Threat, Vulnerabilities and Mitigations: Quiz Revision Flashcards
Which of the following network attacks has the goal of capturing a user’s login information to use in a subsequent attack?
A) Amplified
B) Credential replay
C) On-path
D) Reflected
A credential replay attack uses intercepted credentials to initiate an attack. An attacker will monitor the conversation between Benjamin and George and capture the credentials of George. Later, the attacker initiates a conversation with Benjamin. When challenged for credentials by Benjamin, the attacker supplies George’s credentials, and Benjamin allows the conversation to continue.
What is a reflected attack?
Reflected attacks are Distributed Denial of Service (DDoS) attacks. Reflected DDoS attacks used spoofed IP addresses to send excessive traffic to targets. The attacker will make multiple requests for information from a server, using the spoofed IP address of a victim. The victim is then overwhelmed with response traffic from the server.
What is a On-Path attack?
An on-path (formerly known as man-in-the-middle) attack occurs when a hacker intercepts messages from a sender, modifies those messages, and sends them to a legitimate receiver. This type of attack often involves interrupting network traffic to insert malicious code.
What is a Amplified attack?
Amplified attacks are often part of a DDoS attack, usually associated with UDP protocols. The goal of this attack is to turn a simple query, such as DNS or NTP, into a flood of responses that overwhelms the victim’s network resources
A user notifies you that a software application displays advertisements while the application is executing. Of which security threat is this an example?
A) spyware
B) virus
C) worm
D) adware
Adware is a software application that displays advertisements while the application is executing. A common example is a free mobile app that displays advertisements for other products at the bottom of the screen. Some adware is also spyware that monitors your Internet usage and personal information. Some adware will even allow credit card information theft. The application’s developer may or may not be aware that malicious ads containing spyware are being displayed through the application.
A worm is a program that spreads itself through network connections. Spyware often uses tracking cookies to collect and report on a user’s activities. Not all spyware is adware, and not all adware is spyware. The definition of spyware requires that your activities be monitored and tracked; the definition of adware requires that advertisements be displayed.
A virus is malicious software (malware) that relies upon other application programs to execute itself and infect a system. Another malware that you need to be familiar with is ransomware, which restricts access to a computer that it infects. The ransomware then demands a ransom paid to the creator of the malware for the restriction to be removed.
Which threat actor motivation is exemplified by threatening to release sensitive personally identifiable information (PII)?
A) Financial gain
B) Service disruption
C) Blackmail
D) Data exfiltration
Blackmail is most commonly accomplished by threatening to release sensitive PII or incriminating evidence regarding an individual. The cyber-criminal targets an individual who has access to certain company assets, such as data, systems, or processes, and then digs into their personal records. The cyber-criminal threatens to expose the individual unless they take some action against a company asset on the criminal’s behalf.
Remember that not all PII is sensitive. While names, addresses, gender, and dates of birth are PII, they are found in many public databases. PII also includes geo-location data, online browsing history, and medical records, which are more likely to be leveraged by a blackmailer.
What is service disruption?
Service disruption can cause damage to an organization’s reputation, or loss of public confidence in the organization. If an airline had a disruption where you could not access their services, such as booking a flight, that person would likely do business with another airline.
What is Data exfiltration?
Data exfiltration is the act of sending sensitive or proprietary information to unauthorized recipients external to the organization. Data loss prevention is designed to detect and stop data exfiltration behavior by users. If DLP software is not present, data exfiltration might only be discovered after the event. When it occurs, the best course of action is to identify the source of the disclosure, if possible, and then take disciplinary action against the user.
What is financial gain motivation?
Financial gain motivation is exemplified by activities such as fraud, ransom attacks, and theft of credit card data. Once the threat actor has your information, they can sell it or use it for fraudulent purposes. When a cyber-criminal threatens to reveal sensitive PII in exchange for money, it is termed extortion, not blackmail.
What is Espionage?
