Question 6 In a function whose local variables are located behind (i.e. at smaller stack memory addresses) a buffer with an overflow vulnerability, the overflow vulnerability Not complete a. may be exploited by an attacker by using the overflow to overwrite the function's local variables ob. cannot be exploited by an attacker since overflows cannot overwrite the function's local variables Marked out of 1 c. none of the above p Flag question O d. may be exploited by an attacker by using the overflow to overwrite the function's return address Check Question 7 Security testing of software tends to be Not complete a. identical in nature to functionality testing since it only requires checking correct software outputs for known user inputs. ob. harder than functionality testing due to the large number of possible attack misbehaviours. Marked out of 1 c. all of the above p Flag question d. easier than functionality testing due to the small number of possible attacks. Check Question 8 The best way for software applications to mitigate buffer overflow vulnerabilities is to Not complete Select one: Marked out O a. none of the above of 1 b. Sanitise all user input to fit in the buffer size p Flag question C. randomise storage memory addresses d. insert canary check values in memory to detect overflows Check Question 9 Command injection vulnerabilities are often caused by user data being misinterpreted as Not complete Select one: a. none of the above Marked out of 1 Ob. user name p Flag Oc. parameters question O d. code Check Question 10 Any data that is not completely under control of a system should be considered by that system. Not complete Select one: a. validated Marked out of 1 b. trusted p Flag O c. safe question Od untrusted Check