Examkin

Threats, Vulnerabilities, and Mitigations

490 questions

All types490Multiple choice252Multiple select129Matching109
Question 221Question →

A security team conducts a static code analysis on a newly developed mobile application. The review reveals that the application uses a hardcoded secret key embedded directly inside the compiled source code to encrypt local user session tokens. Which of the following best describes the primary cryptographic security weakness in this application design?

Show answer & explanation

Answer: Hardcoded key usage, which allows attackers to extract the secret key through reverse engineering of the application binary.

Answer

Hardcoded secret keys embedded inside compiled application binaries allow attackers to extract the key through reverse engineering, compromising the security of all data encrypted with that key.
Embedding secret cryptographic keys directly inside source code or compiled application binaries creates a severe vulnerability known as hardcoded key usage. Because mobile application binaries reside on end-user devices, attackers can decompile or disassemble the software using standard reverse engineering tools, extract the secret key, and decrypt all protected session tokens.

Step-by-Step Solution

1
Analyze the scenario details.
The application code contains an embedded, fixed secret key used for local encryption.
Static code analysis identified a hardcoded secret key directly within the compiled mobile application binary.
2
Evaluate the risk of embedding static cryptographic keys in client applications.
Attackers can decompile the mobile binary and extract the hardcoded key.
Client binaries are untrusted environments; any embedded secret key can be recovered using basic reverse engineering tools.
3
Identify the primary cryptographic control weakness.
The weakness is hardcoded key storage leading to key exposure.
Proper key management requires dynamically generated keys or secure storage mechanisms (such as hardware keystores or key vaults) rather than hardcoded code strings.

Key Concept

Hardcoded Cryptographic Keys
Question 222Question →

A threat intelligence team at a healthcare enterprise is designing an automated threat indicator pipeline. The organization wants to ingest structured, machine-readable threat data from trusted peer organizations within its industry sector and automatically exchange standardized operational telemetry across security platforms in real time. Which of the following solutions should the team implement to fulfill these specific requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deployment of TAXII protocol services to facilitate automated, machine-readable indicator transport between security systems.; Direct subscription and participation in a sector-specific ISAC to receive and share industry-relevant threat telemetry with peer organizations.

Answer

The correct solutions are deploying TAXII protocol services for automated indicator transport and joining a sector-specific ISAC to exchange vetted threat data with industry peers.
To achieve automated, machine-readable threat indicator ingestion and real-time community sharing, an organization should deploy TAXII servers (which manage the transport layer for structured threat data such as STIX) and participate in a sector-specific ISAC (which provides the operational trust framework and platform for industry peers to exchange relevant telemetry).

Step-by-Step Solution

1
Analyze requirement for automated, real-time indicators
Identify that machine-readable threat indicator transport requires standardized protocol exchange standards like TAXII.
TAXII automates the sharing of structured threat data across heterogeneous security systems.
2
Analyze requirement for peer-to-peer industry indicator sharing
Identify that sector-specific threat sharing relies on Information Sharing and Analysis Centers (ISACs).
ISACs enable trusted peer collaboration and targeted threat intelligence dissemination within specialized domains like healthcare.
3
Evaluate distractor choices against threat intel definitions
Reject CVE/NVD unparsed feeds for firewall blocking, honeypots for inline packet filtering, and misaligned threat actor attribution.
Vulnerability databases do not contain active operational IOCs, honeypots are not preventive filtering controls, and script kiddies lack zero-day targeted capability.

Key Concept

Threat Intelligence Sharing Architecture (ISACs and TAXII)
Question 223Question →

Users in a office location report that all connected wireless devices suddenly lost Wi-Fi signal simultaneously across multiple channels. Analysis using a spectrum analyzer detects a severe, continuous spike in radio frequency interference spanning the entire 2.4 GHz spectrum. Which of the following wireless attacks is indicated by these symptoms?

Show answer & explanation

Answer: Radio frequency jamming

Answer

Radio frequency jamming
Radio frequency jamming occurs when an attacker uses an RF transmitter to intentionally flood wireless frequencies with noise. The signature indicator is continuous, broad spectrum noise across wireless bands detected by a spectrum analyzer, causing immediate signal loss for all surrounding devices.