Espionage – Competition attacks are the modern version of industrial espionage. Theft of intellectual property, marketing plans, and customer lists are all examples that can have devastating effects on the targeted organization. Even stealing the victim company’s credit card list can have a severe economic impact on that company. Often, the attacking company will find a disgruntled individual in the subject company to carry out the attack.
What is Philosophical or political beliefs?
Philosophical or political beliefs – Philosophical beliefs and political beliefs are used by extremist groups to recruit members to their cause. One nation might attempt to convince citizens of another nation to perform cyberterrorist activities. Hacktivists are the typical actor here.
What are ethical motives?
Ethical motives – Ethical hackers (sometimes called white-hat hackers or penetration testers) are individuals hired by the company to test the company’s security infrastructure. Their purpose is to conduct activities to find weaknesses and “break in”. The ethical hacker will prepare a report detailing the weaknesses so that the client company can address those issues and make corrections. They may be mistaken for threat actors by the company’s in-house team during a closed penetration test.
What is revenge motivation?
Revenge – threat actors can be motivated by revenge. Revenge and retaliation result from the perception that the threat actor has been slighted by a person or organization. The threat actor wants to “teach them a lesson” or extract revenge.
What is disruption and Chaos?
Disruption/Chaos – Some threat actors simply want to cause disruption and chaos. A threat actor might be motivated to gain notoriety by claiming responsibility for a disruptive event. The end goal is to upset normal operations in an attention-getting way.
What is War motivations?
War – Civilians and nation-states can use cyberspace to advance wartime agendas. Each may be engaged in activities that disrupt a target’s communications, services, and infrastructure, or to spread propaganda, misinformation, and fear.
Which of the following supply chain elements are threat vectors? (Choose all that apply.)
A) Third-party software dependencies
B) Managed service providers
C) Hardware suppliers
D) Software suppliers
Managed service providers (MSPs), software and hardware suppliers, and third-party software dependencies are all threat vectors in the supply chain. A supply-chain attack is not an attack on a target directly, but on a more vulnerable company or resource that helps the target organization conduct its business or create a product. By infiltrating the target’s supply chain, the attackers can gain access to internal systems or data through the compromised components.
Managed Service Providers (MSPs) are highly susceptible to supply chain attacks. MSPs provide IT services to other organizations, and may have access to data from their clients. When an organization announces that they are outsourcing a certain aspect of their business, they are outsourcing to an MSP. An MSP may provide any combination of a number of services, such as help desk services, tech support, software updates, data backup, and even payroll services. When an attacker targets an MSP, they potentially have access to multiple clients of that MSP. The most well-known supply chain attack involving an MSP was the SolarWinds attack of 2020. Attackers may also disable access to a third-party managed service, as in the United Healthcare billing service attack of 2024.
Software suppliers include cloud-based SaaS providers and application vendors. Software provider vulnerabilities occur in third-party companies that provide software to other companies (customers). Attackers will look for a vulnerability within the software that the attacker can exploit. Then, when the customer installs the software, the customer’s data is exposed to the attacker, or the attacker is able to install more malicious software into the customer’s system to establish a foothold.
Third-party software dependencies refer to the external libraries, frameworks or components that integrate with an organization’s existing software or that were used to build third-party software. These external items add functionality, or perhaps assist with further development. Issues to consider with third-party software include the possibility of malicious components, lack of transparency from the vendor, and supply chain attacks on vulnerable components.
What are some the strict Audit controls to avoid supply chain attacks?
All vendors in the supply chain should be under strict audit controls. Some recommended best practices to mitigate supply-chain attacks include:
Monitor third-party service providers’ access to sensitive data.
Make an inventory of all data exposed to the supply chain.
Request source code and list of all components used to build a vendor’s software.
Include security requirements and a right-to-audit in all contracts with managed service providers, software providers, and hardware suppliers.
Use automated supply-chain management tools to continually monitor for and remediate known vulnerabilities and audit behavior.
Have a formal procedure for offboarding old vendors and removing their access to internal systems.
What are some of the hardware supply chain attacks?
