Threats, Vulnerabilities, and Mitigations

During a security audit of a web application, an analyst identifies software flaws caused by processing untrusted user data without proper sanitization or encoding. Which of the following application vulnerabilities result directly from improper input validation? (Select TWO.)

Following a security incident where an attacker leveraged compromised developer credentials to establish unauthorized persistence on Linux bastion hosts, an organization is revising its host hardening standards. The forensic investigation revealed two key persistence mechanisms: authorized keys file tampering to insert persistent public keys and rogue systemd service installation to launch unauthorized background processes. Which TWO of the following mitigation controls should the security team implement to directly prevent and detect these technical persistence techniques?

An enterprise security analyst investigates an incident report where multiple corporate mobile devices in a satellite office automatically established wireless associations with an untrusted rogue access point without user intervention. Packet capture analysis shows that the rogue access point listened for directed 802.11 Probe Request frames sent by client devices searching for their Preferred Network Lists (PNL) and dynamically broadcast matching SSIDs using open authentication. Which of the following attack classifications and technical controls accurately apply to this scenario? (Select TWO.)

A security audit reveals that several non-interactive service accounts on Linux production application servers have interactive login shells assigned in `/etc/passwd`. Additionally, auditors found that world-writable temporary storage locations (`/tmp` and `/var/tmp`) are mounted on the main filesystem partition without restrictive execution flags, allowing local users to execute binaries placed in these directories. Which of the following technical mitigation steps provides the most effective hardening baseline to directly address both audit findings?

Security analysts at a biotechnology firm discover an ongoing, highly covert intrusion targeting proprietary genomic therapy blueprints. Forensic investigation reveals that the attackers utilized undisclosed zero-day exploits, maintained encrypted command-and-control persistence for over eighteen months, and focused strictly on data exfiltration without attempting ransomware deployment or financial extortion. Based on these operational attributes, which of the following threat actor types is most likely responsible for this attack?

To optimize threat data collection, an enterprise security operations team must classify different threat intelligence feed types. Pair each threat intelligence category on the left with its defining operational characteristic on the right.

Match each observed wireless or network anomaly on the left with its corresponding attack classification on the right.

A security operations team is refining its threat intelligence research workflow during an active incident investigation involving suspicious PowerShell scripts executed on an endpoint. An analyst needs to correlate newly identified command-and-control (C2) domains against publicly accessible registration data, historic passive DNS records, and peer-reviewed technical blogs without transmitting internal organization telemetry to external partners or incurring subscription fees. Which of the following threat intelligence source categories best satisfies these operational constraints?

An enterprise help desk analyst receives an incoming phone call from an individual impersonating a senior IT infrastructure manager. The caller claims that a critical core router has failed, causing an ongoing outage that threatens an upcoming executive board demonstration. The caller insists that standard identity verification protocols must be bypassed immediately to reset an administrative service account credential before board members notice the disruption. Fearing administrative escalation, the help desk analyst performs the credential reset. Which social engineering technique and primary influence tactics were directly leveraged by the attacker?

A security monitoring system triggers an alert after Microsoft Word spawns a hidden PowerShell process executing an encoded command. Forensic inspection of the host system indicates that no traditional executable files were written to disk; instead, malicious code resides and executes entirely within volatile memory to maintain an outbound command-and-control session. Which of the following malware types is described in this incident?

During a security review of a modern document processing web service, an analyst examines crash logs and source code after an unexpected service degradation. The backend endpoint accepts a JSON request containing a document rendering configuration. The service fetches remote custom template assets via HTTP based on a user-provided URL and parses binary header blocks into a fixed-size internal C-style buffer without checking the size of the incoming string. Log analysis reveals that an attacker submitted a payload pointing to $http://169.254.169.254/latest/meta-data/$ alongside a $4,096$-byte header string into a $512$-byte memory buffer, causing an application crash and sensitive cloud infrastructure credential exposure. Which of the following mitigation controls should the security team implement to remediate these specific software vulnerabilities? (Select TWO)

A system administrator tests a diagnostic page on an internal network dashboard that allows users to test ping utility responses by submitting an IP address. The web application passes the input string directly to a server-side shell script without sanitization. When the administrator inputs `127.0.0.1; cat /etc/passwd`, the output displays the server's user account database. Which of the following application vulnerabilities is present?

A systems administrator is applying baseline security configurations to newly provisioned enterprise servers. To minimize the host attack surface, the administrator closes unneeded network ports and stops background services such as Telnet and FTP that are not required for business operations. Which of the following enterprise hardening practices is the administrator performing?

A security analyst reviews a vulnerability assessment report for legacy environmental monitoring sensors installed across a data center. The report reveals that the sensors transmit operational telemetry in cleartext using SNMPv1 with default community strings. The vendor confirms the embedded hardware cannot support firmware updates, protocol upgrade to SNMPv3, or host-level encryption. Which of the following architectural security controls represents the MOST effective mitigation to protect against internal eavesdropping and unauthorized control commands?

A network security administrator monitoring enterprise switch logs notices that a single Media Access Control (MAC) address is rapidly alternating between two different physical switch ports. This constant port-flapping anomaly is causing frame misdirection across the local subnet. Which of the following attack types is most likely occurring?

A cybersecurity incident response team at a global logistics and supply chain enterprise is analyzing four distinct security events across their logistics automation infrastructure. Match each security event description on the left with the most likely threat actor profile on the right.

A security analyst is reviewing an assessment report for a web application that identified a Cross-Site Request Forgery (CSRF) vulnerability in a user profile management module. Which of the following strategies directly mitigate this specific vulnerability? (Select TWO).

During an application security audit of a cloud-native microservices platform, an analyst inspects API logs for a customer profile service. The service accepts HTTP POST updates in JSON format. The analyst discovers that an attacker sent a modified JSON request payload containing an unadvertised field: `"is_admin": true`. The backend REST framework automatically instantiated the incoming JSON parameters directly into the internal user account object, successfully elevating the standard user's privileges without triggering any schema errors. Which software vulnerability is demonstrated in this scenario, and what primary remediation should developers implement?

A Cyber Threat Intelligence (CTI) analyst is designing an integrated threat research and ingestion framework for an enterprise Security Operations Center (SOC). Match each threat intelligence source or transport mechanism on the left with the operational workflow requirement it directly fulfills on the right.

A security consultant is defining security testing methodologies for an organization's software development lifecycle (SDLC). Match each application security testing method to its corresponding operational characteristic.