Step-by-Step Solution

1
Analyze the physical symptoms reported by end users.
All client devices across multiple channels lost Wi-Fi connectivity at the exact same time.
Simultaneous disruption across multiple channels points to physical-layer RF interference rather than logical access point issues.
2
Interpret the spectrum analyzer findings.
A high, continuous burst of noise was observed across the entire 2.4 GHz band.
RF jamming intentionally floods the wireless spectrum with noise, degrading the signal-to-noise ratio so devices can no longer transmit or receive signals.

Key Concept

Radio Frequency (RF) Jamming Indicators
Estimated Time:45s
Question 224Question →

An incident response team at a regional water utility discovers unauthorized access to its operational technology (OT) network controlling water filtration valves. Forensic analysis reveals that the attacker gained initial access through compromised VPN credentials belonging to an external HVAC contractor, deployed custom zero-day exploits, and maintained undetected access for eight months without altering operations or requesting a ransom. Which of the following threat actor types best matches the attributes and behavior observed in this scenario?

Show answer & explanation

Answer: Nation-state actor

Answer

Nation-state actor
A nation-state actor possesses the advanced technical capability to develop or procure custom zero-day exploits, the financial backing to conduct prolonged reconnaissance, and strategic motivation focused on espionage or long-term operational pre-positioning rather than financial extortion.

Step-by-Step Solution

1
Analyze the attack vector and entry point presented in the scenario.
Initial entry was achieved via a third-party vendor's compromised credentials, demonstrating a supply chain attack vector.
Identifying the vector helps narrow down the actor's capabilities and target methodology.
2
Evaluate the technical sophistication and resource indicators.
The usage of custom zero-day exploits and an eight-month dwell time indicates advanced technical capabilities, significant financial backing, and high persistence.
Developing zero-day exploits requires extensive expertise and financial capital beyond standard cybercriminals or script kiddies.
3
Examine the threat actor's motivation and intent.
The absence of ransomware demands, operational disruption, or theft of financial assets indicates strategic intelligence gathering or pre-positioning rather than financial gain or publicity.
Aligning attributes (sophistication, resources, intent) confirms the threat actor classification.

Key Concept

Threat Actor Attributes and Attack Vectors
Estimated Time:1m 30s
Question 225Question →

A network security administrator examining packet captures from an enterprise core switch notices several anomalous frames originating from an untrusted workstation segment. The captured frame header displays an outer 802.1Q tag corresponding to VLAN 1 (the native VLAN) and an inner 802.1Q tag designated for VLAN 50 (the secure database subnet). Which of the following network attack indicators is demonstrated in this scenario?

Show answer & explanation

Answer: VLAN hopping via double-tagging

Answer

The scenario describes VLAN hopping via double-tagging.
VLAN hopping via double-tagging occurs when an attacker crafts a packet with two 802.1Q tags. The initial switch removes the outer tag because it matches the native VLAN assigned to the trunk link, then forwards the frame. The recipient switch evaluates the inner tag and delivers the payload directly into the targeted VLAN, bypassing firewall and access control boundaries.

Step-by-Step Solution

1
Analyze the frame structure from the packet capture log.
The frame contains nested 802.1Q headers: an outer tag matching the native VLAN of the switch trunk and an inner tag targeting a restricted subnet VLAN.
When a switch configured with a native VLAN receives a frame with an outer tag matching that native VLAN, it strips the outer header without rewriting and forwards the frame out trunk interfaces. The secondary switch then reads the inner tag and delivers the frame to the target VLAN.
2
Correlate frame anomalies with recognized attack vectors.
Encapsulating two 802.1Q tags to bypass VLAN boundaries is the signature mechanism of a double-tagging attack.
This technique exploits switch trunking behavior and implicit trust of native VLAN traffic to achieve unauthorized cross-VLAN frame injection.

Key Concept

VLAN Hopping Indicators and 802.1Q Double-Tagging
Question 226Question →

A system administrator is reviewing web application event logs and discovers multiple database syntax errors generated by user input containing payload strings such as `' OR '1'='1`. Which of the following application vulnerabilities is the attacker attempting to exploit?

Show answer & explanation

Answer: SQL injection

Answer

SQL injection is the vulnerability being targeted.
SQL injection occurs when untrusted input is passed directly into a database query engine without adequate input validation or parameterization. The input payload `' OR '1'='1` forces a SQL boolean condition to always evaluate as true, manipulating the expected query execution flow.

Step-by-Step Solution

1
Analyze the log entries provided in the scenario.
Identify database syntax errors caused by input string `' OR '1'='1`.
Recognizing database command manipulation patterns in user inputs helps identify web application attacks.
2
Determine which application vulnerability allows database syntax execution.
SQL injection occurs when user input fields accept unsanitized SQL commands.
Unsanitized user inputs passed directly into database queries allow attackers to manipulate standard SQL logic.

