B.3.1 Security+ SY0-601 Domain 1: Attacks, Threats, and Vulnerabilities

Question 1

Which of the following attacks tricks victims into providing confidential information (such as identity information or logon credentials) through emails or websites that impersonate an online entity that the victim trusts?

Answer 1

Phishing

Question 2

Users in your organization receive email messages informing them that suspicious activity has been detected on their bank accounts. They are directed to click a link in the email to verify their online banking username and password. The URL in the link is in the .ru top-level DNS domain.

What kind of attack occurred?

Answer 2

Phishing

Question 3

Which of the following is one of the MOST common attacks on employees?

Answer 3

Phishing

Question 4

As the security analyst for your organization, you have noticed an increase in emails that attempt to trick users into revealing confidential information. Which web threat solution should you implement to protect against these threats?

Answer 4

Anti-phishing software

Question 5

Which of the following BEST describes phishing?

Answer 5

A fraudulent email that claims to be from a trusted organization

Question 6

Which of the following social engineering attacks uses voice over IP (VoIP) to gain sensitive information?

Answer 6

Vishing

Question 7

Which of the following are functions of gateway email spam filters? (Select two.)

Answer 7

Blocks email from specific senders
Filters messages containing specific content

Question 8

If an SMTP server is not properly and securely configured, it can be hijacked and used maliciously as an SMTP relay agent. Which activity could result if this happens?

Answer 8

Spamming

Question 9

Which type of malicious activity can be described as numerous unwanted and unsolicited email messages sent to a wide range of victims?

Answer 9

Spamming

Question 10

An attacker sends an unwanted and unsolicited email message to multiple recipients with an attachment that contains malware.

Which kind of attack has occurred in this scenario?

Answer 10

Spam

Question 11

As the security analyst for your organization, you have noticed an increase in user computers being infected with malware. Which two solutions should you implement and configure to remedy this problem? (Select two.)

Answer 11

Virus scanner
Spam filters

Question 12

You are instant messaging a coworker, and you get a malicious link. Which type of social engineering attack is this?

Answer 12

Spim

Question 13

Which of the following is susceptible to social engineering exploits?

Answer 13

Instant messaging

Question 14

Which of the following is considered a major problem with instant messaging applications?

Answer 14

Loss of productivity

Question 15

You are the security analyst for your organization and have recently noticed a large amount of spim on the company mobile devices. Employees rely on the IM app to communicate with each other.

Which of the following countermeasures should you implement?

Answer 15

Use an IM blocker

Question 16

You are cleaning your desk at work. You toss several stacks of paper in the trash, including a sticky note with your password written on it. Which of the following types of non-technical password attacks have you enabled?

Answer 16

Dumpster diving

Question 17

Which of the following are examples of social engineering attacks? (Select three.)

Answer 17

Shoulder surfing
Impersonation
Keylogging

Question 18

Which of the following best describes shoulder surfing?

Answer 18

Someone nearby watching you enter your password on your computer and recording it

Question 19

Brandon is helping Fred with his computer. He needs Fred to enter his username and password into the system. Fred enters the username and password while Brandon is watching him. Brandon explains to Fred that it is not a good idea to allow anyone to watch you type in usernames or passwords.

Which type of social engineering attack is Fred referring to?

Answer 19

Shoulder surfing

Question 20

Compliments, misinformation, feigning ignorance, and being a good listener are tactics of which social engineering technique?

Answer 20

Elicitation

Question 21

An attack that targets senior executives and high-profile victims is referred to as what?

Answer 21

Whaling

Question 22

In which phase of an attack does the attacker gather information about the target?

Answer 22

Reconnaissance

Question 23

Which of the following is a common social engineering attack?

Answer 23

Distributing hoax virus-information emails

Question 24

Pretending to be somebody else and approaching a target to extract information is called what?

Answer 24

Impersonation

Question 25

Carl received a phone call from a woman who states that she is calling from his bank. She tells him that someone has tried to access his checking account, and she needs him to confirm his account number and password to discuss further details. He gives her his account number and password.

Which of the following types of non-technical password attack has occurred?

Answer 25

Social engineering

Question 26

What is social engineering?

Answer 26

It relies on human error. It works by feigning trustworthiness to convince someone to share information

Question 27

An organization’s receptionist received a phone call from an individual claiming to be a partner in a high-level project and requesting sensitive information. The individual is engaging in which type of social engineering?

