What occurs when a command writes to VA page 30? When is it quicker to use a software-managed TLB than a hardware-managed TLB?

After a program (running as normal user) disables a capability A, it is compromised by a buffer-overflow attack. The attacker successfully injects his malicious code into this program's stack space and starts to run it. Can this attacker use the capability A? What if the process deleted the capability, can the attacker uses the capability?

If an operating system uses the FIFO page replacement algorithm and the main memory has only 3 frames, the number of page faults that will occur for the following sequence of page references is 4, 2, 5, 3, 2, 5, 4, 1, 3, 2, 4 Select one:

When a command writes to VA page 30, what occurs? When is a software-managed TLB faster than a hardware-managed TLB?