Key Concept

SQL Injection Identification
Question 227Question →

A DevSecOps engineer is configuring automated security testing methods within a continuous integration/continuous deployment (CI/CD) pipeline for a microservices application. Security directives require identifying code flaws before deployment and assessing application security at runtime in a non-production staging environment without attempting intrusive exploitation. Which TWO of the following security testing methods should be integrated to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Static Application Security Testing (SAST) to analyze uncompiled source code for security flaws early in the build pipeline.; Dynamic Application Security Testing (DAST) to evaluate running application instances in staging using automated non-intrusive web security scans.

Answer

Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) should be integrated into the CI/CD pipeline.
Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) provide complementary vulnerability testing methodologies. SAST analyzes uncompiled code early in the build pipeline to catch static flaws, while DAST tests the compiled, executing application in a staging environment to discover runtime vulnerabilities prior to production release.

Step-by-Step Solution

1
Identify the pre-deployment source code security analysis requirement.
Static Application Security Testing (SAST) is selected because it inspects source code for vulnerabilities before compilation and deployment.
SAST fulfills the requirement of finding software flaws early in the software development lifecycle without running the code.
2
Identify the non-production runtime assessment requirement.
Dynamic Application Security Testing (DAST) is selected because it assesses a functional, running application in a staging environment.
DAST analyzes runtime behavior and identifies vulnerabilities exposed through active application interfaces.

Key Concept

Vulnerability Assessment and Security Testing Methods in Software Development Lifecycles
Question 228Question →

A wireless intrusion prevention system (WIPS) generates a high-severity alert for a mobile workstation located on an enterprise campus. The event log records that an unauthorized device is transmitting targeted unicast 802.11 Probe Response frames matching multiple distinct entries from the workstation's Preferred Network List (PNL). Immediately following the probe responses, the unauthorized device initiates an EAP-TTLS handshake and requests legacy authentication credentials. Which of the following attack mechanisms is most accurately represented by these indicators?

Show answer & explanation

Answer: A Karma attack utilizing passive probe request harvesting to spoof trusted SSIDs and intercept enterprise authentication credentials.

Answer

A Karma attack utilizing passive probe request harvesting to spoof trusted SSIDs and intercept enterprise authentication credentials.
The correct answer accurately identifies a Karma attack. Mobile wireless devices broadcast 802.11 Probe Requests containing SSIDs from their Preferred Network List (PNL) to locate known Wi-Fi networks. In a Karma attack, a rogue access point listens for these requests and immediately responds with unicast Probe Responses matching whichever SSID the client requested. Once the client auto-connects under the assumption that it is reaching a trusted network, the rogue AP initiates authentication exchanges (like EAP-TTLS) to harvest user credentials.

Step-by-Step Solution

1
Analyze the log indicators provided in the scenario.
Identified unicast Probe Responses matching multiple SSIDs from the client workstation's Preferred Network List (PNL), followed by EAP authentication requests.
Client wireless devices periodically broadcast Probe Requests containing SSIDs of previously connected networks stored in their PNL.
2
Correlate the observed frame behavior with wireless attack profiles.
A rogue access point running a Karma attack framework captures these probe requests and dynamically advertises itself as any network requested by the client, inducing automatic client association.
Karma attacks exploit client auto-connect behavior based on PNL probe probing.
3
Evaluate the subsequent credential request indicator.
Once connected to the spoofed SSID, the rogue AP initiates an inner EAP authentication exchange (such as EAP-TTLS/PAP) to capture domain credentials in cleartext or weak hashed format.
This confirms the attacker's motive is unauthorized credential harvesting via rogue AP association.

Key Concept

Karma Attack and Probe Request Harvesting Indicators
Question 229Question →

An incident response team at a critical infrastructure firm is investigating several concurrent security incidents involving social engineering vectors. Match each observed incident scenario to the attack vector that best describes the adversary's delivery method.

Click a left item, then click its matching right item

Items

An administrative staff member receives a customized email appearing to originate from the Chief Executive Officer requesting an immediate, out-of-band wire transfer to secure an urgent acquisition.
A remote system engineer receives a phone call from an attacker impersonating enterprise IT helpdesk support, claiming an urgent credential re-verification is required to restore compromised network access.
Employees at a regional facility find promotional USB flash drives scattered across the employee parking lot, which install reverse-shell malware when inserted into workstation ports.
Threat actors compromise a niche online forum popular among industrial control systems engineers, injecting malicious code into the site to serve drive-by exploits to visiting staff.