Answer 27

Authority

Question 28

Social engineers are master manipulators. Which of the following are tactics they might use?

Answer 28

Moral obligation, ignorance, and threatening

Question 29

Any attack involving human interaction of some kind is referred to as what?

Answer 29

Social engineering

Question 30

A type of malware that prevents the system from being used until the victim pays the attacker money is known as what?

Answer 30

Ransomware

Question 31

Which of the following is a program that appears to be a legitimate application, utility, game, or screensaver, but performs malicious activities surreptitiously?

Answer 31

Trojan horse

Question 32

In 2001, a worm exploited vulnerabilities in Microsoft Internet Information Services (IIS) to infect over 250,000 systems in under nine hours. What was this worm called?

Answer 32

Code Red

Question 33

Which kind of virus operates only in memory and usually exploits a trusted application like PowerShell to circumvent traditional endpoint security solutions?

Answer 33

Fileless virus

Question 34

A collection of zombie computers have been set up to collect personal information. Which type of malware do the zombie computers represent?

Answer 34

Botnet

Question 35

Which of the following describes a logic bomb?

Answer 35

A program that performs a malicious activity at a specific time or after a triggering event.

Question 36

Which of the following best describes spyware?

Answer 36

It monitors the actions you take on your machine and sends the information back to its originating source.

Question 37

Which kind of malware provides an attacker with administrative control over a target computer through a backdoor?

Answer 37

Remote Access Trojan (RAT)

Question 38

Which of the following are characteristics of a rootkit? (Select two.)

Answer 38

Resides below regular antivirus software detection
Requires administrator-level privileges for installation

Question 39

While developing a network application, a programmer adds functionally that allows her to access the running program without authentication so she can capture debugging data. The programmer forgets to remove this functionality prior to finalizing the code and shipping the application.

Which type of security weakness does this describe?

Answer 39

Backdoor

Question 40

An attacker was able to gain unauthorized access to a mobile phone and install a Trojan horse so that he or she could bypass security controls and reconnect later.

Which type of attack is this an example of?

Answer 40

Backdoor

Question 41

In an effort to increase the security of your organization, programmers have been informed they can no longer bypass security during development.

Which vulnerability are you attempting to prevent?

Answer 41

Backdoor

Question 42

You have installed antivirus software on the computers on your network. You update the definition and engine files and configure the software to update those files every day.

What else should you do to protect your systems from malware? (Select two.)

Answer 42

Educate users about malware
Schedule regular full-system scans

Question 43

In a variation of the brute force attack, an attacker may use a predefined list of common usernames and passwords to gain access to existing user accounts. Which countermeasure best addresses this issue?

Answer 43

A strong password policy

Question 44

Which type of password attack employs a list of pre-defined passwords that it tries against a login prompt?

Answer 44

Dictionary attack

Question 45

Which of the following is most vulnerable to a brute-force attack?

Answer 45

Password authentication

Question 46

You are using a password attack that tests every possible keystroke for each single key in a password until the correct one is found.

Which of the following technical password attacks are you using?

Answer 46

Brute force attack

Question 47

Which of the following password attacks uses preconfigured matrices of hashed dictionary words?

Answer 47

Rainbow table attack

Question 48

Which of the following strategies can protect against a rainbow table password attack?

Answer 48

Add random bits to the password before hashing takes place

Question 49

Jack is tasked with testing the password strength for the users of an organization. He has limited time and unlimited storage space.

Which of the following would be the BEST password attack for him to choose?

Answer 49

Rainbow attack

Question 50

A birthday attack focuses on which of the following?

Answer 50

Hashing algorithms

Question 51

An attacker is attempting to crack a system’s password by matching the password hash to a hash in a large table of hashes he or she has.

Which type of attack is the attacker using?

Answer 51

Rainbow

Question 52

When two different messages produce the same hash value, what has occurred?

Answer 52

Collision

Question 53

A relatively new employee in the data entry cubical farm was assigned a user account similar to the other data entry employees’ accounts. However, audit logs have shown that this user account has been used to change ACLs on several confidential files and has accessed data in restricted areas.

This situation indicates which of the following has occurred?

Answer 53

Privilege escalation

Question 54

An attacker has obtained the logon credentials for a regular user on your network.

