Threats and Vulnerabilities MCQ 60 Tests With Answers (2026)

Incorrect·B: The attacker inputs malicious SQL queries into web forms to manipulate the backend database

SQL Injection exploits insufficient input validation: when user-supplied data is embedded directly into a SQL query without sanitization, an attacker can inject malicious SQL syntax (e.g., ' OR '1'='1) to manipulate the query. This can bypass authentication, extract the entire database, modify or delete data (UPDATE/DROP), and in some configurations execute OS commands via xp_cmdshell. SQLi consistently appears in the OWASP Top 10.

Incorrect·B: An attack where malicious JavaScript is injected into a trusted website and executed in the victim's browser

XSS (Cross-Site Scripting) injects malicious client-side scripts (usually JavaScript) into web pages viewed by other users. Because the script executes in the context of a trusted site, it can steal session cookies (leading to session hijacking), redirect users to phishing pages, log keystrokes, and perform actions on behalf of the victim. Three types: Reflected (non-persistent), Stored (persistent), and DOM-based.

Incorrect·B: Common Vulnerabilities and Exposures (a standardized dictionary of publicly known vulnerabilities)

CVE (Common Vulnerabilities and Exposures) is a dictionary maintained by MITRE (sponsored by CISA/DHS) that assigns a unique identifier (e.g., CVE-2021-44228 for Log4Shell) to each publicly known vulnerability. CVE IDs enable consistent, unambiguous communication about vulnerabilities across security tools, advisories, and databases. The National Vulnerability Database (NVD) enriches CVE entries with CVSS scores and additional metadata.

Incorrect·B: To provide a standardized numerical score reflecting the severity and impact of a software vulnerability

CVSS (Common Vulnerability Scoring System) provides a standardized 0–10 numeric score measuring a vulnerability's severity. It uses three metric groups: Base (intrinsic characteristics — attack vector, complexity, privileges required, impact), Temporal (factors that change over time — exploit availability, patch maturity), and Environmental (organization-specific context). Scores: 0.0 = None, 0.1–3.9 = Low, 4.0–6.9 = Medium, 7.0–8.9 = High, 9.0–10.0 = Critical.

Incorrect·B: Sending more data to a computer program's memory buffer than it can hold, causing it to overwrite adjacent memory and execute malicious code

A buffer overflow occurs when a program writes more data into a fixed-size memory buffer than it was allocated, causing it to overwrite adjacent memory regions — including the return address on the stack. An attacker carefully crafts input to overwrite the return address with a pointer to their shellcode, hijacking program execution. Stack-based overflows are the classic form; heap overflows target dynamically allocated memory. Mitigations: ASLR, DEP/NX, stack canaries.

Incorrect·B: By using a pre-compiled list of common words, phrases, and previously leaked passwords

A dictionary attack uses a wordlist — compiled from common passwords (password123, iloveyou), dictionary words, proper names, and historically leaked credential databases (e.g., RockYou, Collections #1–5) — to rapidly test candidate passwords against a hash. Much faster than pure brute-force because most users choose predictable passwords. Credential stuffing is a related variant using breached username/password pairs against other services.

Incorrect·B: Altering the DNS records in a resolver's cache so that a legitimate domain name redirects traffic to a malicious IP address

DNS Cache Poisoning injects a forged DNS response into a resolver's cache, causing it to map a legitimate domain (e.g., bank.com) to an attacker-controlled IP. Victims who query the poisoned resolver are silently redirected to a malicious server without knowing — enabling credential theft, malware delivery, and man-in-the-middle attacks. The 2008 Kaminsky bug was a critical DNS poisoning vulnerability. DNSSEC (DNS Security Extensions) provides cryptographic validation to prevent this.

Incorrect·B: It tricks an authenticated user's browser into executing unwanted actions on a web application where they are currently logged in

CSRF exploits the trust a web application has in an authenticated user's browser. The attacker crafts a malicious request (e.g., a hidden image tag or auto-submitting form) on a site they control. When the victim (who is logged in to bank.com) visits the attacker's page, their browser automatically sends the forged request with their valid cookies, performing actions (fund transfers, email changes) without their knowledge. Mitigations: CSRF tokens, SameSite cookie attribute, re-authentication for sensitive actions.

