Threats, Vulnerabilities, and Mitigations

A security review of an e-commerce platform's legacy vault database reveals that stored payment tokens are encrypted using the Data Encryption Standard (DES) algorithm operating in Cipher Block Chaining (CBC) mode. Additionally, the system uses a single, hardcoded Initialization Vector (IV) for every database record encryption operation. Which TWO cryptographic weaknesses are present in this architecture? (Select TWO)

During a security assessment of a healthcare organization's cloud microservices, security engineers observe two critical design choices: internal microservices grant unrestricted access to API endpoints based strictly on whether incoming requests originate from internal IP address ranges, and large patient diagnostic image files stored at rest are encrypted individually using asymmetric RSA keys. Which of the following statements correctly identifies the primary architectural and cryptographic weaknesses in this design?

A security operations center (SOC) analyst is investigating an active phishing campaign. The analyst needs to rapidly collect publicly accessible domain registration details, IP reputation scores, and security blogs without requiring commercial licensing or sector-specific trust memberships. Which of the following intelligence source categories should the analyst consult?

An enterprise network administrator notices that several workstations on a local subnet are unexpectedly routing their outbound traffic through an unfamiliar host outside the designated gateway pool. Inspection of network packet captures reveals that workstations renewing their dynamic network configurations are accepting DHCPACK packets from a secondary, unauthorized server that responds faster than the corporate server. Which of the following attack indicators is demonstrated in this scenario?

A cybersecurity consultant is designing an automated threat intelligence enrichment pipeline for an enterprise security team. The architecture requires ingesting open-source, standardized vulnerability data alongside automated, machine-readable threat indicator feeds from external partners over HTTPS. Which of the following sources or protocols should the consultant integrate into the pipeline to achieve these specific goals? (Select TWO.)

During a security audit of a native C application, an analyst evaluates a logging routine designed to capture user-submitted feedback. The code snippet under review is as follows:

c
void log_user_feedback(char *user_input) {
FILE *log_file = fopen("/var/log/app_feedback.log", "a");
if (log_file != NULL) {
fprintf(log_file, user_input);
fclose(log_file);
}
}

The analyst notes that input submitted directly by remote users is passed to `fprintf` as the primary formatting parameter without explicit format specifiers. Which of the following application vulnerabilities is directly present in this code?

Match each enterprise security vulnerability finding on the left with the most effective technical hardening mitigation on the right.

An enterprise security team is implementing enterprise hardening practices for out-of-band management interfaces on network switches to reduce the risk of unauthorized lateral movement. Which TWO of the following technical controls should the team implement? (Select TWO.)

A security analyst is conducting a vulnerability assessment on a company's web portal source code and server logs. The audit identifies that input from a search field is concatenated directly into a backend database statement without input sanitization. Additionally, users can view arbitrary account records by modifying the user ID parameter in the HTTP GET request line because server-side authorization validation is absent. Which of the following application vulnerabilities are present in this scenario? (Select TWO.)

A security analyst is evaluating packet captures and log entries following a network intrusion alert. Match each observed technical indicator to its corresponding network or wireless attack classification.

Match each threat intelligence concept on the left with its primary operational role within an enterprise security framework on the right.

A security analyst is reviewing HTTP logs for a web application dashboard generator. During security testing, an tester supplied the parameter payload `{{7*7}}`, which resulted in the server returning a web page displaying `49`. A subsequent request containing the payload `{{self.__init__.__globals__.__builtins__.__import__('os').popen('whoami').read()}}` executed on the backend host and returned the web server execution account context. Which of the following application vulnerabilities is present in this system?

A network administrator receives an alert from an Intrusion Detection System (IDS) displaying the following log entries captured from a local subnet:

[WARN] Unsolicited ARP Reply detected: 192.168.1.1 is at 00:11:22:AA:BB:CC (Previous MAC: 00:00:0C:07:AC:01)
[WARN] Unsolicited ARP Reply detected: 192.168.1.1 is at 00:11:22:AA:BB:CC (Host 192.168.1.45 ARP cache updated)
[INFO] Traffic for default gateway 192.168.1.1 rerouted through 00:11:22:AA:BB:CC

Based on these technical indicators, which of the following network attacks is actively occurring?

A security analyst is investigating an anomaly in an e-commerce platform's reward point redemption API. During peak traffic events, logs reveal that multiple concurrent API requests using the same single-use discount coupon resulted in repeated point deductions beyond the user's actual balance. Code review shows that the application checks the remaining balance in one database query and updates the record in a subsequent query without synchronization. Which of the following vulnerabilities and mitigation strategies are identified in this scenario? (Select TWO.)

An enterprise web application accepts XML-based configuration files uploaded by system administrators. During a code security audit of the backend parser, an analyst discovers that the XML parser is configured to parse inline Document Type Definitions (DTDs) and resolve external entity references by default. Which of the following vulnerabilities is directly created by this parser configuration flaw?

A chief information security officer (CISO) at a regional healthcare network wants to establish a secure, bidirectional threat intelligence sharing channel to exchange sector-specific cyber threat indicators and attacker tactics directly with peer healthcare organizations. Which threat intelligence source or framework is best suited to fulfill this requirement?

A security analyst is investigating network security logs following user complaints of sudden, repeated disconnections from the corporate Wi-Fi network. Shortly after being disconnected, several user devices automatically reconnected to an unauthorized access point broadcasting the corporate ESSID. Which TWO of the following wireless network indicators specifically point to an active disassociation and Evil Twin attack sequence?

A security engineering team is automating its enterprise threat intelligence workflow to improve SIEM alert enrichment. The solution requires a standardized data format for expressing structured cyber threat information alongside an automated protocol for machine-to-machine transport over HTTPS. Which of the following standards should the team implement to satisfy these requirements? (Select TWO.)

Match each enterprise security risk scenario on the left with the most effective enterprise hardening mitigation on the right.

During a security investigation following alerts from an enterprise Network Intrusion Detection System (NIDS), a security analyst inspects captured traffic headers from a user workstation. The network logs reveal that outbound TCP port 443 connections destined for an internal authentication portal are systematically terminated via forged TCP Reset (RST) packets, while concurrent HTTP 302 response headers redirect the user's browser to submit credentials in cleartext over port 80. Which of the following network attacks is best demonstrated by these observed technical indicators?