CSC 472 — Practice Quiz 2 — Review (Classes 1

Practice Quiz 2 — Review (Classes 1–11)

30 multiple-choice questions, 1 point each. Closed notes: no slides, no AI tools, no talking. Your instructor will tell you when to start and when to stop. Pick the single best answer for each question, then press Submit quiz.

Your answers are saved in this browser as you go, so a refresh or a dropped connection will not lose your work. If you submit more than once, every submission is recorded.

Your name *

Student ID *

Question 1 1 point

In this course, what is the key difference between correctness and security?

Security only matters for programs that talk over a network They are two names for the same goal Correctness always requires more code than security does Correctness handles expected input; security must hold even against a motivated adversary who hunts edge cases

Question 2 1 point

A denial-of-service (DoS) attack primarily violates which property of the CIA triad?

Authentication Availability Confidentiality Integrity

Question 3 1 point

Per the course's generative-AI policy, how should you treat an answer an AI tool gives you (for example a gadget address or an offset it suggests)?

As a hypothesis to validate against the actual target (debugger output, program behavior, a working exploit) As forbidden — AI may not be used in this course at all As ground truth you can cite directly As automatically correct as long as the script compiles

Question 4 1 point

By the cdecl convention, after a function returns, which register holds its return value?

ESI EBP EAX ESP

Question 5 1 point

Which general-purpose register is conventionally used as the counter for loop and string operations, decremented on each iteration?

EAX EDX ECX EDI

Question 6 1 point

x86/IA-32 is little-endian. The opposite ordering, big-endian, is also commonly called:

Host byte order Reverse-endian order Segment byte order Network byte order

Question 7 1 point

On x86, the cmp instruction decides whether a later conditional jump is taken by setting bits in which register?

EBP ESP EIP EFLAGS

Question 8 1 point

What does the ret instruction do at the machine level?

Zeroes out the current stack frame Pops the value at the top of the stack into EIP, transferring control there Pushes EIP onto the top of the stack Jumps to a fixed address encoded in its opcode

Question 9 1 point

Under the cdecl calling convention, in what order are a function's arguments pushed onto the stack?

In alphabetical order of the parameter names Always in registers, never on the stack Left-to-right (first argument pushed first) Right-to-left (last argument first), so arg1 ends up at the lowest address

Question 10 1 point

In cdecl, who removes the arguments from the stack after the call returns?

Nobody — they stay on the stack permanently The caller (e.g. add esp, 8) The callee, via ret N The operating system kernel

Question 11 1 point

In a typical 32-bit cdecl stack frame, what is stored at [ebp+4]?

The saved return address The caller's saved EBP The first local variable The first argument

Question 12 1 point

Which sequence is the standard function prologue that establishes a new stack frame?

push ebp ; mov ebp, esp sub ebp, esp ; push esp mov esp, ebp ; pop ebp pop ebp ; ret

Question 13 1 point

The x86 leave instruction is equivalent to which pair of operations?

mov esp, ebp ; pop ebp push ebp ; mov ebp, esp pop eip ; push esp add esp, 8 ; ret

Question 14 1 point

Which gdb command prints the chain of stack frames (the call backtrace)?

x/16xw $esp bt set $eip run

Question 15 1 point

On 32-bit Linux using the int 0x80 convention, which system-call number is placed in EAX to invoke execve?

0x1 0x4 0x80 0xb

Question 16 1 point

To invoke execve("/bin/sh", ...) via int 0x80, what must EBX point to?

The system-call number The saved return address The address of the pathname string to execute (e.g. "/bin/sh") The environment array, which is required to be non-NULL

Question 17 1 point

Which tool traces the sequence of system calls a running program makes?

readelf nm objdump strace

Question 18 1 point

Why must injected shellcode be position-independent?

Because the CPU refuses to run any code that contains absolute addresses Because it does not know in advance the absolute address where it will land in memory Because it must always be smaller than 10 bytes Because position-independent code always runs faster

Question 19 1 point

When shellcode sets up "/bin/sh" for execve, why is the string stored with a trailing NUL byte?

To disable the stack canary Because execve expects a NUL-terminated C string for the pathname Because a NUL byte makes the shellcode deliberately larger To serve as a NOP sled

Question 20 1 point

In this month's labs, why is gets(buf) the root cause of the overflow, and what is the standard fix?

It encrypts the input; the fix is to turn encryption off It reads only one byte, so it must be called in a loop It is too slow; replace it with scanf It reads with no bounds check; replace it with a length-limited read such as fgets

Question 21 1 point

Which gcc flag was used so the overflow could reach the saved return address without tripping a stack-smashing guard?

-no-pie -z execstack -fno-stack-protector -m32

Question 22 1 point

A NOP sled on x86 is built by repeating which single-byte opcode?

0xcc 0xeb 0x00 0x90

Question 23 1 point

In a return-to-shellcode attack (Class 9), where is the overwritten return address made to point?

Into the NOP sled leading to the injected shellcode in the buffer At the saved EBP At the address of main() At a fixed libc function

Question 24 1 point

With NX/DEP enabled (-z noexecstack), what happens when execution returns into shellcode placed on the stack?

It runs normally, just more slowly The shellcode is automatically relocated to the heap and run there The stack canary silently repairs the overwritten bytes The CPU faults, because the stack is marked writable but non-executable

Question 25 1 point

In Return-Oriented Programming, what is a gadget?

A NOP sled that redirects EIP A whole function copied out of libc A short sequence of existing instructions ending in ret A hardware debug register

Question 26 1 point

In a return-chaining ROP exploit that passes arguments on the stack, what is the purpose of a pop; ret gadget inserted between two chained function calls?

To allocate a fresh stack frame with malloc To execute shellcode directly on the stack To remove (clean up) a leftover argument from the stack so the next address is treated as the following function To disable ASLR for the process

Question 27 1 point

On x86 with NX support, where is the per-page No-eXecute (NX) bit stored?

In the page table entry (PTE) for each virtual page In the EFLAGS register In the ELF file's symbol table In the saved return address

Question 28 1 point

What best describes a zero-day vulnerability?

A vulnerability for which no patch exists yet (the vendor has had zero days to respond) Any bug found by an automated scanner A bug that can never be exploited A vulnerability discovered on the day a product ships

Question 29 1 point

In the Class 11 demo, why is rop2.c compiled as a statically linked binary?

To bulk the binary up with library code so it contains enough ROP gadgets To enable ASLR for the process To make the program run faster To remove the need for a stack entirely

Question 30 1 point

In string and memory-copy operations, which register conventionally holds the destination pointer?

EDI EBX ECX ESI