Incorrect·B: An attacker exploiting a bug or design flaw to gain elevated access to resources normally protected from an application or user

Privilege escalation allows an attacker to gain higher-level permissions than originally authorized. Vertical escalation goes from a standard user → administrator/root (e.g., exploiting a SUID binary on Linux). Horizontal escalation goes from one user account to another at the same privilege level (e.g., accessing another user's files). It's a critical step in the attack kill chain after initial access — enabling data exfiltration, persistence, and lateral movement.

Incorrect·B: A web vulnerability allowing an attacker to read arbitrary files on the server running an application (e.g., using ../ to access /etc/passwd)

Directory (Path) Traversal occurs when user-supplied input is used to construct a file path without adequate sanitization, allowing an attacker to navigate outside the intended directory using sequences like ../../ to read sensitive server files (/etc/passwd, /etc/shadow, application config files, private keys). The attack exploits the file system hierarchy rather than application logic. Prevention: canonicalize paths, validate against an allowlist, use chroot jails.

Incorrect·B: Spear phishing is highly targeted at specific individuals; Whaling is a subset of spear phishing targeting high-level executives (CEOs, CFOs)

Standard phishing casts a wide net with generic messages. Spear phishing is targeted and personalized — researching the victim's name, role, and relationships to craft a convincing pretext. Whaling is a further specialization targeting "big fish" — C-suite executives and board members — whose authority can authorize large wire transfers or access sensitive systems. Business Email Compromise (BEC) fraud combines whaling with impersonation to authorize fraudulent financial transactions.

Incorrect·B: An attack that uses a massive precomputed table of cryptographic hashes to rapidly crack password hashes

A rainbow table is a precomputed data structure mapping candidate passwords to their hash values. Instead of computing a hash for each guess at runtime (as in a brute-force attack), an attacker simply looks up a stolen hash in the table to instantly find the corresponding password. Rainbow tables are orders of magnitude faster than live brute-forcing. The defense: cryptographic salting makes precomputed tables useless.

Incorrect·B: By adding random data (a "salt") to a password before hashing it, rendering precomputed hash tables useless

A salt is a random, unique value generated for each user and prepended or appended to their password before hashing: Hash(password + salt). Because the salt is unique per user, even two users with identical passwords produce different hashes — making precomputed rainbow tables useless (the table would need to be regenerated for every possible salt value, which is computationally infeasible). Modern password hashing algorithms (bcrypt, Argon2, scrypt) incorporate salts by design.

Incorrect·B: An attacker obtaining a user's valid session ID (often via XSS or sniffing) and using it to impersonate the user on a web application

Web applications use session tokens (cookies) to identify authenticated users. Session hijacking steals a valid session token — via XSS (stealing the cookie via document.cookie), network sniffing on unencrypted HTTP, or session fixation (forcing a known session ID). With the token, the attacker impersonates the victim without knowing their password. Defenses: HTTPS-only cookies, HttpOnly and Secure flags, SameSite attribute, session timeout, and re-authentication for sensitive actions.

Incorrect·B: A decoy system deliberately set up to attract, detect, and study attackers and their methods

A honeypot is a deliberately vulnerable decoy system designed to lure attackers and detect unauthorized access. It serves multiple purposes: early detection (any access to the honeypot indicates an intrusion), threat intelligence (studying attacker tools and techniques), and deception (wasting attacker time). A honeynet is a network of honeypots. Production honeypots protect live systems; research honeypots gather threat intelligence.

Incorrect·B: It operates entirely within the computer's RAM and uses legitimate system tools (like PowerShell) to avoid leaving a footprint on the hard drive

Fileless malware avoids writing executable files to disk — instead, it injects malicious code directly into the memory of legitimate running processes (e.g., PowerShell, wscript, mshta) or stores payloads in the Windows Registry. Because there is no malicious file on disk, traditional signature-based antivirus often misses it. Detection requires behavioural analysis and memory forensics. The "Living off the Land" (LotL) technique is a key component of fileless attacks.

Incorrect·B: Altering the factory-assigned Media Access Control address of a network interface to bypass access control lists or hide identity

A MAC (Media Access Control) address is a hardware-assigned 48-bit identifier unique to each network interface. MAC spoofing changes a device's MAC address to impersonate another device, bypass MAC-based access control lists (ACLs), bypass Wi-Fi MAC filtering, or hide the attacker's true identity on the local network. It is simple to perform on most operating systems and does not require special hardware. It only works within the local network segment (MAC addresses are not routable).

