9.2.2 User Input Security

Which of the following is an example of user input?

• When a user fills in a form.

• When a user views a webpage.

• When a user downloads a file.

• When a user reads an email.

What type of attack can occur when a website accepts user input?

• Directory Traversal

• Phishing

• Man-in-the-Middle

• Denial of Service

Which of the following is NOT a type of attack that can occur from user input?

• Buffer Overflow

• Command Injection

• Cross-Site Scripting (XSS)

• Phishing

What is Cross-Site Scripting (XSS)?

• An attack where malicious scripts are injected into trusted websites.

• An attack that disrupts the service of a network.

• An attack that intercepts communication between two parties.

• An attack that encrypts data and demands ransom.

What is the goal of a Directory Traversal attack?

• To delete files in the root folder

• To access files outside the permitted system space

• To encrypt files in the system

• To create new files in the root folder

What tactic is used in a Directory Traversal attack?

• Inserting a series of ../ characters into the URL or software code

• Deleting system files

• Encrypting the root folder

• Creating new user accounts

What is a buffer overflow?

• A situation where the data is smaller than the input variable can hold.

• A situation where the data is larger than the input variable can hold and overflows into process execution space to run hostile code.

• A situation where the data is exactly the size of the input variable.

• A situation where the data is stored in the CPU.

What can the extra data do once there is a buffer overflow?

• It can execute with system-level privileges.

• It can be deleted automatically.

• It can be stored in the memory buffer.

• It can be transferred to another system.

What is the primary goal of command injection?

• To insert text into form fields for data validation

• To run terminal commands on the hosting server

• To enhance the user interface of a website

• To improve website performance

How can an attacker fool a website into accepting multiple commands?

• By using special characters to connect parts of the user input

• By using long strings of text

• By inserting HTML tags

• By using encrypted data