Matches

Show answer & explanation

Answer

The scenarios match their respective social engineering attack vectors as follows: the executive wire transfer scam matches Whaling; the phone call impersonating IT support matches Vishing; leaving malware-infected USB drives in the parking lot matches Baiting; and compromising a frequently visited industry forum matches a Watering Hole Attack.
Each attack scenario aligns with its specific technical vector definition: executive impersonation email is Whaling; fraudulent IT support telephone call is Vishing; infected physical media in a public area is Baiting; and compromised industry website targeting specific users is a Watering Hole Attack.

Step-by-Step Solution

1
Analyze the communication channel and target of the targeted email scenario.
Identified spear phishing targeting high-level corporate personnel and authority, which corresponds to Whaling.
Whaling specifically target senior executives or impersonates executive authority for financial or high-value gain.
2
Examine the telephone-based credential harvesting scenario.
Identified voice-based social engineering, which corresponds to Vishing.
Vishing relies on phone conversations and pretexting to elicit sensitive credentials from victims.
3
Evaluate the physical media USB scenario.
Identified physical baiting tactics using hardware media left in accessible areas.
Baiting entices victims with physical objects (like USB drives) promising a gain or appealing to curiosity.
4
Evaluate the web forum injection scenario.
Identified strategic web compromise targeting a specific user group, corresponding to a Watering Hole Attack.
Watering hole attacks infect trusted sites frequented by the target demographic to deliver drive-by downloads.

Key Concept

Social Engineering Attack Vector Classification
Question 230Question →

A security analyst investigates an incident where an adversary registered a domain visually similar to an enterprise's external vendor portal (payro1l-service.com). The adversary hosted a trojanized software patch on the site and sent personalized emails directly to three payroll specialists, claiming an urgent compliance update was required to prevent processing delays. Which of the following social engineering attack vectors best describes the primary delivery tactic used against the payroll specialists?

Show answer & explanation

Answer: Spear phishing utilizing pretexting and typosquatting

Answer

Spear phishing utilizing pretexting and typosquatting is the primary vector because the adversary targeted specific employees with tailored emails, crafted an urgent compliance story, and hosted the malware on a deceptive domain.
The scenario describes a targeted attack against specific employees (payroll specialists) using customized communication, which characterizes spear phishing. The attacker fabricated an urgent compliance requirement scenario (pretexting) and directed targets to a visually deceptive lookalike domain (typosquatting).

Step-by-Step Solution

1
Analyze the delivery method and target specificity in the scenario.
The adversary targeted specific payroll specialists using customized emails, which defines spear phishing.
General phishing broadcasts messages broadly, whereas targeting specific individuals based on their roles is spear phishing.
2
Evaluate the psychological influence technique and domain setup.
The adversary created a fake story about mandatory compliance updates (pretexting) and hosted it on a lookalike domain (typosquatting).
Pretexting establishes a fabricated scenario to manipulate targets into taking action, while typosquatting tricks users via deceptive URL spellings.
3
Differentiate from alternative social engineering vectors.
Watering hole, vishing/baiting, and whaling do not match the targeted email medium, technical setup, or audience profile described.
Watering hole attacks compromise third-party sites passively, vishing uses voice calls, baiting uses physical media, and whaling targets C-suite executives.

Key Concept

Identifying Spear Phishing, Pretexting, and Typosquatting Vectors
Question 231Question →

A security engineering team is conducting a vulnerability assessment of an internal payment API gateway. The assessment reveals that client TLS connections are configured to accept cipher suites utilizing the RC4 stream cipher for data encryption and static RSA key exchange for session negotiation. Which of the following security risks or weaknesses are directly introduced by this cryptographic configuration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Susceptibility to plaintext recovery attacks resulting from statistical biases in the stream cipher keystream; Loss of Perfect Forward Secrecy, allowing retrospective decryption of recorded sessions if the server private key is compromised

Answer

The correct selections state that the configuration introduces susceptibility to plaintext recovery via keystream statistical biases and results in a loss of Perfect Forward Secrecy.
The scenario highlights two distinct cryptographic weaknesses: the use of RC4 and static RSA key exchange. RC4 contains documented statistical biases in its keystream generation, which enables malicious actors to recover plaintext from captured TLS traffic over time. Static RSA key exchange uses the server's static public key to transport pre-master secrets without generating ephemeral keys per session; consequently, it lacks Perfect Forward Secrecy, meaning a future compromise of the server's private key compromises all previously recorded session communications.