Incorrect·B: Registering a domain name extremely similar to a popular website (e.g., goggle.com) to trick users who mistype the URL

Typosquatting exploits common keyboard typos and misspellings by registering domain names nearly identical to legitimate sites. Attackers monetize these domains via phishing pages (credential harvesting), drive-by malware downloads, or affiliate ad fraud. Variants include homograph attacks (using visually similar Unicode characters, e.g., Cyrillic "?" instead of Latin "a"), combosquatting (adding words like bank-services.com), and soundsquatting (using homophones).

Incorrect·B: Improper Input Validation / Broken Access Control

Trusting client-supplied data for security decisions is a fundamental design flaw: clients can trivially modify cookies, hidden form fields, URL parameters, and HTTP headers. Improper Input Validation / Broken Access Control (OWASP A01) occurs when the server fails to validate that the authenticated user is actually authorized to access the requested resource or action, relying on client-side controls (hidden fields, JavaScript checks) that can be easily bypassed with developer tools or a proxy like Burp Suite.

Incorrect·B: An attacker secretly intercepting, reading, and potentially altering the communications between two parties who believe they are communicating directly

A Man-in-the-Middle (MitM) attack positions the attacker between two communicating parties, allowing them to eavesdrop on, capture, and/or modify communications in real time without either party knowing. Techniques include ARP spoofing (on local networks), SSL stripping (downgrading HTTPS to HTTP), rogue Wi-Fi hotspots, and BGP hijacking. TLS/SSL encryption and certificate pinning are primary defenses; HTTP Strict Transport Security (HSTS) prevents SSL stripping.

Incorrect·B: A vulnerability where an attacker forces the server to make requests to internal, restricted, or external resources on the attacker's behalf

SSRF exploits server-side functionality that fetches external URLs (e.g., webhooks, URL-based file parsers). An attacker provides a malicious URL that points to internal resources (http://169.254.169.254/latest/meta-data/ — the AWS EC2 metadata service), backend services (http://internal-redis:6379), or localhost endpoints normally inaccessible from the internet. Blind SSRF occurs when the server response is not returned to the attacker. SSRF was used in the 2019 Capital One breach. OWASP Top 10 A10:2021.

Incorrect·B: By extracting a hashed credential from memory and using it to authenticate to other network resources without ever needing the plaintext password

Windows NTLM authentication can accept a password hash directly without requiring the plaintext password. Pass-the-Hash (PtH) exploits this: an attacker with admin privileges uses tools like Mimikatz to extract NTLM hashes from the LSASS process memory, then uses those hashes to authenticate laterally to other systems on the network. Defenses: Credential Guard, Protected Users security group, disabling NTLM in favour of Kerberos, principle of least privilege.

Incorrect·B: An advanced exploit technique that bypasses Data Execution Prevention (DEP) by chaining together small snippets of existing executable code (gadgets) already in memory

DEP/NX marks memory regions as non-executable, preventing injected shellcode from running. ROP bypasses this by not injecting new code — instead, it chains together short instruction sequences ("gadgets") already present in the program's legitimate code (ending in RET instructions). By carefully controlling the stack, the attacker sequences these gadgets to perform arbitrary computations entirely using existing code. Combining ROP with ASLR bypass is a hallmark of sophisticated exploits.

Incorrect·B: A race condition where a system verifies an access condition but the state changes maliciously before the system actually performs the authorized action

TOCTOU is a race condition vulnerability: there is a window of time between when a system checks a condition (e.g., "does this file path point to a legitimate file?") and when it uses that result to take action (e.g., "open and read the file"). An attacker can swap the resource during this window — replacing the legitimate file with a symlink to /etc/shadow, for example. TOCTOU attacks are particularly dangerous in privileged programs (SUID binaries) and file system operations on multi-threaded systems.

Incorrect·B: Untrusted data is used to recreate an object, allowing an attacker to tamper with the serialized data to achieve Remote Code Execution (RCE) or bypass authentication

Serialization converts an object to a byte stream for storage or transmission; deserialization reconstructs it. Insecure deserialization occurs when an application deserializes untrusted, user-controlled data without validation. An attacker crafts a malicious serialized payload that, when deserialized, triggers a gadget chain invoking arbitrary method calls — leading to RCE, privilege escalation, or authentication bypass. Famous example: Apache Commons Collections gadget chains in Java. OWASP Top 10 A08:2021.