Hardware provider vulnerabilities occur in device manufacturers and suppliers. A classic example is the Target breach in 2013. Target’s HVAC hardware provider was compromised, and through the HVAC provider, attackers accessed Target’s payment system and stole millions of credit card numbers from Target’s customers. Other hardware-based supply chain attacks could include:
Selling counterfeit equipment through an unauthorized channel
Tampering with legitimate equipment before it is delivered to the target
Using uncertified third-party components while manufacturing the hardware
Allowing off-site personnel to install hardware without supervision
To mitigate these risks, organizations should only buy hardware from authorized resellers or the manufacturer, inspect hardware for signs of tampering, supervise vendor personnel during equipment installation, and request vendors certify the hardware and its components.
Which of the following malware attacks is actually a collection of unwanted or unnecessary programs installed on a system?
A) Keylogger
B) Bloatware
C) Rootkit
D) Trojan
Bloatware is an umbrella term for all the extra (and usually unwanted) applications that are installed on systems by the manufacturers. Many of these extra applications are harmless, and some of these applications may be bundled in a zip file. When you install from the zip file, you also install all the extra applications which may include things like browser hijackers, adware and even spyware.
What is a keylogger?
Keyloggers capture the keystrokes made on the keyboard and send them to the attacker. The keylogger can be a physical device, it is more often a software application. The keylogger records the keystrokes made by the users as a file, which can be transmitted in real time or at a time of the attacker’s choosing.
What is a Trojan?
A Trojan is malware, malicious content that looks to be something beneficial or legitimate. The user is tricked into downloading and installing the content, or clicking on a link that is actually an executable. The name “Trojan” comes from the ancient Greek story of the Trojan Horse.
What is a rootkit?
A rootkit is a type of malware that allows attackers to have administrative access through a backdoor. Once an attacker has gained access, the rootkit may have the capability of erasing its tracks. Rootkits are particularly dangerous, since the administrative access allows the attacker to change system-level files including the Registry.
You have several independent security monitoring solutions, each with different logging mechanisms. You are concerned that they are not working well together, and that the separate logs may not present all the necessary information. In addition, the costs of maintaining the separate products are rising. You need to provide a centralized solution that will include centralized logging. What could you replace them with?
A) Patch management tools
B) Host-based firewall
C) DLP
D) UTM
Unified Threat Management (UTM) incorporates several threat management devices and systems into one appliance. The biggest advantage to a UTM from an analysis standpoint is that all the logs are in one place, as opposed to checking multiple systems. In addition, a UTM would cut down on the costs associated with maintaining separate products.
What are HIPS and HIDS used for?
HIDSs and HIPSs have two different functions. Host-based Intrusion Detection Systems (HIDS) will provide an alert in the event of a breach on a single server or computer. Host-based Intrusion prevention systems (HIPS) will go a step further and stop the attack. An example would be shutting down port 80 when http traffic exceeds the baseline norm. With either product, it would be important to view the log entries generated, and interpret the results based on documentation provided by the HIPS/HIDS vendor. A host-based system will not monitor network traffic for threats.
Is Antivirus products a one stop shop against threat?
Antivirus products (and the antimalware products that encompass them) provide notifications when a threat has been detected, and what action was taken. On many occasions, the software will identify a potential threat, and prompt you for what action to take. Antivirus is not a centralized solution for security; it is only one part of the solution.
What does Patch Management tool assist in?
Patch management tools assist with the installation of patches, which can present a significant challenge to an enterprise environment. Their logs will contain successful and failed updates, incompatible patches, and unsuccessful patch installations, but no other security logging information.
What are the features of Host-Based firewalls?
Host-based firewalls include products that are installed as an application, or included in the OS, such as the Windows Firewall. In the case of Windows Firewall, it is possible to have the firewall activated, but not generating log entries. You can activate logging by going into the console, choosing Actions, then Properties. The logging can be set as seen below. It is important to review the documentation that accompanies the application to interpret the results. Firewall logs display traffic that has been allowed and denied passage through the firewall, but not logs from other security systems, such as antimalware tools.
