Which of the following application attacks is used to gain access to SEH?

While opening an email attachment, Pete, a customer, receives an error that the application has
encountered an unexpected issue and must be shut down. This could be an example of which of the
following attacks?

A server administrator notes that a legacy application often stops running due to a memory error. When
reviewing the debugging logs, they notice code being run calling an internal process to exploit the
machine. Which of the following attacks does this describe?

Which of the following was launched against a company based on the following IDS log?
122.41.15.252 – – [21/May/2012:00:17:20 +1200] “GET
/index.php?username=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAA HTTP/1.1″ 200 2731 “http://www.company.com/cgibin/
forum/commentary.pl/noframes/read/209″ “Mozilla/4.0 (compatible;
MSIE 6.0; Windows NT 5.1; Hotbar 4.4.7.0)”

A security administrator examines a network session to a compromised database server with a packet
analyzer. Within the session there is a repeated series of the hex character 90 (x90).
Which of the following attack types has occurred?

A security analyst, Ann, is reviewing an IRC channel and notices that a malicious exploit has been created
for a frequently used application. She notifies the software vendor and asks them for remediation steps,
but is alarmed to find that no patches are available to mitigate this vulnerability.
Which of the following BEST describes this exploit?

Using a heuristic system to detect an anomaly in a computer’s baseline, a system administrator was able
to detect an attack even though the company signature based IDS and antivirus did not detect it. Further
analysis revealed that the attacker had downloaded an executable file onto the company PC from the USB
port, and executed it to trigger a privilege escalation flaw.
Which of the following attacks has MOST likely occurred?

An attacker used an undocumented and unknown application exploit to gain access to a file server. Which
of the following BEST describes this type of attack?

Which of the following can only be mitigated through the use of technical controls rather that user
security training?

The security administrator is observing unusual network behavior from a workstation. The workstation is
communicating with a known malicious destination over an encrypted tunnel. A full antivirus scan, with
an updated antivirus definition file, does not show any signs of infection.
Which of the following has happened on the workstation?