Incorrect·B: It randomly arranges the memory positions of key data areas of a program, making it incredibly difficult for an attacker to predict where to inject or execute shellcode

ASLR randomizes the base addresses of the stack, heap, and loaded libraries (DLLs/shared objects) every time a program runs. This prevents an attacker from reliably predicting memory addresses needed to redirect execution (e.g., in ret2libc attacks or ROP chains). ASLR is most effective when combined with DEP/NX (no execution in data regions) and stack canaries. Bypasses include information leaks (revealing a real address) and brute-forcing 32-bit address spaces.

Incorrect·B: Attackers using pre-installed, legitimate administrative tools (like WMI, PowerShell, or PsExec) to execute attacks without downloading custom malware

Living off the Land (LotL) is a stealth technique where APT operators use tools already present on the victim's system — WMI, PowerShell, certutil, regsvr32, mshta, PsExec, BITSAdmin — to achieve objectives. Because these are legitimate admin tools, signature-based AV and EDR solutions struggle to distinguish malicious from legitimate use. Detection relies on behavioural analytics: unusual parent-child process relationships, abnormal PowerShell execution policies, and anomalous network connections spawned from desktop apps.

Incorrect·B: An arithmetic operation attempts to create a numeric value that is outside the range that can be represented with a given number of bits, causing unexpected behavior or memory corruption

Integer overflow occurs when an arithmetic operation produces a value exceeding the maximum for its data type — wrapping around to a small or negative number. In C/C++, an unsigned 8-bit integer holding 255 + 1 becomes 0. Attackers exploit this to cause incorrect size calculations in memory allocation: if a size variable overflows to a small number, the allocated buffer is much smaller than the data it receives — enabling a heap overflow. A famous example: the 2021 OpenSSL BN_mod_sqrt() integer overflow.

Incorrect·B: An attack against an application that parses XML input, allowing an attacker to view local files, interact with internal networks, or cause a DoS via malicious entity references

XXE exploits XML parsers that process external entity references. The attacker submits XML containing a declaration like <!ENTITY xxe SYSTEM "file:///etc/passwd">, causing the parser to read and return the local file content. Beyond file disclosure, XXE enables SSRF (by referencing internal network URLs), remote code execution (via PHP expect:// wrapper), and Billion Laughs DoS (nested entity expansion). OWASP Top 10 A05:2021. Prevention: disable external entity processing in the XML parser configuration.

Incorrect·B: Reflected XSS involves the server bouncing the malicious script back to the client; DOM XSS occurs entirely within the browser's Document Object Model without server involvement

In Reflected XSS, the malicious script is included in the HTTP request (usually a URL parameter), reflected in the server's response, and executed by the victim's browser. In DOM-based XSS, the vulnerability lies entirely in client-side JavaScript: the script reads attacker-controlled data (from the URL hash, document.referrer, postMessage) and writes it unsafely to the DOM via innerHTML, document.write, or eval — the malicious payload never reaches the server, making server-side input filtering ineffective.

Incorrect·B: An SQLi attack where the database does not return data to the web page, forcing the attacker to infer information by asking the database true/false questions or measuring response times

In Blind SQLi, the application does not display database error messages or query results, but the attacker can still extract data by inferring from indirect signals. Boolean-based blind SQLi sends true/false conditions (e.g., IF(1=1,SLEEP(5),0)) and infers results from differences in the response. Time-based blind SQLi uses database time-delay functions (SLEEP, WAITFOR DELAY) and measures response time. Though slow, automated tools like SQLmap can extract entire databases character by character.

Incorrect·B: Compromising an organization by infiltrating a third-party vendor, software update mechanism, or trusted partner that has access to the target's systems (e.g., SolarWinds)

A supply chain attack targets a less-secure element in an organization's supply chain rather than the organization directly. The SolarWinds SUNBURST attack (2020) compromised SolarWinds' build pipeline to inject malicious code into legitimate software updates, reaching 18,000+ customers including US government agencies. The XZ Utils backdoor (2024) was a two-year social engineering effort to inject a backdoor into a widely used compression library. Supply chain attacks are devastating because victims trust signed updates from known vendors.

Incorrect·B: A bug where user input is passed directly to formatting functions (like printf in C), allowing an attacker to read from or write to arbitrary memory locations

C's printf family (printf, sprintf, fprintf) accept a format string with specifiers (%s, %x, %n). If user input is passed directly as the format string (printf(user_input) instead of printf("%s", user_input)), an attacker can inject their own format specifiers. %x reads values off the stack (leaking memory), %s reads strings from attacker-specified addresses (arbitrary read), and %n writes the count of characters printed to an attacker-specified address (arbitrary write) — enabling RCE. A classic but still-encountered C programming error.