What are the security technologies and their output?
For the Security+ exam, you also need to understand other security technologies and their output, including file integrity checks, application allow listing, removable media control, DEP, WAFs, DLP, UTM, and advanced malware tools.
What is a File integrity checks do?
File integrity checks examine selected files to see if there have been any changes, or attempted changes. It is important to review the logs to know when attempts have been made, even if the file integrity product returned the file to the original state.
What are the functions of Application allow list?
Application allow list is the practice of denying all applications except for those that are approved. Those approved applications are designated as on the allow list. Several products are available that check for applications that are not on the allow list, including attempts to install those applications. The logs the allow list product generates would tell you if someone had attempted (for example) to install a keylogger. Removable media control (RMC) is important in many environments. USB drives, SD cards, CDs, DVDs and BluRay devices can all present dangers to the system. As an example, someone can use a USB drive to copy sensitive information and deliver it to someone outside the organization. Another example could be a CD that appears to be a music CD but is actually installation media for unauthorized software. Examine the RMC logs to determine attempts to violate removable media policies.
Why are advanced malware tools check do?
Advanced malware tools check for malicious code that would otherwise slip by standard antivirus and antimalware tools.
What does DLP examine?
Data Loss Prevention (DLP) examines outbound traffic for sensitive data, keywords, and specific files leaving the organization.
What does DEP do?
Data execution prevention (DEP) forces the user to approve an application before it executes or launches. Logs will record execution attempts, including failed attempts. Notification of failed attempts is important, as it could tell you that your antimalware application successfully blocked an attempt to install malware.
What is a web application firewall?
A web application firewall uses a set of defined rules to manage incoming and outgoing web server traffic, as well as attack prevention. Organizations can define their own rules, based on their particular vulnerability.
Recently, while reviewing log data, you discover that a hacker has used a design flaw in an application to obtain unauthorized access to the application. Which type of attack has occurred?
A) backdoor
B) privilege escalation
C) maintenance hook
D) buffer overflow
An escalation of privileges attack occurs when an attacker has used a design flaw in an application to obtain unauthorized access to the application. Privilege escalation includes incidents where a user logs in with valid credentials and then takes over the privileges of another user, or where a user logs in with a standard account and uses a system flaw to obtain administrative privileges.
There are two types of privilege escalation: vertical and horizontal. With vertical privilege escalation, the attacker obtains higher privileges by performing operations that allow the attacker to run unauthorized code. With horizontal privilege escalation, the attacker obtains the same level of permissions as he already has but uses a different user account to do so.
What does the term backdoor mean?
A backdoor is a term for lines of code that are inserted into an application to allow developers to enter the application and bypass the security mechanisms. Backdoors are also referred to as maintenance hooks.
What does a buffer overflow involved in?
A buffer overflow occurs when an application erroneously allows an invalid amount of input in the buffer. It can be used to perform a denial-of-service (DoS) attack or a Distributed Denial-of-Service (DDoS) attack.
What is a race condition in Application issue?
Race condition – typically targets timing, mainly the delay between time of check (TOC) and time of use (TOU). To eliminate race conditions, application developers should create code that processes exclusive-lock resources in a certain sequence and unlocks them in reverse order.
What is insecure direct object references in application issues?
Insecure direct object references – occurs when a developer exposes a reference to an internal object, such as a file, directory, database record, or key, as a URL or form parameter without implementing the appropriate security control. An attacker can manipulate direct object references to access other objects without authorization. Implementing an access control check helps to protect against these attacks.
What does CSRF do in terms of application issues?
Cross-site request forgery (CSRF) – occurs when a malicious site executes unauthorized commands from a user on a web site that trusts the user. It is also referred to as a one-click attack or session riding. Implementing anti-forgery tokens protect against this attack.
What application issue occurs when improper storage of sensitive data occurs?
Improper storage of sensitive data – occurs when sensitive data is not properly secured when it is stored. Sensitive data should be encrypted and protected with the appropriate access control list. Also, when sensitive data is in memory, it should be locked.
