Threats, Vulnerabilities, and Mitigations

During a routine audit at an aerospace software supplier, cybersecurity analysts discover that a lead avionics developer installed an unapproved third-party cloud synchronization tool on a secure build workstation. The investigation reveals the developer used the application to bypass network throttling and meet a tight project deadline, with no intent to exfiltrate data or compromise systems. Which threat actor classification and primary attribute best describe this developer's actions?

A security manager at a retail organization is establishing a threat research and information-sharing strategy. Management wants to receive timely early warnings regarding cyber threats specifically targeting the retail sector and securely exchange anonymized threat telemetry with industry peers. Which of the following sources or mechanisms best fulfills these organizational requirements?

A security operations team at a financial technology firm discovers that an external adversary maintained undetected access inside their cloud development pipeline for over eight months. The adversary utilized custom zero-day exploits, digitally signed binary payloads, and target-tailored command-and-control channels to exfiltrate proprietary trading algorithms without demanding ransom or disrupting services. Which of the following threat actor attributes and attack vectors are demonstrated in this scenario? (Select TWO.)

A security operations analyst is evaluating several network monitoring alerts and packet captures from an enterprise environment. Match each observed technical indicator on the left with its corresponding attack classification on the right.

A network security analyst investigating connectivity issues on a corporate subnet captures traffic from an interface receiving anomalous activity. Packet inspection reveals thousands of broadcast DHCPDISCOVER requests sent within a 10-second window, each specifying a unique, randomized client hardware MAC address. As a result, legitimate clients on the network are receiving IP address APIPA configurations due to scope exhaustion. Which of the following attack indicators is described in this scenario?

A security analyst is auditing a legacy enterprise reporting application. While reviewing the source code responsible for exporting document files, the analyst notes that user-supplied input parameters are directly concatenated into a system command string passed to an operating system command shell executor (`exec()`). The development team proposes mitigating this risk by deploying a Web Application Firewall (WAF) rule designed to inspect requests and block common SQL keywords such as `SELECT`, `INSERT`, and `UNION`. Which of the following evaluations best explains why the proposed mitigation is ineffective?

A security audit of a legacy financial data synchronization service reveals two key architectural flaws: bulk transaction records are encrypted using AES in Electronic Codebook (ECB) mode, and API client connections are allowed based solely on internal IP address ranges without individual user or service authentication. Which of the following security control and cryptographic weaknesses are present in this system? (Select TWO).

An incident response team investigates a workstation that consistently bypasses security controls during boot-up. Low-level forensic examination reveals that malicious code was injected directly into the device's Unified Extensible Firmware Interface (UEFI) storage, allowing the payload to execute before the operating system kernel and Endpoint Detection and Response (EDR) drivers initialize. Which of the following malware classifications best describes this threat?

A security engineering team is implementing an automated threat intelligence platform to exchange structured cyber threat data with an industry ISAC and ingest machine-readable indicators into internal security tools. Which of the following components specifically define the standardized language for expressing threat data and the automated transport protocol for exchanging it? (Select TWO.)

Match each threat intelligence source type to its primary operational use case or intelligence characteristic in an enterprise security framework.

A security technician analyzing network packet captures following a reported credential compromise notes that multiple workstations are issuing UDP port 5355 multicast requests after failing standard DNS name resolution for local resources. Immediately following each multicast query, an unauthorized host on the local subnet returns spoofed name resolution responses, directing the victim workstations to initiate SMB authentication over TCP port 445 to the attacker's machine. Which of the following technical indicators specifically confirm the presence of this attack? Select TWO.

During a network security monitoring session, an analyst receives alerts indicating that an enterprise layer 2 switch is broadcasting unicast frames meant for a specific server out of all active switch ports. Inspection of the switch switchport log shows a single interface generating thousands of inbound Ethernet frames per second, each containing unique, rapidly changing source MAC addresses. Which of the following network attacks is taking place?

An enterprise security architecture assessment identified several technical flaws across the organization's cryptographic implementations and control configurations. Match each cryptographic or security control weakness on the left to its corresponding security impact on the right.

Match each observed wireless or network attack technical indicator to its corresponding security threat classification.

An internal penetration testing team discovers that a custom mobile application's source code explicitly disables Transport Layer Security (TLS) certificate validation routines. The application is configured to accept any presented digital certificate without verifying its certificate authority (CA) trust chain or hostname matching. Which of the following best describes the primary security risk introduced by this cryptographic control weakness?

A threat intelligence analyst at a cloud service provider is tasked with obtaining early-warning indicators regarding unpatched, zero-day vulnerabilities currently being offered for sale by illicit actors prior to public disclosure. Which threat intelligence source type should the analyst primarily monitor to fulfill this requirement?

A security analyst is investigating reports from branch office employees who experienced sudden wireless disconnections followed by prompts to re-enter corporate network credentials on an unfamiliar browser landing page. Wireshark captures and wireless intrusion prevention system (WIPS) logs collected during the incident reveal specific anomalous indicators. Which TWO of the following technical indicators confirm that an Evil Twin attack was executed against the wireless network?

A network security technician is reviewing switch port traffic logs after receiving reports of unauthorized network sniffing on a corporate segment. The log packet trace reveals that a newly attached workstation sent dynamic negotiation frames configured with desirable trunking modes, successfully establishing a trunking link with the switch interface. Shortly after, frames with double-encapsulated 802.1Q headers were observed traversing the interface toward an isolated finance VLAN. Which of the following network attack types is indicated by these technical observations?

A security operations team is standardizing its threat intelligence collection and distribution architecture. Match each threat intelligence technology or source type on the left with its correct technical definition or exchange role on the right.

A security analyst is reviewing application event logs following a report of data exposure in a web portal. The log entries indicate that authenticated users are altering the `user_id` query parameter in the HTTP GET request (`GET /api/v1/profile?user_id=8834`) to retrieve private profile data belonging to other accounts without any server-side validation of ownership. Which of the following security vulnerabilities is demonstrated in this scenario, and what is the most appropriate control to remediate it?