Incorrect·B: They exploit speculative execution in modern CPUs, allowing an attacker to read protected data from the processor's cache memory

Modern CPUs use speculative execution — predicting likely code paths and executing them before confirming the prediction — to improve performance. Spectre and Meltdown (discovered 2017) exploit this: although speculative execution results are discarded when a branch misprediction is detected, they leave measurable side effects in the CPU cache. An attacker uses Flush+Reload or Prime+Probe cache timing attacks to infer the discarded values — reading kernel memory (Meltdown) or cross-process memory (Spectre) without authorization. Mitigations involve costly kernel patches (KPTI) and microcode updates.

Incorrect·B: Forcing a client and server to abandon a secure, modern cryptographic protocol (like TLS 1.3) and use an older, vulnerable one (like SSL 3.0)

Downgrade attacks exploit TLS/SSL backward compatibility: by interfering with the protocol negotiation handshake (using a MitM position), the attacker forces the client and server to agree on an older, vulnerable protocol version. POODLE (2014) exploited fallback to SSL 3.0, which has a CBC padding oracle vulnerability. BEAST and CRIME exploited TLS 1.0/1.1 weaknesses. Modern TLS 1.3 eliminates this by removing all backward compatible negotiation with insecure cipher suites.

Incorrect·B: An attacker injecting malicious input into a web template engine (like Jinja2 or Twig), leading to Server-Side Remote Code Execution

SSTI occurs when user-controlled input is embedded in a server-side template and evaluated by the template engine. In Flask/Jinja2, injecting {{{{7*7}}}} renders 49 — confirming injection. Escalating to RCE via Jinja2 sandbox escape allows accessing Python's os module and executing arbitrary OS commands. Every template engine has a different syntax and exploit chain, but the root cause is the same: treating user input as template code. Prevention: never pass user input to template render functions; validate strictly.

Incorrect·B: Manipulating an application into saving a malicious, crafted response in its cache, which is then served to other legitimate users

Web cache poisoning (discovered/named by James Kettle, 2018) exploits how caches distinguish between requests. By identifying unkeyed inputs (HTTP headers or parameters the cache ignores when creating keys but the application uses in responses — like X-Forwarded-Host), an attacker can craft a request that poisons the cached response with injected content (XSS payloads, redirects). The poisoned response is then served to all users making the same keyed request, allowing mass exploitation without targeting individuals.

Incorrect·B: It uses the mathematical probability of collisions (the Birthday Paradox) to find two different inputs that produce the same hash output much faster than brute-forcing

The Birthday Paradox states that in a group of 23 people, there is a 50% probability that two share a birthday. Applied to cryptography: finding any two inputs that produce the same hash (a collision) requires only approximately √N operations, not N. For a 128-bit hash like MD5, finding a collision requires ~2^64 operations — feasible with modern hardware. This undermines hash-based digital signature schemes: an attacker can substitute a malicious document with the same hash as a legitimate signed document. SHA-256 and SHA-3 provide much larger collision resistance.

Incorrect·B: Tricking a Windows application into loading a malicious Dynamic Link Library (DLL) file by placing it in a specific directory with the name of a legitimate, required DLL

Windows applications load DLLs using a search order: the current directory is checked before System32 and other system directories. DLL hijacking exploits this by placing a malicious DLL with the same name as a required legitimate DLL in a directory earlier in the search order (typically the application's own directory). When the application loads, it inadvertently loads the malicious DLL, execute attacker code in the application's security context. DLL hijacking is a common persistence and privilege escalation technique in pentesting frameworks like Metasploit.

Incorrect·B: Extracting service account credential hashes from Active Directory via Kerberos tickets and cracking them offline

Kerberoasting exploits the Kerberos authentication protocol's ticket-granting mechanism. Any authenticated domain user can request a Kerberos TGS (Ticket-Granting Service) ticket for any service registered with an SPN (Service Principal Name). These tickets are encrypted with the associated service account's NTLM hash. An attacker requests tickets for service accounts (which often use weak, static passwords), extracts the encrypted portion, and cracks it offline using hashcat or John the Ripper. Mitigation: use 25+ character random service account passwords, enable AES encryption for Kerberos.