Step-by-Step Solution

1
Analyze the symmetric encryption component (RC4 stream cipher).
Identify that RC4 suffers from known keystream biases (e.g., Fluhrer, Mantin, and Shamir attacks / NOMORE attacks), permitting plaintext recovery over repeated ciphertexts.
Cryptographic assessment requires identifying vulnerabilities tied directly to weak or deprecated bulk ciphers.
2
Analyze the key exchange mechanism (static RSA key exchange).
Determine that static RSA key exchange does not generate ephemeral session keys, failing to provide Perfect Forward Secrecy (PFS).
Without ephemeral key exchange algorithms like ECDHE or DHE, compromise of the server's long-term private key compromises all historical session traffic.
3
Evaluate and eliminate incorrect distractor claims regarding identity authentication and memory buffer security.
Confirm that server authentication via RSA certificates remains active and that buffer overflows represent software execution vulnerabilities rather than cipher flaws.
Differentiates protocol-level cryptographic weaknesses from software code vulnerabilities and general PKI misconceptions.

Key Concept

Cryptographic and Security Control Weaknesses
Question 232Question →

A lead security analyst at a online retail enterprise is evaluating threat intelligence options to proactively detect compromised corporate credentials being offered for sale on subterranean marketplaces. The organization requires actionable, curated threat feeds with tailored risk scoring and automated API integration to ingest indicators of compromise (IOCs) without dedicating internal staff to manually monitor dark web forums. Which threat intelligence source type should the analyst recommend to meet these requirements?

Show answer & explanation

Answer: Commercial threat intelligence feed

Answer

Commercial threat intelligence feed
Commercial threat intelligence feeds are subscription-based services provided by security vendors who deploy dedicated researchers and automated tools to monitor dark web forums, paste sites, and subterranean channels. They curate this raw data, enrich it with contextual risk scores, and deliver actionable indicators automatically through API integrations, fulfilling all specified organizational criteria.

Step-by-Step Solution

1
Analyze the operational requirements
Identified key requirements: dark web monitoring, curated risk scoring, automated API integration, and no manual internal research overhead.
The enterprise needs a turnkey intelligence product rather than raw data collection.
2
Evaluate intelligence source attributes
Commercial threat intelligence vendors specialize in specialized deep/dark web monitoring, raw data processing, contextual enrichment, and automated IOC delivery via structured APIs.
Paid commercial feeds offload manual scraping and vetting from internal SOC teams.
3
Compare against alternative options
OSINT lacks deep subterranean monitoring guarantees; ISACs focus on peer sharing rather than credential scraping services; NVD catalogs software flaws rather than compromised account data.
Commercial threat intelligence is the only option satisfying all constraints.

Key Concept

Distinguishing characteristics and operational use cases of Commercial/Proprietary Threat Intelligence feeds compared to OSINT, ISACs, and Vulnerability Databases.
Estimated Time:2m 0s
Question 233Question →

A global pharmaceutical firm connects several remote research facilities to its central datacenters using legacy IPsec VPN site-to-site tunnels. A cryptographic assessment of the gateway configurations reveals that Phase 1 IKE negotiations utilize Diffie-Hellman (DH) Group 2 (1024-bit) with 3DES-CBC payload encryption, while Phase 2 uses MD5 for message integrity verification. Security analysts report elevated risks of session key recovery, collision vulnerabilities, and performance degradation. Which of the following primary mitigation strategies comprehensively addresses these cryptographic control weaknesses?

Show answer & explanation

Answer: Reconfigure the IPsec VPN tunnels to use Diffie-Hellman Group 14 or higher (or ECDH), transition payload encryption to AES-256-GCM, and replace MD5 authentication with SHA-256.

Answer

Reconfigure the IPsec VPN tunnels to use Diffie-Hellman Group 14 or higher (or ECDH), transition payload encryption to AES-256-GCM, and replace MD5 authentication with SHA-256.
The option recommending upgrading Diffie-Hellman to Group 14 or higher (or ECDH), replacing 3DES with AES-256-GCM, and upgrading MD5 to SHA-256 directly addresses all three identified cryptographic flaws. DH Group 2 (1024-bit) is vulnerable to state-sponsored precomputation; 3DES uses 64-bit blocks subject to collision attacks (Sweet32); and MD5 is broken due to practical hash collisions. Upgrading key length, cipher strength, and hashing algorithms restores robust security across IKE Phase 1 and Phase 2 negotiations.