Which type of security threat exists if this user account is used to perform administrative functions?

Answer 54

Privilege escalation

Question 55

Which of the following is an example of privilege escalation?

Answer 55

Privilege creep

Question 56

A user is able to access privileged administrative features with an account that is not granted administrator rights.
Which type of vulnerability is this?

Answer 56

Privilege escalation

Question 57

Travis and Craig are both standard users on the network. Each user has a folder on the network server that only they can access. Recently, Travis has been able to access Craig’s folder.

This situation indicates which of the following has occurred?

Answer 57

Privilege escalation

Question 58

Which of the following is an attack that injects malicious scripts into web pages to redirect users to fake websites to gather personal information?

Answer 58

XSS (Cross-site scripting)

Question 59

Which of the following are subject to SQL injection attacks?

Answer 59

Database servers

Question 60

You have a website that accepts input from users for creating customer accounts. Input on the form is passed to a database server where the user account information is stored.

An attacker is able to insert database commands in the input fields and have those commands execute on the server.

Which type of attack has occurred?

Answer 60

SQL injection

Question 61

An attacker inserts SQL database commands into a data input field of an order form used by a web-based application. When submitted, these commands are executed on the remote database server, causing customer contact information from the database to be sent to the malicious user’s web browser.

Which practice would have prevented this exploit?

Answer 61

Implementing client-side validation

Question 62

In 2011, Sony was targeted by an SQL injection attack that compromised over one million emails, usernames, and passwords.

Which of the following could have prevented the attack?

Answer 62

Careful configuration and penetration testing on the front end

Question 63

SQL injections are a result of which of the following flaws?

Answer 63

Web applications

Question 64

Which of the following functions does a single quote (‘) perform in an SQL injection?

Answer 64

Indicates that data has ended and a command is beginning

Question 65

Which of the following attacks is a form of software exploitation that transmits or submits a longer stream of data than the input variable is designed to handle?

Answer 65

Buffer overflow attack

Question 66

A programmer that fails to check the length of input before processing leaves his code vulnerable to which form of common attack?

Answer 66

Buffer overflow attack

Question 67

Having poor software development practices and failing to program input validation checks during development of custom software can result in a system vulnerable to which type of attack?

Answer 67

Buffer overflow attack

Question 68

Which type of attack is the act of exploiting a software program’s free acceptance of input in order to execute arbitrary code on a target?

Answer 68

Buffer overflow attack

Question 69

Sam has used malware to access Sally’s computer on the network. He has found information that allows him to use the underlying NTLM to escalate his privileges without needing the plaintext password.

Which of the following types of attacks did he use?

Answer 69

Pass-the-hash attack

Question 70

Which of the following best describes an evil twin?

Answer 70

An access point that is configured to mimic a valid access point to obtain logon credentials and other sensitive information

Question 71

Your company security policy states that wireless networks are not to be used because of the potential security risk they present to your network.

One day, you find that an employee has connected a wireless access point to the network in his office.

Which type of security risk is this?

Answer 71

Rogue access point

Question 72

What is a Rogue access point?

Answer 72

It is an unauthorized access point added to a network, or it is an access point that is configured to mimic a valid access point

Question 73

Which of the following best describes Bluesnarfing?

Answer 73

Viewing calendar, emails, and messages on a mobile device without authorization

Question 74

Which of the following sends unsolicited business cards and messages to a Bluetooth device?

Answer 74

Bluejacking

Question 75

You are the security analyst for your organization. Clients are complaining about being unable to connect to the wireless network. After looking into the issue, you have noticed short bursts of high-intensity RF signals are interfering with your wireless network’s signal.

Which type of attack are you most likely experiencing?

Answer 75

Jamming

Question 76

Which type of Radio Frequency Identification (RFID) tag can send a signal over a long distance?

Answer 76

Active

Question 77

An attacker has intercepted near-field communication (NFC) data and is using that information to masquerade as the original device.

Which type of attack is being executed?

Answer 77

Relay

Question 78

Which type of attack is WEP extremely vulnerable to?

Answer 78

IV attack

Question 79

Which of the following describes a man-in-the-middle attack?

Answer 79

A false server intercepts communications from a client by impersonating the intended server.

Question 80

Capturing packets as they travel from one host to another with the intent of altering the contents of the packets is a form of which type of attack?

