Threats, Vulnerabilities, and Mitigations

A cybersecurity team is establishing testing procedures for an enterprise security audit. Match each security testing method on the left with its primary operational objective on the right.

A security operations team needs to implement continuous vulnerability assessment and security testing mechanisms for a cloud-hosted e-commerce application platform. The security objective is to identify runtime application vulnerabilities and network anomalies without degrading live user traffic performance or causing service interruptions on production database hosts. Which TWO of the following methods or practices best meet these operational requirements?

Match each host, network, or infrastructure vulnerability scenario on the left with its corresponding primary remediation strategy on the right.

A threat intelligence architect at a critical infrastructure provider is designing an automated threat intelligence sharing framework. The organization needs to ingest structured, machine-readable threat data—including adversary tactics, malware relationships, and indicators of compromise—from an Industry Information Sharing and Analysis Center (ISAC) and feed it directly into security orchestration tools via an automated, HTTPS-based service. Which of the following technical solutions correctly pairs the data representation format with the transport mechanism to meet these requirements?

An IT security administrator at a retail organization discovers that an authorized system administrator leveraged legitimate elevated privileges to copy and exfiltrate confidential payment database records for personal gain. Which threat actor classification best describes this individual?

An incident responder identifies an active threat on an enterprise network where a malicious program continuously scans adjacent hosts across the local subnet and automatically copies itself to available network shares without requiring any user execution or logged-in credentials. Which of the following malware types is primarily characterized by this autonomous network replication capability?

During an internal security assessment, an analyst discovers that an enterprise host permits unauthenticated administrative connections from any device within the internal network. The system design relies entirely on the border edge firewall to block external threats, assuming all intranet traffic is inherently safe. Which of the following architecture vulnerabilities is primarily demonstrated by this scenario?

A security analyst reviews an alert from an endpoint detection and response (EDR) agent installed on a user workstation. The telemetry reveals a background process silently logging user keystrokes, taking screenshots of desktop applications, and exfiltrating the collected data to an external server. Which of the following malware classifications and attributes describe this activity? (Select TWO.)

During an off-peak security monitoring review, a security analyst identifies anomalous activity across several database server endpoints. Host telemetry indicates sustained 98% CPU and GPU utilization during non-business hours, accompanied by persistent outbound TCP traffic destined for an external IP address over port 3333 using the Stratum protocol. Endpoint inspection confirms an unauthorized binary executing via a persistent Windows Task Scheduler job. Based on these technical indicators of compromise (IoCs), which of the following malware types has compromised the systems?

An enterprise security architect is mapping enterprise hardening controls to specific vulnerability findings identified during a comprehensive threat assessment. Match each enterprise mitigation strategy on the left with the threat or attack vector on the right that it is primarily designed to counter.

A security administrator is auditing a legacy internal service and discovers two critical cryptographic control weaknesses: the application utilizes static, hardcoded Initialization Vectors (IVs) for Cipher Block Chaining (CBC) encryption, and it explicitly disables Certificate Revocation List (CRL) verification during TLS peer authentication. Which of the following security risks are directly introduced by these weaknesses? (Select TWO.)

A security engineer is analyzing HTTP request logs for a document generation microservice after a Security Information and Event Management (SIEM) alert triggered on high CPU utilization. The service accepts custom template strings from authenticated users to format PDF invoices. Inspection of an isolated POST request payload reveals the following body:

`{"account_id": 9402, "template_body": "{{ self._TemplateReference__context.namespace.__init__.__globals__['os'].popen('id').read() }}"}`

The microservice returned an HTTP 200 OK response containing the payload output: `uid=1001(appworker) gid=1001(appworker)`.

Which of the following vulnerabilities was exploited in this incident, and what primary software control best prevents this vulnerability?

An enterprise security operations center (SOC) detects anomalous network and wireless activity across multiple site logs during a synchronized red-team exercise. Match each observed technical log snippet or packet capture indicator to its corresponding network or wireless attack classification.

A security analyst reviewing network traffic logs from a global logistics platform notices that high-frequency automated telemetry updates are transmitted using AES encryption. Despite the encryption, an eavesdropper sitting on the network path can easily identify recurring fleet coordinates and status codes because identical 16-byte plaintext blocks consistently produce identical 16-byte ciphertext blocks throughout the session. Which cryptographic weakness is directly responsible for allowing the adversary to reconstruct payload patterns from the intercepted traffic?

A security engineer inspects a vulnerability scan report and port listing for a building automation system (BAS) controller deployed on an internal VLAN (172.16.45.10):

PORT STATE SERVICE REASON
23/tcp open telnet Unencrypted interactive management shell
80/tcp open http Embedded Web Server (Cleartext HTTP Basic Auth)
502/tcp open modbus Modbus TCP (Industrial protocol without built-in authentication)

Which of the following architectural and host vulnerabilities are present on this system? (Select TWO.)

A security analyst needs to gather freely available threat indicators and standardized software vulnerability data without incurring commercial licensing or subscription costs. Which TWO of the following threat intelligence sources should the analyst utilize?

A multinational financial services firm discovers an unauthorized third-party file synchronization application installed across several workstations in the accounting department. The application was introduced by employees seeking to bypass internal network latency when sharing large spreadsheets with external auditors. While analyzing the traffic, security operations identifies that the external cloud server receiving the synchronized financial data was compromised three days prior by a ransomware syndicate, exposing corporate credentials and confidential records. Which of the following best categorizes the primary attack vector utilized and the threat actor attribute responsible for the initial vulnerability?

A network administrator suspects an attacker is performing an Evil Twin attack combined with a disassociation attack to intercept wireless client traffic. Which TWO technical indicators directly point to this specific wireless attack scenario? (Select TWO.)

A security analyst investigates packet capture data and network syslog alerts from an enterprise workstation segment. The logs reveal multiple unsolicited gratuitous ARP reply frames mapping the IP address of the subnet default gateway to an unauthorized local host's MAC address. Concurrently, workstations requesting address records for the corporate portal `login.enterprise.local` receive forged response packets directing them to an external public IP address, bypassing the internal primary DNS server. Which of the following attack indicators and techniques are demonstrated in this security incident? (Select TWO.)

During a targeted forensic investigation of a compromised server, an investigator examines volatile memory artifacts using a memory analysis framework. The analysis reveals an injected memory section within the address space of a legitimate lsass.exe process possessing PAGE_EXECUTE_READWRITE memory permissions. Further inspection reveals shellcode executing directly out of unmapped RAM with no corresponding executable file present on the disk or file modification recorded. Which of the following malware classifications best describes this threat?