Step-by-Step Solution

1
Analyze the identified cryptographic weaknesses in the scenario
Identified DH Group 2 (1024-bit MODP) as vulnerable to precomputation attacks, 3DES as vulnerable to Sweet32 collision attacks on 64-bit block sizes, and MD5 as susceptible to cryptographic hash collisions.
Security assessment requires identifying specific failure points across key exchange, bulk encryption, and integrity verification components.
2
Select appropriate modern cryptographic replacements for each vulnerable primitive
Diffie-Hellman Group 14+ / ECDHE replaces weak key exchange, AES-256-GCM replaces weak block ciphers with authenticated encryption, and SHA-256 replaces collision-prone MD5.
CompTIA Security+ standards mandate robust, current symmetric and asymmetric primitives with sufficient key lengths to safeguard enterprise data transit.
3
Evaluate and eliminate incorrect control recommendations
Eliminated options recommending asymmetric ciphers for bulk traffic, network perimeter firewalls for crypto remediation, and control category reclassifications.
Only upgrading the negotiation parameters directly resolves protocol-level cryptographic flaws.

Key Concept

Cryptographic Control Weaknesses and Legacy Cipher Remediation
Question 234Question →

A web application developer wants to remediate software vulnerabilities that allow attacker-controlled inputs to execute malicious scripts in user browsers or alter database commands. Which of the following secure coding practices should the developer implement to address these application vulnerabilities? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Context-aware output encoding before rendering user input in HTML responses; Parameterized queries and prepared statements for all database operations

Answer

The correct secure coding practices are context-aware output encoding and parameterized queries with prepared statements.
Context-aware output encoding neutralizes script execution to mitigate Cross-Site Scripting (XSS), while parameterized queries isolate user data from executable SQL commands to mitigate SQL Injection (SQLi). Both are essential application-level secure coding practices.

Step-by-Step Solution

1
Identify the target application vulnerability types described in the scenario.
Executing scripts in browsers indicates Cross-Site Scripting (XSS), and altering database commands indicates SQL Injection (SQLi).
Accurate identification of vulnerability mechanisms is required to select effective code-level mitigations.
2
Select the appropriate mitigation control for client-side script execution (XSS).
Context-aware output encoding neutralizes special characters so the browser treats input purely as display text.
Encoding prevents script tags from executing in the web browser context.
3
Select the appropriate mitigation control for database command alteration (SQLi).
Parameterized queries ensure database engines treat user input strictly as parameter values rather than executable SQL syntax.
Prepared statements prevent input strings from redefining query logic.

Key Concept

Application Software Vulnerability Remediation and Secure Coding
Question 235Question →

Match each threat intelligence source type to its primary characteristic or operational scope.

Click a left item, then click its matching right item

Items

Open-Source Intelligence (OSINT)
Information Sharing and Analysis Center (ISAC)
Commercial Threat Feed
Vulnerability Database (NVD/CVE)

Matches

Show answer & explanation

Answer

Open-Source Intelligence (OSINT) pairs with publicly accessible security data gathered from open sources. Information Sharing and Analysis Center (ISAC) pairs with a sector-specific trust community established to exchange relevant threat indicators among industry peers. Commercial Threat Feed pairs with a paid subscription service providing vetted, high-fidelity threat indicators. Vulnerability Database (NVD/CVE) pairs with a standardized public catalog detailing known security flaws.
Each threat intelligence source type is accurately mapped to its core delivery mechanism: OSINT relies on publicly available information; ISACs represent sector-specific peer sharing communities; commercial feeds are paid vendor subscriptions; and vulnerability databases provide public catalogs of known software security flaws.

Step-by-Step Solution

1
Identify the defining features of public versus proprietary threat intelligence sources.
OSINT aligns with publicly available information, while Commercial feeds align with paid vendor subscriptions.
Source accessibility and licensing distinguish OSINT from closed/commercial intelligence feeds.
2
Differentiate peer-to-peer industry sharing platforms from general vulnerability repositories.
ISACs handle sector-specific member sharing, whereas Vulnerability Databases (like NVD/CVE) provide a universal reference catalog for software flaws.
ISACs focus on threat actor activity across critical sectors, while CVE repositories detail specific software vulnerabilities.
3
Map each threat intelligence source to its corresponding operational description.
All four intelligence source types are correctly paired with their target definitions.
Each definition precisely captures the primary scope and business model of the respective intelligence source.