Answer 80

Man-in-the-middle attack

Question 81

Which of the following switch attacks associates the attacker’s MAC address with the IP address of the victim’s devices?

Answer 81

ARP spoofing/poisoning

Question 82

Which of the following attacks tries to associate an incorrect MAC address with a known IP address?

Answer 82

ARP poisoning

Question 83

What does ARP spoofing/poisoning do?

Answer 83

It associates the attacker’s MAC address with the IP address of a victim’s device

Question 84

Which of the following is the term used to describe what happens when an attacker sends falsified messages to link their MAC address with the IP address of a legitimate computer or server on a network?

Answer 84

ARP poisoning

Question 85

Which of the following attacks, if successful, causes a switch to function like a hub?

Answer 85

MAC flooding

Question 86

What is the appropriate switch attack for ARP spoofing/poisoning?

Answer 86

The source device sends frames to the attacker’s MAC address instead of to the correct device.

Question 87

What is the appropriate switch attack for Dynamic Trunking Protocol?

Answer 87

Should be disabled on the switch’s end user (access) ports before implementing the switch configuration into the network

Question 88

What is the appropriate switch attack for MAC flooding?

Answer 88

Causes packets to fill up the forwarding table and consumes so much of the switch’s memory that it enters a state called Fail Open Mode

Question 89

What is the appropriate switch attack for MAC spoofing?

Answer 89

Can be used to hide the identity of the attacker’s computer or impersonate another device on the network

Question 90

What is the correct definition of MAC spoofing?

Answer 90

Allows an attacker’s computer to connect to a switch using an authorized MAC address.

Question 91

What is the correct definition of MAC flooding?

Answer 91

The process of intentionally overwhelming the CAM table with Ethernet frames, each originating from a different MAC address.

Question 92

What is the correct definition of ARP poisoning?

Answer 92

The MAC address of the attacker can be associated with the IP address of another host.

Question 93

What is the correct definition of Port mirroring?

Answer 93

Creates a duplicate of all network traffic on a port and sends it to another device.

Question 94

Which type of denial-of-service (DoS) attack occurs when a name server receives malicious or misleading data that incorrectly maps host names and IP addresses?

Answer 94

DNS poisoning

Question 95

When does DNS poisoning occur?

Answer 95

It occurs when a name server receives malicious or misleading data that incorrectly maps host names and IP addresses

Question 96

While using the internet, you type the URL of one of your favorite sites in the browser. Instead of going to the correct site, the browser displays a completely different website. When you use the IP address of the web server, the correct site is displayed.

Which type of attack has likely occurred?

Answer 96

DNS poisoning

Question 97

An attacker uses an exploit to push a modified hosts file to client systems. This hosts file redirects traffic from legitimate tax preparation sites to malicious sites to gather personal and financial information.

Which kind of exploit has been used in this scenario?

Answer 97

DNS poisoning

Question 98

An attacker sets up 100 drone computers that flood a DNS server with invalid requests. This is an example of which kind of attack?

Answer 98

Distributed Denial-of-Service (DDoS)

Question 99

What is a distributed denial-of-service (DDoS) attack?

Answer 99

A distributed denial-of-service (DDoS) attack employs multiple attackers

Question 100

Which of the following is the single greatest threat to network security?

Answer 100

Employees

Question 101

The IT manager in your organization proposes taking steps to deflect a potential threat actor. The proposal includes the following:

• Create and follow onboarding and off-boarding procedures.
• Employ the principal of least privilege.
• Have appropriate physical security controls in place.

Which type of threat actor do these steps guard against?

Answer 101

Insider

Question 102

An employee stealing company data could be an example of which kind of threat actor?

Answer 102

Internal threat

Question 103

Which of the following BEST describes an inside attacker?

Answer 103

An unintentional threat actor

Question 104

Which of the following threat actors seeks to defame, shed light on, or cripple an organization or government?

Answer 104

Hacktivist

Question 105

What is a hacktivist?

Answer 105

A hacktivist is any individual whose attacks are politically motivated

Question 106

A script kiddie is a threat actor who lacks knowledge and sophistication. Script kiddie attacks often seek to exploit well-known vulnerabilities in systems.

What is the BEST defense against script kiddie attacks?

