Skip to content

Multiple Choice Questions

Estimate Time: 3 min read

Question 1

Which C++ type is typically used to represent a resizable, owned string suitable for reading arbitrary user input?

  • a) char*
  • b) std::array
  • c) std::string
  • d) std::string_view

Question 2

What is the primary security risk when copying unbounded user input into a fixed-size buffer without checking its length?

  • a) Buffer overflow leading to memory corruption or a crash
  • b) Disclosure of stored credentials through logs
  • c) Slower program performance under heavy load
  • d) Incorrect output formatting in the user interface

Question 3

Which C-style function is known to be unsafe because it copies a null-terminated C string without checking that the destination is large enough?

  • a) memcpy
  • b) strcpy
  • c) strncpy
  • d) std::copy

Question 4

Where is the best place to enforce a maximum allowed length for input received from an untrusted client in a typical C++ server application?

  • a) Only in client-side JavaScript to give immediate feedback
  • b) Deep inside low-level helper functions after many transformations
  • c) When formatting output for logs
  • d) Immediately at the trust boundary, before any copying or processing

Question 5

Which coding approach most directly eliminates the unsafe pattern of copying raw input into a small fixed buffer in C++ authentication code?

  • a) Allocate a larger fixed-size char array and hope inputs never exceed it
  • b) Use raw pointers and manual memory management with new/delete
  • c) Use std::string for input and stored credentials and reject inputs that exceed a documented maximum
  • d) Call strlen() repeatedly and trust the result implicitly

Question 6

When testing input-length validation, which single test case is most likely to reveal an off-by-one error in the length check?

  • a) An empty string
  • b) A string with length exactly one greater than the allowed maximum
  • c) A string that is exactly equal to the allowed maximum length
  • d) A very large string of several megabytes

Question 7

Consider a program that uses std::getline to read a line into std::string, then immediately calls std::strcpy(dest, input.c_str()) where dest is declared as char dest[64]. What is the most likely outcome if an attacker supplies a very long input line?

  • a) A stack buffer overflow or memory corruption that can crash the process
  • b) std::getline will automatically truncate the input to 63 characters and avoid any issue
  • c) std::strcpy will throw a standard exception that the program can catch
  • d) The C runtime will silently allocate more space for dest and copy succeeds

Question 8

Which combination of practices is the most effective overall strategy for preventing input validation failures in a C++ program that handles authentication input?

  • a) Rely solely on compiler mitigations like stack canaries and ASLR without changing validation logic
  • b) Perform validation only at the deepest internal functions to minimize repeated checks
  • c) Accept all input and depend on process restarts to recover from crashes
  • d) Centralize validation at the trust boundary, enforce explicit length and character policies, and include automated unit tests for boundary cases