Key Concept

Threat Intelligence Sources and Classification
Question 236Question →

A security team needs to perform continuous vulnerability assessment on legacy enterprise servers that are prone to crashing when subjected to heavy network port probes. The solution must accurately detect missing operating system patches and misconfigurations without generating extra network traffic or risking application instability. Which of the following security assessment methods should the team implement?

Show answer & explanation

Answer: Deploying host-based vulnerability assessment agents directly on the legacy servers

Answer

Deploying host-based vulnerability assessment agents directly on the legacy servers is the most appropriate method.
Host-based vulnerability agents execute directly within the target operating system. They evaluate system files, installed patches, and configurations locally without transmitting probe traffic across the network, ensuring complete vulnerability visibility while preventing accidental crashes of fragile legacy services.

Step-by-Step Solution

1
Analyze the operational constraints of the target environment.
Identified key constraints: fragile legacy servers that crash under network probes, requirement for low network overhead, and need for accurate patch detection.
Selecting an effective vulnerability assessment technique requires matching scanning methods to host stability and network impact constraints.
2
Compare host-based agent architecture with network-based scanning methods.
Host-based agents inspect installed packages, OS build numbers, and registry settings locally, bypassing network probe traffic entirely.
Agent-based scanning eliminates network transmission overhead and prevents service disruption on sensitive hosts.

Key Concept

Host-based Vulnerability Assessment Agents vs. Network-based Scans
Question 237Question →

During a security assessment of a critical server, anomalous network connections are observed originating from a system process. Standard endpoint detection tools running on the native operating system report no suspicious processes or modified system binaries. However, when inspecting the host via an offline forensic image, an unauthorized kernel driver is discovered that hooks system calls to hide its running processes and network sockets from native operating system APIs. Which of the following malware types best describes this behavior?

Show answer & explanation

Answer: Rootkit

Answer

Rootkit
The correct answer is Rootkit because rootkits operate at a deep system level (often kernel-mode) and modify or hook operating system API calls, effectively cloaking processes, open ports, and files from local administration and antivirus utilities.

Step-by-Step Solution

1
Analyze the observed indicators of compromise
Identified anomalous network traffic that is invisible to security monitoring software running within the active host operating system.
Security tools relying on native OS APIs fail to detect the process because the underlying system calls are manipulated.
2
Evaluate the forensic evidence from offline disk image analysis
Discovered an unauthorized kernel driver hooking system calls to conceal active processes and open sockets.
Operating at the kernel layer to intercept API requests and cloak system artifacts is the primary capability of rootkit malware.
3
Map technical findings to standard malware categories
Conclude that the behavioral telemetry aligns with a kernel-mode rootkit.
Rootkits maintain persistent, privileged access while actively hiding their components from native system administration utilities.

Key Concept

Rootkits subvert operating system integrity by hooking API calls and kernel structures to conceal files, processes, and network connections from detection tools.
Question 238Question →

A security analyst is reviewing endpoint telemetry and forensic evidence following a corporate incident. Match each observed technical Indicator of Compromise (IoC) on the left with its correct malware classification on the right.

Click a left item, then click its matching right item

Items

A process executes a Base64-encoded command directly within volatile memory using PowerShell without dropping a binary file to disk, while establishing persistence via a WMI event subscription.
System call table hooks are identified alongside Direct Kernel Object Manipulation (DKOM) that actively conceals listening network sockets and process IDs from process management utilities.
Network logs show rapid automated probe traffic targeting TCP port 445 across multiple subnets, self-replicating to adjacent unpatched systems without requiring user interaction.
An end user manually launches an executable disguised as a software update utility, which installs the expected application while silently deploying a covert remote access channel.

Matches

Show answer & explanation

Answer

Fileless Malware pairs with in-memory PowerShell execution without disk binaries; Rootkit pairs with kernel-level DKOM and syscall table manipulation to hide processes; Worm pairs with automated network port scanning and self-replication across subnets; Trojan pairs with malicious software disguised as a legitimate setup utility requiring manual execution.
The correct pairings accurately reflect the core mechanisms and telemetry signatures of each malware category. Fileless malware operates purely in volatile memory via scripts or legitimate system utilities like PowerShell. Rootkits install deep within kernel architecture to hook system calls and alter operating system structures (DKOM) to hide artifacts. Worms leverage network service vulnerabilities (such as SMB port 445) to spread autonomously across connected devices. Trojans rely on user interaction, using trickery to conceal malicious functionality within legitimate-looking executable applications.