Answer 106

Keep systems up to date and use standard security practices

Question 107

Which of the following best describes a script kiddie?

Answer 107

A hacker who uses scripts written by much more talented individuals

Question 108

Which of the following is the BEST definition of the term hacker?

Answer 108

A general term used to describe any individual who uses their technical knowledge to gain unauthorized access to an organization

Question 109

Which of the following is the correct definition of a threat?

Answer 109

Any potential danger to the confidentiality, integrity, or availability of information or systems

Question 110

Which of the following BEST describes a cyber terrorist?

Answer 110

Disrupts network-dependent institutions

Question 111

Which of the following could an employee also be known as?

Answer 111

Internal threat

Question 112

What is the storage location called that holds all the development source files that version control systems use?

Answer 112

Repository

Question 113

John is the IT manager at a mid-sized company. He has been tasked with improving the physical security of the company’s server room.

Which of the following actions would be the MOST effective in enhancing the physical security of the server room?

Answer 113

Installing a biometric access control system

Question 114

In your role as a security analyst, you need to stay up to date on the latest threats. You are currently reviewing the latest real-time updates on cyberthreats from across the world.

Which of the following resources are you MOST likely using?

Answer 114

Threat feeds

Question 115

Which of the following is an example of a vulnerability?

Answer 115

An enabled USB port

Question 116

The root account has all privileges and no barriers. Which of the following is another name for the root account?

Answer 116

Superuser account

Question 117

Which of the following authentication protocols transmits passwords in cleartext and, therefore, is considered too unsecure for modern networks?

Answer 117

PAP

Question 118

Which of the following is the weakest hashing algorithm?

Answer 118

MD5

Question 119

You have transferred an encrypted file across a network using the Server Message Block (SMB) Protocol. What happens to the file’s encryption?

Answer 119

The file is unencrypted when moved.

Question 120

Every ACME computer comes with the same account created at the factory. Which kind of vulnerability is this?

Answer 120

Default accounts and passwords

Question 121

Which of the following do security templates allow you to do? (Select two.)

Answer 121

Quickly apply settings to multiple computers
Configure consistent security settings between devices

Question 122

What does the netstat -a command show?

Answer 122

All listening and non-listening sockets

Question 123

You need to increase the security of your Linux system by finding and closing open ports. Which of the following commands should you use to locate open ports?

Answer 123

nslookup

Question 124

In which of the iptables default chains would you configure a rule to allow an external device to access the HTTPS port on the Linux server?

Answer 124

Input

Question 125

A wireless access point configured to use Wired Equivalent Privacy (WEP) is an example of which kind of vulnerability?

Answer 125

Weak security configurations

Question 126

You are deploying a brand new router. What is one of the first things you should do?

Answer 126

Update the firmware

Question 127

When confidential or protected data is exposed, either intentionally or accidentally, it is considered to be which of the following?

Answer 127

Data breach

Question 128

DNS tunneling is a common method that allows an attacker to accomplish which attack?

Answer 128

Data exfiltration

Question 129

Which impact of vulnerabilities occurs when an attacker uses information gained from a data breach to commit fraud by doing things like opening new accounts with the victim’s information?

Answer 129

Identity theft

Question 130

Sometimes, an attacker’s goal is to prevent access to a system rather than to gain access. This form of attack is often called a denial-of-service attack and causes which impact?

Answer 130

Availability loss

Question 131

Which formula is used to determine a cloud provider’s availability percentage?

Answer 131

Uptime/uptime + downtime

Question 132

You have configured an NIDS to monitor network traffic. Which of the following describes harmless traffic that has been identified as a potential attack by the NIDS device?

Answer 132

False positive

Question 133

Which of the following describes a false positive when using an IPS device?

Answer 133

Legitimate traffic being flagged as malicious

Question 134

In your role as a security analyst, you ran a vulnerability scan, and several vulnerabilities were reported. Upon further inspection, none of the vulnerabilities actually existed.

Which type of result is this?

Answer 134

False positive

Question 135

Which of the following describes the worst possible action by an IDS?

Answer 135

The system identified harmful traffic as harmless and allowed it to pass without generating any alerts.

Question 136

A security administrator logs onto a Windows server on her organization’s network. Then she runs a vulnerability scan on that server.

Which type of scan was conducted in this scenario?

