organizations reduce hardware supply chain risks?
By only using open-source hardware to ensure transparency
By purchasing equipment from multiple suppliers to diversify risk
Implementing strict security policies, limiting number of hardware vendors
By installing custom firmware to override potential security flaws

Security Vulnerabilities Flashcards | StudBud