When does improper error and exception handling occurs in application issues?
Improper error and exception handling – occurs when developers do not design appropriate error or exception messages in an application. The most common problem because of this issue is the fail-open security check, which occurs when access is granted (instead of denied) by default. Other issues include system crashes and resource consumption. Error handling mechanisms should be properly designed, implemented, and logged for future reference and troubleshooting.
Why is Secure cookie storage transmission so important to avoid application issues?
Secure cookie storage and transmission – Cookies store a user’s web site data, often including confidential data, such as usernames, passwords, and financial information. A secure cookie has the secure attribute enabled and is only used via HTTPS, ensuring that the cookie is always encrypted during transmission.
What are memory leaks when it comes to application issues?
Memory leaks – occur when an application does not release memory after it is finished working with it. Reviewing coding and designing best practices helps to prevent memory leaks.
Application Issue: Integra Overflow?
Integer overflows – occurs when an operation attempts to input an integer that is too large for the register or variable. The best solution is to use a safe integer class that has been built to avoid these problems.
Application Issue: Geo-Tagging?
Geo-tagging – occurs when media, such as photos or videos, are tagged with geographical information. Turning off the geo-tagging feature on your device protects against releasing this type of information. It is also possible to remove geo-tagging information from media before using it in an application or web site.
Application issue: Data Remnants?
Data remnants – occurs when applications are removed but data remnants, including registry entries, are left behind. Specialty tools and apps are available to ensure that applications have been completely removed from a device.
You have recently been hired as a network administrator. The CIO informs you that their wireless networks are protected using firewalls. He has asked that you implement MAC filtering on all access points. What is the purpose of using this technology?
A) to provide port authentication for a wireless network
B) to ensure that unused ports are not accessible by clients
C) to restrict the clients that can access a Web site
D) to restrict the clients that can access a wireless network
The purpose of MAC filtering is to restrict the clients that can access a wireless network. Access is restricted based on the client’s media access control (MAC) address, which is the unique identifier that is encoded on the network interface card (NIC).MAC filtering is not used to restrict the clients that can access a Web site. This is most often done using access control lists (ACLs).
802.1X (or WPA2-Enterprise) provides port authentication for a wireless network using Extensible Authentication protocol (EAP). 802.1X can use Protected EAP (PEAP) or Lightweight EAP (LEAP). PEAP is the more secure of the two. Both of these implementations require a server certificate on the RADIUS server. If the RADIUS server certificate expires, then clients will be unable to connect until the RADIUS server obtains a new certificate.
To ensure that unused ports are not accessible by clients, you should disable all unused ports.
How to increase network security in wireless network?
To increase network security, you should use the following mitigation and deterrent techniques:
MAC limiting and filtering
802.1X
Disable unused interfaces, applications, and services.
Rogue machine detection
You should always monitor system logs, including the audit logs, event logs, security logs, and access logs. Often by monitoring these logs, a security professional can discover issues or attacks and can take measures to prevent the issues.
Security professionals should understand an organization’s security posture. Security professionals should perform certain mitigation and deterrent activities including recording an initial baseline configuration, continually monitoring security, and performing remediation as necessary.
You should also ensure that a good reporting system is set up to notify appropriate personnel if certain actions occur. This reporting system should include alarms and alerts. Security professionals should also perform periodic trending analysis to identify any new organizational trends.
Mitigation controls help to mitigate security issues. Deterrent controls help to deter attacks. Prevention controls help to prevent attacks. Detective controls help to detect any attack when it occurs. Any security policy should employ all of these types of controls to be most effective. Cameras and intrusion detection systems (IDSs) are detective controls. Intrusion prevention systems (IPSs) and guards are preventive controls.
A remote employee has a history of logging into the system every day between 8:50 AM and 9:05 AM. Today, the employee logs in at 3 AM. What does this exemplify?
