Desktop Application Desktop Application Security 2 — Questions and Answers
Question 1: What is 'sandboxing' in the context of desktop application security?
- Running an application in an isolated environment that restricts its access to system resources (Correct answer)
- Testing an application in a development environment before release
- Storing sensitive application data in encrypted containers
- Running multiple app instances in separate virtual machines
Correct answer: Running an application in an isolated environment that restricts its access to system resources
Sandboxing isolates an application so it cannot access files, network resources, or processes outside its designated area.
Question 2: Which Windows security feature prevents unauthorized changes to the operating system by requiring elevation prompts?
- User Account Control (UAC) (Correct answer)
- Windows Defender
- BitLocker
- Windows Firewall
Correct answer: User Account Control (UAC)
UAC requires explicit administrator approval before allowing applications to make system-wide changes, limiting malware damage.
Question 3: What is a 'zero-day vulnerability' in a desktop application?
- A security flaw that is exploited before the developer has released a patch (Correct answer)
- A bug introduced on the application's launch day
- A vulnerability that takes zero seconds to exploit
- A flaw that only affects systems with zero updates installed
Correct answer: A security flaw that is exploited before the developer has released a patch
Zero-day vulnerabilities are unknown to the vendor, so attackers can exploit them with no patch available to defend against them.
Question 4: What is 'DLL hijacking' in desktop application security?
- Placing a malicious DLL in a location where it loads before the legitimate one (Correct answer)
- Stealing DLL source code from open-source projects
- Crashing an application by overloading its DLL calls
- Decompiling a DLL to find hardcoded passwords
Correct answer: Placing a malicious DLL in a location where it loads before the legitimate one
DLL hijacking tricks an application into loading a malicious DLL instead of the legitimate one by exploiting path search order.
Question 5: What is the recommended way to store API keys or passwords within a desktop application on Windows?
- Windows Credential Manager or encrypted secure storage (Correct answer)
- Plain text configuration files
- Hardcoded in the application's source code
- In the Windows Registry without encryption
Correct answer: Windows Credential Manager or encrypted secure storage
Windows Credential Manager provides secure, encrypted storage for credentials that applications can access safely.
Question 6: What does 'input validation' prevent in desktop application security?
- Malicious or malformed data from causing unexpected behavior or security vulnerabilities (Correct answer)
- Users from entering data in the wrong field
- The application from accepting too many simultaneous inputs
- Network traffic from reaching the application
Correct answer: Malicious or malformed data from causing unexpected behavior or security vulnerabilities
Input validation ensures data meets expected format, type, and range criteria before processing, blocking injection and overflow attacks.
Desktop Application Desktop Application Security 2
What is 'sandboxing' in the context of desktop application security?