Step-by-Step Solution

1
Analyze the first telemetry artifact describing in-memory PowerShell execution and WMI event subscription persistence without disk write operations.
Identify this behavior as living-off-the-land techniques characteristic of fileless malware.
Fileless malware resides in volatile memory and leverages standard system tools to avoid detection by traditional file-based antivirus scanners.
2
Analyze the second telemetry artifact detailing DKOM and system call table hooking designed to conceal open network ports.
Identify this behavior as kernel-mode privilege manipulation characteristic of a rootkit.
Rootkits operate with ring 0 privileges to alter system telemetry and hide malicious activity from operating system diagnostics.
3
Analyze the third telemetry artifact showing automated SMB scanning and network propagation without user interaction.
Identify this behavior as autonomous network self-replication characteristic of a worm.
Worms operate independently across network links, taking advantage of vulnerabilities without needing human execution.
4
Analyze the fourth telemetry artifact describing a user executing a program disguised as a legitimate software update.
Identify this social engineering mechanism and hidden payload delivery as a Trojan.
Trojans rely on deceptive packaging to trick users into manually granting execution rights to embedded malicious software.

Key Concept

Malware Types and Indicators of Compromise
Question 239Question →

A systems administrator is hardening a newly deployed web server before placing it into the production environment. To reduce the server's attack surface by ensuring only necessary network communications and operating system functions are active, which of the following host mitigation practices should the administrator perform FIRST?

Show answer & explanation

Answer: Disabling unneeded services and network protocols

Answer

Disabling unneeded services and network protocols is the primary host-hardening technique used to reduce attack surface.
Disabling unnecessary services and network protocols reduces the overall attack surface of a server by turning off unused network ports and background processes, preventing attackers from exploiting unneeded running applications.

Step-by-Step Solution

1
Identify the primary administrative goal described in the scenario
The goal is host hardening to minimize the attack surface by stopping unnecessary ports and system functions.
Hardening a host system requires eliminating unneeded entry points.
2
Evaluate the effective control for reducing host attack surface
Disabling unneeded applications, daemons, and network protocols directly removes potential vulnerability vectors.
Fewer active services mean fewer potential targets for software exploitation or unauthorized network access.

Key Concept

Host Hardening and Attack Surface Reduction
Question 240Question →

A security analyst conducts an audit of an internal management server and inspects the following listening socket bindings and active process report:

Proto Local Address Foreign Address State PID/Program name
tcp 0.0.0.0:21 0.0.0.0:* LISTEN 812/vsftpd
tcp 0.0.0.0:5900 0.0.0.0:* LISTEN 1044/vncserver
tcp 127.0.0.1:9090 0.0.0.0:* LISTEN 1120/cockpit-daemon

Further investigation confirms that `vncserver` is configured without password authentication and accepts connections from any source IP. Which of the following represents the primary root cause host and architecture vulnerability in this deployment?

Show answer & explanation

Answer: Insecure service configuration allowing unauthenticated binding to wildcard network interfaces

Answer

Insecure service configuration allowing unauthenticated binding to wildcard network interfaces
The socket audit shows VNC bound to `0.0.0.0:5900`, exposing the service across all network interfaces. Combined with disabled authentication, any internal network host can establish a remote desktop session. The root vulnerability is the insecure host service configuration.

Step-by-Step Solution

1
Analyze the socket output
The process `vncserver` is listening on `0.0.0.0:5900`, which means it listens on all network interfaces.
Identifying the socket binding reveals the exposure surface of the service.
2
Evaluate the service configuration details
The VNC service requires no password authentication.
Determining authentication requirements exposes the root security vulnerability.
3
Identify the primary architecture flaw
An unauthenticated remote desktop daemon listening on all host network interfaces creates an immediate unauthorized access risk.
Host security configuration dictates whether network exposure leads to compromise.

Key Concept

Host and Architecture Vulnerabilities - Insecure Service Configuration and Network Socket Exposure
PreviousPage 12 / 25Next
Threats, Vulnerabilities, and Mitigations Practice Questions — CompTIA Security+ — Page 12 | Examkin