A) Out-of-cycle logging
B) Resource inaccessibility
C) Published/documented
D) Missing logs
Out-of-cycle logging is when an event that normally occurs and is recorded at a regular time or interval shows up in the log as having occurred at an odd time or off-cycle. While it’s normal to see the event, it appears at a strange time, signaling that an attack may be underway.
What are the signs of Resource inaccessibility?
Resource inaccessibility is an indicator of malicious activity. For example, if a web server goes down and is suddenly inaccessible, it might be the victim of a Denial of Service (DoS) attack.
What happens when published/documented indicators are used?
Published/documented indicators are those that have been recently discovered and subsequently published by threat feed organizations such as the Cybersecurity and Infrastructure Security Agency (CISA). These indicators may include things like IP addresses, file hashes like MD5, and domain names. By knowing what to look for, this information can be used to uncover and respond to attacks.
What are missing logs may be signs of?
Missing logs may be a sign that an attack has been attempted or has occurred, and the attacker has erased the log to cover up their tracks. Log files are a critical tool in monitoring activities, investigating problems, storing information about the health of the system and the network. Consequently, many organizations will store the log files on a separate device or server in a protected area of the network.
Which of the following mitigation techniques would include establishing, deploying, and then maintaining a standard configuration, such as an image?
A) Removal of unnecessary software
B) Decommissioning
C) Installation of endpoint protection
D) Configuration enforcement
Configuration enforcement includes establishing, deploying, and then maintaining a standard configuration, such as a naming convention or even a system image. You could have an image based on a device/OS pair, an image for each of several user groups, or images for departments throughout the organization. Once the proper configuration has been established and preserved as a system image, configuration enforcement looks for changes to that configuration and, in some cases, even reverts the system to the proper configuration.
What is decommissioning so important?
Decommissioning is a mitigation technique that is used when a system or device is no longer of use to the organization. Contrary to what many users feel as adequate, deleting files into the recycle bin is not a secure process. When a system or device has reached the end of its service life, storage media and drives must be sanitized, either through destruction or using tools to erase all traces of data on the device. Such as degaussing
What is the removal of unnecessary software associated with?
Removal of unnecessary software is associated with system hardening. System hardening increases the security of a server or a computer system by reducing vulnerabilities and the attack surface. Other examples of system hardening activities include closing down ports and adjusting permissions.
What does endpoint security involve?
Endpoint security is the practice of protecting the endpoints (workstations, printers, etc.) in the network. Endpoint protection includes protecting them from other endpoints that spend at least some of the time outside the LAN. This is done by verifying patches and updates before the device is allowed access to the network. Endpoint security also includes the hardening process of endpoints. It cannot route traffic from a device being flooded to a location where the traffic can be studied
Which of the following is not a vulnerability associated with the supply chain?
A) Service provider
B) TPM
C) Software provider
D) Hardware provider
Trusted Platform Module (TPM) is not a supply chain vulnerability. TPM and Hardware Security Module (HSM) are both chips that implement hardware-based encryption. The main difference between the two is that a TPM chip is usually mounted on the motherboard and HSM chips are PCI adapter cards.
Supply chain vulnerabilities include the service provider, the hardware provider, and the software provider.
Hardware provider vulnerabilities occur in device manufacturers and suppliers. A classic example is the Target breach in 2013. Target’s HVAC hardware provider was compromised, and through the HVAC provider, attackers accessed Target’s payment system and stole millions of credit card numbers from Target’s customers.
Software provider vulnerabilities occur in third-party companies that provide software to other companies (customers). Attackers will look for a vulnerability within the software that the attacker can exploit. Then, when the customer installs the software, the customer
Service provider vulnerabilities can occur with a company that provides you with services, such as when you outsource your payroll processing or billing. If the service provider is compromised, the attacker can access and exploit the customer data.
Which threat actor type can be characterized by an unsophisticated skill level, the use of widely available tools, and is motivated by the need to prove their skills?
A) Hacktivist
B) Shadow IT
C) Insider
D) Unskilled attacker
E) Competitor
Unskilled attackers (sometimes referred to as script kiddies) typically rely on tools that are widely available on the Internet. These unskilled attackers are often motivated by the thrill of the chase and by the need to prove that they can do it. For the most part, they have limited time and financial resources.
