15. Review Questions

Conceptual Questions

Why is TCP more vulnerable to state-exhaustion attacks than IP?
Why does DNS caching improve performance but also create security risk?
What is the difference between phishing and pharming?
Why can a low-rate Shrew attack still be highly damaging?
Why is source-IP spoofing especially useful in some DoS attacks?
What makes buffer overflow a control-flow problem and not just a crash problem?
Why are worms typically more dangerous at internet scale than viruses?
Why can SYN scanning reveal open ports without fully establishing connections?
Why are salted password hashes more resistant to rainbow-table attacks?
Why is Slowloris considered an application-layer attack?
What is the difference between SQL injection and XSS?
Why do standard protocols such as IRC or HTTP help botnets hide?
Why can spear phishing succeed even in well-engineered networks?
Why does sandboxing help mobile security?
Why are side-channel attacks different from ordinary software-input attacks?

Applied Questions

A server shows many half-open connections. Which attack should you suspect first, and why?
A resolver suddenly sends users to the wrong IP address for a legitimate domain. What attack categories should you investigate?
Authentication logs show repeated attempts for usernames like admin, root, and oracle. What is the likely attack type?
A web server remains responsive to pings but new HTTP clients hang. Which attack classes could explain this?
A browser executes injected script after a victim clicks a crafted link. What type of vulnerability is this?
A company sees thousands of compromised webcams sending traffic to one target. What major security story does this resemble?
A smartcard reveals secret-dependent timing variation. What attack family does that indicate?

← Suggested Lab Roadmap