Ethical Hacking - Unit 1 Quiz

Any resource that needs protection from attackers. Examples include computers, communication equipment, and storage media.

Defines who has access to what resources and to what extent.

A set of principles that ensure information is kept private (confidentiality), accurate (integrity), and available to those who need it (availability).

The process of proving one's identity. Examples include using passwords, cards, tokens, or biometrics.

Specifies the type of access authorized users have to specific resources.

The chance that an asset might be attacked. Involves analyzing and quantifying the potential risks.

The dangers or threats a system faces from attackers. Examples include snooping, traffic analysis, modification, masquerading, replaying, repudiation, and denial of service.

Weaknesses or loopholes in hardware, software, applications, or protocols that can be exploited by attackers to cause harm.

A type of virus where a hidden key is used to encrypt the rest of its code. The key is embedded within the virus and then unlocks the remaining part of the virus after infecting a system. This technique helps the virus avoid detection by security checks.

This virus hides its presence from detection by antivirus software. It can be difficult to locate and remove.

A virus that changes its form with each infection. It mutates to disguise itself, making it challenging to detect using traditional antivirus methods.

A virus that completely rewrites itself when it infects a system, modifying its internal workings and behavior. It's a more advanced form of a polymorphic virus.

A malicious program disguised as something harmless or beneficial. It tricks users into installing it, then secretly grants hackers unauthorized access to their computer.

Software designed to collect personal information about users without their consent. This information can be used for targeted advertising, identity theft, or other malicious purposes.

A set of programs that grants remote users privileged access to a system. It's usually installed after an initial attack and allows hackers to take control of an infected system.

A type of spyware that displays advertisements on your computer.

Exploiting vulnerable XML processors by uploading XML or injecting malicious content in an XML document.

Occurs when security-critical events are not logged properly, making malicious activities difficult to detect.

Occurs when an attacker can bypass access control checks by manipulating URLs, changing user IDs, or accessing unauthorized parts of the system.

A vulnerability caused by a lack of testing and secure coding practices that leads to security flaws in the app.

Insecure authentication or authorization mechanisms in an app, allowing unauthorized access.

Lack of validation of user input and output, which can lead to vulnerabilities like SQL injection and cross-site scripting (XSS).

Using insecure communication channels like HTTP instead of HTTPS, allowing attackers to intercept sensitive information.

Mobile apps that lack secure storage mechanisms for sensitive data, exposing it to potential attacks.

A type of SQL injection where the hacker uses the same communication channel to both launch the attack and gather results.

A SQL injection technique that exploits database errors to retrieve information about the database structure.

An SQL injection method where the attacker forces the database to return a true or false result, allowing them to deduce information about the database.

An SQL injection attack where the attacker crafts a query that makes the server wait for a specific time before responding. The attacker then measures this time delay to deduce information.

Pre-compiled SQL statements that separate SQL logic from user input, preventing malicious code from being executed.

Restricting user access to only the information they need to perform their tasks.

Regularly testing your systems for vulnerabilities and weaknesses to identify potential security risks.

An attack where someone tries to guess passwords or usernames using a list of commonly used credentials.

A type of rootkit that modifies application files to change their behavior, often to hide malware or gain unauthorized access.

A type of rootkit that alters the core operating system files, often to gain complete control over the system.

A type of rootkit that hides within the hardware or firmware of devices, making it incredibly difficult to detect.

A type of rootkit that exploits virtualization technology to create a hidden, unauthorized environment within a host system.

A web vulnerability that allows attackers to inject malicious scripts into websites, potentially stealing data or compromising user accounts.

A web attack that forces a user to unknowingly submit malicious requests to a website, often to compromise their account or steal sensitive information.

A type of attack that exploits security flaws in database queries to gain unauthorized access to sensitive data.

A vulnerability where attackers can manipulate data submitted through web forms to trigger unexpected actions or gain unauthorized access.

A type of phishing attack that uses fake text messages to trick people into giving up sensitive information or downloading malware.

A phishing attack that specifically targets high-profile individuals within organizations, aiming to gain access to valuable information.

A deceptive Wi-Fi network created by hackers to mimic legitimate hotspots, allowing them to intercept user data.

An attack where the attacker listens in on and records data being transmitted between two devices, often on unsecured networks.

An attack where the hacker positions themselves between a user and a website, intercepting and potentially manipulating the communication.

An attack where the attacker steals or guesses the session token, gaining control of a user's online session.