What is Shadow IT?
Shadow IT are IT applications, systems, and resources (such as cloud services) that are installed or used by internal staff without the knowledge or consent of the IT department. Shadow IT is neither authorized nor approved, and therefore poses a risk to the organization’s security posture, risk management, data integrity, and regulatory compliance.
What is Hacktivist?
Hacktivists are activists who use hacking techniques to promote their own political or social agenda. Their activities can cause DoS and DDoS attacks, or place embarrassing posts on the web sites or social media sites of an organization with opposing views. They often believe they are engaging in a righteous and morally correct cause, even if their activities are illegal. As with unskilled attackers, hacktivists often have limited time and financial resources. However, a hacktivist within a sophisticated or large organization may have access to significant resources.
What are insider attacks?
Insider attacks are perpetrated by people within the organization. Insider threats have many possible motives, including promotion of an activist agenda, monetary reward, retaliation for not being selected for a promotion, or some other situation that caused the insider to become disgruntled with the organization. They typically have limited resources but given that they may already have substantial knowledge of the organization and network, they are particularly dangerous.
What is Competition Attacks?
Competition attacks are the modern version of industrial espionage. Theft of intellectual property, marketing plans, and customer lists are all examples that can have devastating effects on the targeted organization. Even stealing the victim company’s credit card list can have a severe economic impact on that company. Often, the attacking company will find a disgruntled individual in the subject company to carry out the attack.
What are Organized Crime Attacks?
Organized crime attacks are carried out by criminal groups for the sole purpose of monetary gain. Organizations like the Mafia, Russian organized crime, and drug cartels have significant resources in terms of time and money to recruit hackers to carry out their agenda.
What is Nation State Attacks?
Nation-state / Advanced Persistent Threat (APT) attacks are conducted by one nation upon another or upon a significant entity within the target country with large coordinated attacks. APTs have attackers who have very significant time and financial resources. Motives could be financial, political, disruption of the economy, or theft of intellectual property, such as military secrets.
Which of the following begins with the attacker creating a fake patch?
A) SQL injection
B) Cross-site scripting
C) Malicious update
D) Memory injection
Malicious update is when an attacker first creates a fake software update, containing malware, that appears to be legitimate, and then gets users to download and install the update. Upon installation, the malware is activated on the system.
What is memory Injections?
Memory injection is the primary goal of buffer overflow attacks. Buffer overflows attempt to put more information than can fit into an allocated area of memory. With memory injection, the attacker inserts malicious code into program memory. The computer then executes that malicious code as part of the program.
What is an SQL injection?
An SQL injection is an example of improper input handling, and the impact can include data destruction or unfettered access to the database. Inputs should be checked for common SQL injection symbols. Other examples of improper input handling include failure to validate the type of data in an input field, the length of the data, and proper date ranges.
What is cross-site scripting (XSS) Attacks?
A cross-site scripting (XSS) attack occurs when an attacker locates a vulnerability on a website that allows the attacker to inject malicious code into a web application. A persistent XSS attack occurs when data provided to the web application is first stored persistently on the server and later displayed to users without being encoded using HTML on the web client. A non-persistent XSS attack occurs when data provided by a web client is used immediately by server-side scripts to generate results for that user. XSS flaws occur every time an application takes user-supplied data and sends it to a web browser without first confirming or encoding the data.
You are considering cloud services, and you are concerned about the interaction of your security policies and those of the hosting provider. What can alleviate your concern?
A) Stress testing
B) VM escape protection
C) Cloud access security brokers
D) VDI
Cloud access security brokers would alleviate your concern because they enforce security policies, whether on-premises or cloud-based. They often sit between the cloud service users and providers, merging the security policies of the user and the provider. Virtual desktop infrastructure (VDI) creates a user desktop on a virtual machine that is hosted on a data center server. Desktops can be personalized while still having centralized management and security.
