Threats, Vulnerabilities, and Mitigations

A security analyst is reviewing endpoint telemetry and forensic artifacts across several compromised systems. Match each malware classification on the left with its corresponding technical indicator of compromise (IoC) or behavior on the right.

During a comprehensive security audit following a series of distinct security events across a global enterprise, threat intelligence analysts are categorizing observed activities by threat actor type, attributes, and primary attack vectors. Match each threat actor profile on the left with the enterprise scenario on the right that best exemplifies its characteristic capabilities, motivation, and attack vector.

An enterprise security architect is designing compensating controls for legacy operational technology (OT) controllers on an industrial network. The controllers run an end-of-life operating system that cannot be patched or upgraded due to critical vendor warranty constraints. Which TWO of the following technical mitigation techniques should the security architect implement to prevent privilege escalation and lateral movement without impacting system stability? (Select TWO.)

An incident response team investigates a physical intrusion where an unauthorized cellular bridge was connected inside a financial firm's network distribution room. Reviewing access logs and security footage reveals that an attacker contacted the facilities desk pretending to be an official state electrical inspector. The attacker claimed an imminent safety violation required an emergency inspection of the transfer switches to avoid immediate facility shutdown. Driven by the fear of operational disruption, the staff member generated a temporary badge and granted unescorted access without cross-referencing the official vendor schedule. Which social engineering attack vector and primary principles of influence were combined to execute this breach?

Match each social engineering attack vector to the enterprise incident scenario that best exemplifies its delivery method and tactics.

A security analyst investigates an incident where an attacker compromised a containerized microservice pod and used stolen service account credentials to move laterally and extract confidential data from an internal backend database. The current environment relies primarily on an ingress Web Application Firewall (WAF) and perimeter firewalls, which permitted all internal pod-to-pod traffic once the perimeter was traversed. Which of the following technical mitigation strategies should the organization implement to enforce least privilege access and restrict lateral movement within the container environment?

A security analyst is investigating anomalous network activity within a corporate VLAN. Systems on the subnet experience intermittent latency, and central syslog feeds capture repeated notifications from the primary switch indicating rapid MAC address movement (flapping) for the default gateway across several access ports. Concurrently, network packet captures reveal that the switch has entered a fail-open state, broadcasting unicast frames meant for specific internal servers out of all physical ports on the VLAN. Which of the following attacks is MOST likely occurring?

During a post-incident investigation, a security analyst discovers that an attacker executed a multi-channel campaign against an organization. First, remote administrators received text messages during a off-hours maintenance window directing them to a fake portal to re-authenticate their multi-factor credentials due to an urgent server outage. Second, the attacker telephoned the helpdesk, impersonated the Chief Information Security Officer, and pressured an technician into bypassing standard identity verification to reset a high-privilege account password immediately. Which of the following social engineering attack vectors and influence principles were demonstrated in this incident? (Select TWO)

A threat intelligence team at a global maritime logistics provider is investigating an intrusion into their vessel tracking and scheduling infrastructure. The investigation reveals that an Advanced Persistent Threat (APT) group maintained continuous, undetected access for nine months after obtaining valid third-party vendor API credentials. Forensic analysis indicates the threat actor deployed proprietary, custom-built malware operating exclusively in volatile memory to conduct long-term intelligence gathering. Which TWO of the following attributes and attack vectors typically characterize this specific category of threat actor in contrast to casual hacktivists or script kiddies?

During a comprehensive security audit of an enterprise microservices web platform, an analyst examines two service implementations. Service 1 is an avatar generator that receives a user-supplied web URL via an HTTP POST request, fetches the image resource directly from that URL using a server-side HTTP client, and stores it in internal object storage without restricting target IP addresses or domains. Service 2 is a catalog search service that accepts input strings from search queries and directly concatenates them into dynamic SQL strings executed against the backend database.

Which of the following vulnerability classifications are present in these microservices, and which recommended controls effectively mitigate them? (Select THREE.)

An aerospace engineering enterprise recently completed a third-party technical audit of its internal infrastructure. Match each security weakness scenario on the left with the corresponding cryptographic or control vulnerability on the right.

A security technician is analyzing a compromised workstation log after an administrative staff member manually ran an executable disguised as a printer driver update. Forensic analysis reveals that upon execution, the payload established persistence via Windows Task Scheduler to maintain access across reboots and initiated command-and-control traffic. The telemetry confirms the file did not perform automated network vulnerability scans or attempt self-replication to other network hosts. Which of the following malware characteristics and operational indicators are demonstrated in this scenario? (Select TWO.)

A hospital security team wants to join a trusted non-profit network to exchange sector-specific threat intelligence with peer healthcare organizations. Which of the following resources best fulfills this requirement?

An organization's finance department receives an email requesting an immediate change to a trusted vendor's direct deposit bank account details before a scheduled wire transfer. The email features legitimate company logos, uses appropriate financial terminology, and references recent specific purchase order numbers, but originates from a slightly altered external domain. Which of the following social engineering attacks is depicted in this scenario?

During an incident response investigation on a compromised domain controller, a security team suspects the persistent presence of a rootkit alongside other malicious artifacts. Which of the following technical indicators of compromise (IoCs) specifically confirm the presence of a rootkit on the host? (Select TWO.)

A Security Operations Center (SOC) analyst investigates alerts from a managed network switch. The syslog outputs reveal that a single switch port learned over 100,000 unique source MAC addresses in less than one minute. Subsequent packet analysis shows that unicast traffic intended for specific hosts on VLAN 10 is now being broadcast to all physical ports on the switch, allowing an unauthorized system to capture unencrypted data frames. Which of the following attack types is indicated by these log entries, and what primary operational state change causes the switch to exhibit this behavior?

A corporate security operations center is investigating four distinct security incidents involving social engineering vectors across physical, web, domain, and email boundaries. Match each incident description on the left with its corresponding social engineering attack classification on the right.

An application security auditor reviews network traffic logs and backend code snippets for a cloud-hosted Web API. The audit reveals two specific behaviors:

1. When a client submits a malformed query request, the server responds with an HTTP 500 Internal Server Error containing full stack traces, database schema details, and unhandled exception data.
2. The endpoint `/api/v1/account` accepts a user-supplied parameter `account_id` and retrieves requested profile records without checking whether the requesting user's token has permission to access that specific account.

Which of the following application vulnerabilities are directly illustrated by these findings? (Select TWO).

A security analyst reviews wireless intrusion prevention system (WIPS) alert logs following reports of intermittent connectivity issues at a corporate office. The log reveals that multiple wireless workstations simultaneously disconnected from the corporate SSID 'Enterprise-Secure' after receiving spoofed 802.11 Subtype 12 management frames. Immediately following the disconnection, the affected workstations attempted to re-authenticate against an unauthorized access point broadcasting the same SSID on an adjacent channel, but using a degraded WPA2-PSK security mechanism instead of 802.1X WPA3-Enterprise. Which TWO of the following wireless attack indicators and techniques are demonstrated in this scenario?

A software security engineer is reviewing static code analysis findings for a legacy file rendering service. The report identifies two vulnerabilities: one where unvalidated user input is directly concatenated into a shell command string, allowing arbitrary system execution, and another where arithmetic calculations for buffer allocation fail to validate integer limits, leading to potential heap buffer overflows. Which of the following remediation techniques should the team implement to directly fix these code-level software vulnerabilities? (Select TWO).