CS 4337 Exam 2 Review UPDATED
QUESTIONS AND CORRECT ANSWERS
The Same Origin Policy prevents XSS attacks if a browser implements it correctly. - CORRECT
ANSWER False
Return-oriented programming may exploit a stack buffer overflow. - CORRECT
ANSWER True
Which of the following option leads to the portability and security of Java? - CORRECT
ANSWER Bytecode is executed by JVM
The server can trust cookie values in HTTP requests to be untampered since the cookies are set by the
server. - CORRECT ANSWER False
Which of the following is wrong about Java Byte Code Verifier? - CORRECT
ANSWER Checks that the computer resources are available
In return-oriented programming, a return from a hijacked function can not be controlled by the
hijacker. - CORRECT ANSWER False
In Control Flow Integrity (CFI), an in-line reference monitor is a rewriting of the program by inserting
instructions to check whether the CFI property is maintained. - CORRECT ANSWER True
A Web site that allows users to enter text, such as a comment or a name, and then stores it and later
displays it to other users, is potentially vulnerable to a kind of attack what attack is it... - CORRECT
ANSWER Cross-site scripting
In hardware-enforced NX bit (non-executable bit) - CORRECT ANSWER The EIP can jump to
executable regions
In Control Flow Integrity (CFI), the detailed labeling method will allow a return from a function to
any other function as long as it exists in the same program. - CORRECT ANSWER False
, Control flow integrity (CFI) is provided by the compiler and adds instrumentation into the binary
during compile time. - CORRECT ANSWER True
An attacker of return-oriented programming may overflow the buffer by - CORRECT
ANSWER appending one or more fake calling frames
Which of the following is a challenge in program behavior-based detection:
Determining the control flow graph of the program
Detecting deviations from the control flow graph of the program
All of the above - CORRECT ANSWER All of the above
Which of the following is not a Java feature?
Dynamic
Architecture Neutral
Use of pointers
Object-oriented - CORRECT ANSWER Use of pointers
Singed by an untrusted principal remote java code has very restricted access to computer resources. -
CORRECT ANSWER True
It determines what resources a class can access such as reading and writing to the local disk. -
CORRECT ANSWER Security Manager
Protection domains cannot be established by the class loader - CORRECT ANSWER False
Return-oriented programming may exploit shellcode or injected code - CORRECT
ANSWER False
Which of the following is not an example of an XSS attack? - CORRECT ANSWER DNS XSS
QUESTIONS AND CORRECT ANSWERS
The Same Origin Policy prevents XSS attacks if a browser implements it correctly. - CORRECT
ANSWER False
Return-oriented programming may exploit a stack buffer overflow. - CORRECT
ANSWER True
Which of the following option leads to the portability and security of Java? - CORRECT
ANSWER Bytecode is executed by JVM
The server can trust cookie values in HTTP requests to be untampered since the cookies are set by the
server. - CORRECT ANSWER False
Which of the following is wrong about Java Byte Code Verifier? - CORRECT
ANSWER Checks that the computer resources are available
In return-oriented programming, a return from a hijacked function can not be controlled by the
hijacker. - CORRECT ANSWER False
In Control Flow Integrity (CFI), an in-line reference monitor is a rewriting of the program by inserting
instructions to check whether the CFI property is maintained. - CORRECT ANSWER True
A Web site that allows users to enter text, such as a comment or a name, and then stores it and later
displays it to other users, is potentially vulnerable to a kind of attack what attack is it... - CORRECT
ANSWER Cross-site scripting
In hardware-enforced NX bit (non-executable bit) - CORRECT ANSWER The EIP can jump to
executable regions
In Control Flow Integrity (CFI), the detailed labeling method will allow a return from a function to
any other function as long as it exists in the same program. - CORRECT ANSWER False
, Control flow integrity (CFI) is provided by the compiler and adds instrumentation into the binary
during compile time. - CORRECT ANSWER True
An attacker of return-oriented programming may overflow the buffer by - CORRECT
ANSWER appending one or more fake calling frames
Which of the following is a challenge in program behavior-based detection:
Determining the control flow graph of the program
Detecting deviations from the control flow graph of the program
All of the above - CORRECT ANSWER All of the above
Which of the following is not a Java feature?
Dynamic
Architecture Neutral
Use of pointers
Object-oriented - CORRECT ANSWER Use of pointers
Singed by an untrusted principal remote java code has very restricted access to computer resources. -
CORRECT ANSWER True
It determines what resources a class can access such as reading and writing to the local disk. -
CORRECT ANSWER Security Manager
Protection domains cannot be established by the class loader - CORRECT ANSWER False
Return-oriented programming may exploit shellcode or injected code - CORRECT
ANSWER False
Which of the following is not an example of an XSS attack? - CORRECT ANSWER DNS XSS
