CompTIA Security+ Exam SY0-501 Common Vulnerabilities

A situation in which an application writes to or reads from an area of memory that it is not supposed to access is referred to as:

• Buffer overflow

A collection of precompiled functions designed to be used by more than one Microsoft Windows application simultaneously to save system resources is known as:

• DLL

Which of the terms listed below describes a type of attack that relies on executing a library of code?

• DLL injection

A predefined username/password on a brand new wireless router is an example of:

• Default configuration

Which of the terms listed below refers to a software that no longer receives continuing support?

• EOL

After feeding an input form field with incorrect data, a hacker gets access to debugger info providing extensive description of the error. This situation is an example of:

• Improper error handling

A situation in which a web form field accepts data other than expected (e.g. server commands) is an example of:

• Improper input validation

Which of the following violates the principle of least privilege?

• Improperly configured accounts

Which of the following factors pose the greatest risk for embedded systems? (Select 2 answers)

• Inadequate vendor support • Default configurations • Improper input handling

Which of the terms listed below describes a programming error where an application tries to store a numeric value in a variable that is too small to hold it?

• Integer overflow

A situation in which an application fails to properly release memory allocated to it or continually requests more memory than it needs is called:

• Memory leak

Which of the following terms describes an attempt to read a variable that stores a null value?

• Pointer dereference

A malfunction in preprogrammed sequential access to a shared resource is described as:

• Race condition

Which of the answers listed below describes the result of a successful DoS attack?

• Resource exhaustion

An effective asset management process provides countermeasures against: (Select all that apply)

• System sprawl • Undocumented assets • Architecture and design weaknesses

In the IT industry, the term "System sprawl" is used to describe poor hardware resource utilization.

• True

The purpose of a downgrade attack is to make a computer system fall back to a weaker security mode which makes the system more vulnerable to attacks.

• True

What is the best countermeasure against social engineering?

• User education

Zero-day attack exploits:

• Vulnerability that is present in already released software but unknown to the software developer

An e-commerce store app running on an unpatched web server is an example of:

• Vulnerable business process