Desktop Application Desktop Application Security 1 — Questions and Answers
Question 1: What type of attack injects malicious commands into a desktop application that passes user input to the operating system shell?
- Command injection (Correct answer)
- SQL injection
- Buffer overflow
- Cross-site scripting
Correct answer: Command injection
Command injection occurs when an app passes unsanitized user input to OS shell commands, allowing attackers to execute arbitrary commands.
Question 2: What is the principle of 'least privilege' in desktop application security?
- An application should request only the permissions it actually needs to function (Correct answer)
- Users should have the fewest features available by default
- Applications should run at the lowest visual priority
- Security updates should be minimal to avoid breaking changes
Correct answer: An application should request only the permissions it actually needs to function
Least privilege limits what an application can access or modify, reducing the damage if the application is compromised.
Question 3: What is a 'buffer overflow' vulnerability in a desktop application?
- Writing more data to a memory buffer than it can hold, potentially allowing code execution (Correct answer)
- Running out of RAM while the application is open
- Filling a database table beyond its capacity
- Sending too many network requests simultaneously
Correct answer: Writing more data to a memory buffer than it can hold, potentially allowing code execution
Buffer overflows occur when input data exceeds allocated memory, potentially overwriting adjacent memory and enabling arbitrary code execution.
Question 4: What does 'code signing' a desktop application accomplish?
- It verifies the application's publisher identity and confirms the code hasn't been tampered with (Correct answer)
- It compresses the executable to reduce download size
- It obfuscates source code to prevent reverse engineering
- It enables the app to run with administrator privileges automatically
Correct answer: It verifies the application's publisher identity and confirms the code hasn't been tampered with
Code signing uses a digital certificate to authenticate the publisher and ensure the installer hasn't been modified since signing.
Question 5: Which type of malware disguises itself as a legitimate desktop application to gain unauthorized access?
- Trojan horse (Correct answer)
- Worm
- Ransomware
- Adware
Correct answer: Trojan horse
A Trojan horse masquerades as a legitimate or useful application while secretly performing malicious actions in the background.
Question 6: What is the purpose of encrypting sensitive data stored locally by a desktop application?
- To protect data from being read if the device is lost or accessed by unauthorized users (Correct answer)
- To speed up data retrieval from disk
- To compress files to save storage space
- To prevent the application from crashing
Correct answer: To protect data from being read if the device is lost or accessed by unauthorized users
Encrypting locally stored data ensures that even if an attacker gains file system access, the data remains unreadable without the key.
Desktop Application Desktop Application Security 1
What type of attack injects malicious commands into a desktop application that passes user input to the operating system shell?