Free Application, Web, and Cloud Attacks practice questions
10 free SY0-801 questions on Application, Web, and Cloud Attacks, each with a full explanation — no account needed. This section sits in the Threats, Vulnerabilities, and Attacks part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A web page lets an admin ping a host. A request arrives with the host value set to 8.8.8.8; cat /etc/passwd and the response includes the contents of that system file. Which attack is this?
A shell separator followed by a second command that the server runs is OS command injection, and the input reached a system shell. Directory traversal would use dot-dot-slash path sequences rather than a chained command, SQL injection targets a database query, and cross-site scripting runs script in a browser, none of which is happening here.
An application shows no query output and no error messages, but an attacker sends many near-identical requests to one parameter, some of which make the response pause for several seconds. Which technique is this?
When the app returns no data or errors, an attacker uses a payload that tells the database to pause and measures the response time, which is time-based blind SQL injection. Cross-site scripting runs in a browser, LDAP injection abuses directory filter syntax, and traversal reads files, so none would show as timed yes-or-no answers from a database.
A username field receives the value *)(uid=*))(|(uid=* and the application then treats the attacker as an authenticated directory user. Which injection is this?
Parentheses, asterisks, and the pipe operator are directory-filter syntax, so an input that rewrites the filter to match or bypass a check is LDAP injection. SQL injection uses quotes and query keywords, command injection uses shell separators, and an XXE attack uses an XML document type declaration, so the punctuation here names the directory as the interpreter.
A SOAP API accepts XML that users submit. A document declares a document type with an external SYSTEM entity referencing a local file path, and the parser returns that file's contents in its response. Which attack is this, and what stops it?
A submitted document type with a SYSTEM entity that makes the parser read a local file is XXE injection, and disabling external entity resolution in the parser removes it. Parameterized queries, output encoding, and anti-CSRF tokens defend the database, the browser, and forged browser requests, not an XML parser resolving entities.
A crafted link carries a script in its query string. When a victim clicks it, the server echoes that query straight into the results page and the script runs, but only for the person who followed the link. Which type of cross-site scripting is this?
A script that is not saved but rides in a request and is reflected back into the response, running only for the victim who clicked, is reflected XSS. Stored XSS is saved on the server and runs for every viewer, DOM-based XSS executes from client-side script without the server reflecting it, and SQL injection targets a database rather than a page.
What is the purpose of a stack canary, also called a stack cookie?
A stack canary is a secret value placed before the return address, and the program stops if the value was altered, which detects an overflow that reached the return address. Random addressing is ASLR, marking memory non-executable is DEP, and automatic bounds checking is what a memory-safe language provides, so each of those is a different protection.
A standard user exploits a flaw in a SUID-root binary on Linux and uses it to spawn a shell that runs as root. Which kind of privilege escalation is this?
Going from a standard user to root is gaining a higher level of privilege, which is vertical escalation. Horizontal escalation reaches another peer's data at the same level, an insecure direct object reference is the usual vehicle for that, and a race condition is a timing flaw, so none of them describes crossing upward to root.
An overflow exploit lands the attacker's code in the stack and tries to run it, but the CPU refuses because the region is marked data-only. Which protection blocked the exploit?
Marking a region such as the stack as data-only and refusing to execute code there is Data Execution Prevention, backed by the processor's no-execute bit. ASLR randomizes addresses, a canary detects an overwritten return address, and a memory-safe language prevents the bug at the source, so none of those is what refused to run the injected code.
Why does Address Space Layout Randomization make buffer overflow exploits less reliable?
ASLR puts the program and its libraries at random addresses each time it runs, so an exploit that must know where things live often guesses wrong and the program crashes instead of being hijacked. Bounds checking belongs to memory-safe languages, the secret value is a stack canary, and refusing to execute data regions is DEP.
After a low-privilege web process is compromised, investigators see a new account added to a privileged group and an unexpected process running as SYSTEM. Which activity is indicated, and which control most limits its damage?
A low-privilege foothold followed by a new privileged group member and a SYSTEM process is privilege escalation, and least privilege with prompt patching most limits how far an attacker can climb. A buffer overflow is a memory bug, traversal reads files, and CSRF forges browser requests, so their controls do not address someone gaining higher rights.
Study this section
Every lesson that covers Application, Web, and Cloud Attacks on the SY0-801 exam.