Threats, Attacks and Vulnerabilities Flashcards
Which of the following terms best describes a type of software that disguises itself as legitimate software but contains malicious code that can compromise the security of a system?
A) malware
B) Ransomware
C) adware
D) firewall
Malware
short for malicious software, is software designed to infiltrate or damage computer systems while often appearing as legitimate software. It includes various types such as viruses, trojans, and spyware.
An attacker poses as a delivery person, carrying a package for a company, and convinces an employee to let them into the building. Once inside, the attacker gains unauthorized access to the company’s network. What type of social engineering technique is this?
A) tailgating
B) pretexting
C) phishing
D) vishing
Tailgating
also known as piggybacking, involves an attacker following an authorized person into a secure area by appearing as if they belong there.
Threat actors, who is motivated by financial gain and often uses malicious software to encrypt a victim’s data and demand a ransom is typically referred to as?
A) a hacktivist
B) a script kiddie
C) a cybercriminal
D) a nation-state actor
A cybercriminal
are motivated by financial gain and commonly use ransomware to demand payments from victims.
Which attack involves flooding a network with ICMP echo request packets sent to a broadcast address?
A) syn flood
B) smurf attack
C) DDoS attack
D) DNS amplification attack
Smurf attack
sends ICMP echo request packets to a network’s broadcast address, causing a flood of replies to the victim’s IP.
Which of the following best describes the concept of a “zero-day vulnerability”?
A) a vulnerability that has been in existence for zero days
B) a vulnerability that has been exploited for zero days
C) a vulnerability that is unknown to the software vendor and has no available patch
D) a vulnerability that is at the lowest risk level
A vulnerability that is unknown to the software vendor and has no available patch
What is a common characteristic of a “man-in-the-middle” (MitM) attack?
A) the attacker intercepts and alters data between two parties without their knowledge
B) the attacker floods a network with excessive traffic to overwhelm it
C) the attacker disguises malicious code as legitimate software
D) the attacker gains unauthorized access to a system using stolen credentials
The attacker intercepts and alters data between two parties without their knowledge
An employee receives an email from what appears to be their company’s IT department. The email requests that the employee reset their email password due to a security breach. The email contains a link to a login page. What kind of threat is the employee facing?
A) phishing attack
B) insider threat
C) man-in-the-middle
D) ransomware attack
Phishing attack
This scenario describes a phishing attack. Phishing is a type of attack where attackers impersonate trusted entities to trick individuals into revealing sensitive information, often by luring them to fake login pages.
A security administrator has noticed several unauthorized access attempts to the organization’s internal systems. These attempts are often based on trying common username and password combinations. Which type of attack does this scenario most likely describe?
A) SQL injection attack
B) brute-force attack
C) DDoS attack
D) cross-site scripting (XSS) attack
Brute-force attack
The scenario describes a brute-force attack where an attacker attempts to gain access by trying many possible username and password combinations. This is a common method used to crack passwords.
A company’s network administrator has discovered a new piece of software running on one of the company’s servers. The software was not installed by the IT department and is not part of the approved software list. What type of threat is this scenario indicating?
A) insider threat
B) ransomware attack
C) trojan horse
D) spear-phishing attack
Trojan horse
This scenario suggests the presence of a Trojan horse, which is a type of malware that disguises itself as legitimate software but has malicious intent. It is often installed by an attacker.
Which attack aims to manipulate a website to redirect users to a fraudulent site that appears legitimate to steal their information?
A) SQL injection
B) cross-site scripting (XSS)
C) DNS spoofing
D) URL hijacking
DNS spoofing
DNS spoofing manipulates the DNS records to redirect users to a fraudulent site, typically appearing legitimate, intending to steal their information.
An employee has lost their company-issued smartphone, and it contained sensitive corporate data. What kind of threat does this scenario illustrate?
A) phishing attack
B) insider threat
C) physical security breach
D) ransomware attack
Physical security breach
The scenario illustrates a physical security breach where the loss of a device (in this case, a smartphone) leads to the potential exposure of sensitive data.
A network administrator has implemented a firewall rule that allows only specific incoming traffic from trusted IP addresses and denies all other incoming traffic. What security principle does this rule exemplify?
A) principle of least privilege
B) defense in depth
C) zero trust
D) security by design
Principle of least privilege
The firewall rule aligns with the principle of least privilege, where access is restricted to only what is necessary for users or systems to perform their functions.
An organization has implemented a policy that requires regular patching of software and systems to address known vulnerabilities. What security practice does this policy reflect?
A) security through obscurity
B) vulnerability management
C) least privilege
D) zero-day exploitation
Vulnerability management
The policy reflects the practice of vulnerability management, which involves identifying, prioritizing, and addressing known vulnerabilities in software and systems.
A company is conducting a security audit and penetration testing on its network to identify and rectify vulnerabilities before malicious actors can exploit them. What security practice is this organization following?
A) incident response
B) security assessment
C) security awareness training
D) least privilege
Security assessment
The organization is conducting a security assessment, specifically penetration testing, to identify and rectify vulnerabilities in its network.
An organization has set up a dedicated network segment for guest wireless access, which is isolated from its internal network. What security principle does this network segmentation align with?
A) principle of least privilege
B) defense in depth
C) network segmentation
D) security by design
Network segmentation
is the practice of dividing a network into isolated segments to enhance security by controlling access and limiting the potential for lateral movement by attackers.
A company’s web application was recently compromised, and customer data was stolen. The company’s cybersecurity team discovers that the attackers exploited a vulnerability in the application’s code to gain unauthorized access. What type of attack is this?
A) SQL injection
B) man-in-the-middle
C) cross-site scripting (XSS) attack
D) zero-day vulnerability
SQL injection
The scenario describes an SQL injection attack, where attackers exploit vulnerabilities in web application code to gain unauthorized access to a database.
An organization’s security team regularly reviews and assesses logs generated by its servers and network devices to detect and investigate security incidents. What security practice does this represent?
A) security awareness training
B) log analysis and review
C) data classification
D) security policy enforcement
Log analysis and review
Regularly reviewing and analyzing logs is a key practice in identifying and responding to security incidents and potential threats.
An attacker calls an employee, pretending to be a colleague from another department, and requests sensitive information to complete a report. What type of social engineering technique is this?
A) impersonation
B) tailgating
C) phishing
D) vishing
Impersonation
involves pretending to be someone the target knows and trusts to manipulate them into disclosing sensitive information.
Which type of attack involves the modification or interception of communication between two parties without their knowledge?
A) man-in-the-middle
B) buffer overflow
C) spoofing
D) zero-day exploit
Man-in-the-middle
MitM attacks intercept and manipulate communications between two parties without their awareness, allowing attackers to eavesdrop or modify data.
An attacker calls employees, claiming to be a security auditor conducting routine checks. The attacker asks for login credentials and access to the company’s network to perform a “security check.” What type of social engineering technique is this?
A) impersonation
B) spear-phishing
C) vishing
D) tailgating
Vishing
is a social engineering technique that involves voice communication, typically over the phone, to manipulate individuals into revealing sensitive information or granting access.