Answer 136

Credentialed scan

Question 137

A security administrator needs to run a vulnerability scan that analyzes a system from the perspective of a hacker attacking the organization from the outside.

Which type of scan should he or she use?

Answer 137

Non-credentialed scan

Question 138

You have run a vulnerability scanning tool and identified several patches that need to be applied to a system. What should you do next after applying the patches?

Answer 138

Run the vulnerability assessment again.

Question 139

You have implemented a new application control solution. After monitoring traffic and use for a while, you have noticed an application that continuously circumvents blocking.

How should you configure the application control software to handle this application?

Answer 139

Tarpit

Question 140

You want to be able to identify the services running on a set of servers on your network. Which tool would BEST give you the information you need?

Answer 140

Vulnerability scanner

Question 141

For some reason, when you capture packets as part of your monitoring, you aren’t seeing much traffic. What could be the reason?

Answer 141

You forgot to turn on promiscuous mode for the network interface.

Question 142

Which SIEM component is responsible for gathering all event logs from configured devices and securely sending them to the SIEM system?

Answer 142

Collectors

Question 143

You are concerned that an attacker can gain access to your web server, make modifications to the system, and alter the log files to hide his or her actions. Which of the following actions would best protect the log files?

Answer 143

Use syslog to send log entries to another server

Question 144

Which of the following systems is able to respond to low-level security events without human assistance?

Answer 144

SOAR

Question 145

A company has recently experienced a significant increase in the volume of security alerts. The security team is struggling to keep up with the volume and is concerned that they may miss a critical alert.

The company is considering implementing a Security Orchestration, Automation, and Response (SOAR) system.

Which of the following would be the MOST likely benefit of implementing a SOAR system?

Answer 145

The SOAR system will automate routine, tedious, and time-consuming tasks

Question 146

You have been hired to perform a penetration test for an organization. You are given full knowledge of the network before the test begins.

Which type of penetration test are you performing?

Answer 146

White box

Question 147

As part of a special program, you have discovered a vulnerability in an organization’s website and reported it to the organization. Because of the severity, you are paid a good amount of money.

Which type of penetration test are you performing?

Answer 147

Bug bounty

Question 148

Which of the following uses hacking techniques to proactively discover internal vulnerabilities?

Answer 148

Penetration testing

Question 149

Which of the following activities are typically associated with a penetration test?

Answer 149

Attempt social engineering

Question 150

What is the primary purpose of penetration testing?

Answer 150

Test the effectiveness of your security perimeter

Question 151

Which phase or step of a security assessment is a passive activity?

Answer 151

Reconnaissance

Question 152

Which of the following items would be implemented at the Network layer of the security model?

Answer 152

Penetration testing

Question 153

Which of the following is a very detailed document that defines exactly what is going to be included in the penetration test?

Answer 153

Scope of work

Question 154

Which step in the penetration testing life cycle is accomplished using rootkits or Trojan horse programs?

Answer 154

Maintain access

Question 155

The process of walking around an office building with an 802.11 signal detector is known as?

Answer 155

War driving

Question 156

Gathering as much personally identifiable information (PII) on a target as possible is a goal of which reconnaissance method?

Answer 156

OSINT

Question 157

What is OSINT?

Answer 157

Open-source intelligence

Question 158

You are the security analyst for your organization and have discovered evidence that someone is attempting to brute-force the root password on the web server. Which classification of attack type is this?

Answer 158

Active

Question 159

Which classification of attack type does packet sniffing fall under?

Answer 159

Passive

Question 160

Which type of reconnaissance is dumpster diving?

Answer 160

Passive

Question 161

Which passive reconnaissance tool is used to gather information from a variety of public sources?

Answer 161

theHarvester

Question 162

You have been hired as part of the team that manages an organization’s network defense.

Which security team are you working on?

Answer 162

Blue

Question 163

What are the Blue team members?

Answer 163

The defense of the system. This team is responsible for stopping the red team’s advances.

Question 164

You have been promoted to team lead of one of the security operations teams.

Which security team are you now a part of?

Answer 164

White

Question 165

What are White team members?

Answer 165

The referees of cybersecurity. This team is responsible for managing the engagement between the red and blue teams. This group typically consists of the managers or team leads.

Question 166

What are Purple team members?

Answer 166

Members of the purple team work on both offense and defense. This team is a combination of the red and blue teams.