Threats, Vulnerabilities, and Mitigations

An industrial control system (ICS) security engineering team requires an automated, standardized mechanism to continuously ingest machine-readable tactical indicators of compromise (IoCs) directly into their Security Orchestration, Automation, and Response (SOAR) platform from external sector peers. Which of the following intelligence standards and transport protocol combinations best satisfies this operational requirement?

A security analyst reviews web application logs and observes client-side script payloads, such as `<script>document.cookie</script>`, submitted through an unvalidated search input and subsequently executed within victim browser sessions. Which of the following application vulnerabilities is present?

A security engineer is hardening an internal enterprise environment following an incident where an adversary established initial access on an administrative endpoint, extracted LSASS memory credentials, and executed lateral movement using unencrypted Server Message Block (SMB) sessions across internal network segments. Which TWO of the following enterprise host hardening strategies would most effectively mitigate these lateral movement techniques?

During an incident response investigation on an enterprise network operating an IPv4 infrastructure, security analysts observe unauthorized traffic redirection affecting internal hosts. Network packet captures reveal an influx of unsolicited ICMPv6 Type 134 messages broadcast across the local subnet containing a Router Preference flag set to 'High' and pointing DNS recursive server options to an untrusted external link-local address. Which network attack indicator is demonstrated in this scenario?

A security operations team at a healthcare research organization is analyzing a long-term intrusion targeting proprietary patient genetic databases. The adversary demonstrated advanced capabilities by leveraging custom zero-day exploits, operating stealthily across multiple months without deploying ransomware or causing service disruptions. Which of the following attributes and motivations are most characteristic of this specific threat actor profile? (Select TWO.)

During a security assessment of a C-based binary processing service, an engineer analyzes the following code snippet responsible for dynamic memory allocation:

`unsigned int total_size = header_size + payload_size;`
`char *buffer = (char *)malloc(total_size);`
`memcpy(buffer, header_data, header_size);`
`memcpy(buffer + header_size, payload_data, payload_size);`

During testing, an input with $header\_size = 0xFFFFFFFF$ ($4,294,967,295$) and $payload\_size = 0x00000010$ ($16$) causes the `total_size` variable to wrap around to $0x0000000F$ ($15$ bytes). As a result, `malloc` allocates a $15$-byte buffer on the heap, but subsequent `memcpy` operations attempt to copy over $4$ gigabytes of data into that buffer.

Which of the following vulnerability types is demonstrated by this flaw, and which control best prevents its exploitation?

A security engineer inspects an internal build host and discovers that an unencrypted container management daemon is listening on TCP port 2375 across all network interfaces, as shown in the following output:

# netstat -tuln | grep 2375
tcp 0 0 0.0.0.0:2375 0.0.0.0:* LISTEN

This configuration allows any node on the internal network segment to send remote commands to spawn root-privileged container processes and access the underlying host filesystem. Which of the following represents the primary host and architecture vulnerability in this scenario?

A security analyst conducts a host and network audit of a newly deployed industrial sensor gateway host. The audit reveals two vulnerability findings: the host's administrative web interface uses unencrypted HTTP with factory default credentials, and the host resides on a flat corporate network segment directly accessible to internal workstations. Which of the following recommendations should the analyst make to remediate these vulnerabilities? (Select TWO.)

An enterprise security architecture team at a telecommunications firm is updating their threat landscape documentation. Match each threat actor category on the left with its primary operational attributes, resources, and attack vector characteristics on the right.

A logistics enterprise recently migrated its driver dispatch platform to a public cloud API gateway. During a post-deployment security assessment, an analyst discovers that while TLS 1.3 protects network transit, the API gateway relies exclusively on source IP address allowlisting to authorize client requests sent from drivers' mobile devices across cellular carrier networks. Which of the following architectural weaknesses represents the MOST critical security control failure in this implementation?

A smart utility company deploys thousands of IoT smart meters to transmit real-time electrical grid telemetry back to a central collection server. During a technical security evaluation of the device firmware binary, security analysts discover that all smart meters utilize a single, identical AES key compiled directly into the executable code to encrypt outgoing telemetry payloads. Which cryptographic weakness is present in this deployment, and what is the main security risk associated with it?

A security analyst has been tasked with evaluating an enterprise web application server to identify missing software patches, unsecure configurations, and known system weaknesses. The organization requires that the assessment identify specific vulnerability details without attempting system exploitation or causing service disruption to production users. Which of the following security assessment methods should the analyst execute to fulfill these requirements?

A regional power grid operator discovers an undetected intrusion within its operational technology (OT) network. Forensic analysis reveals that the attackers leveraged a zero-day vulnerability in specialized industrial controller software to establish long-term persistence. Over an eight-month period, the attackers conducted extensive reconnaissance and network mapping without deploying ransomware or attempting financial extortion. Which of the following threat actor types and attribute profiles best aligns with this attack scenario?

During an incident triage session, security analysts isolate four distinct technical telemetry artifacts collected from host and network sensors. Match each observed technical indicator on the left with its primary malware classification on the right.

A security team is conducting a technical audit of an organization's network and application infrastructure. Match each identified cryptographic or security control weakness on the left with the precise risk or impact it presents on the right.

A threat hunting team performs memory analysis on a suspected workstation and discovers active network sockets associated with hidden execution threads. Lower-level operating system call tables have been intercepted to filter out these specific process IDs from standard administrative monitoring tools. Which of the following malware types is MOST likely operating on the system?

A security analyst conducts incident triage on an enterprise server and uncovers two distinct anomalous indicators:

1. The standard administrative utility binary on disk was replaced with a compromised version that allows unauthorized access using a hardcoded master key.
2. A loadable kernel module is actively intercepting system calls to modify process listings, effectively hiding malicious processes and network sockets from diagnostic commands.

Which of the following malware classifications or mechanisms are directly demonstrated by these forensic findings? (Select TWO)

During an incident response investigation, a security analyst reviews an Endpoint Detection and Response (EDR) alert on a enterprise workstation. Telemetry logs show that a user opened a weaponized document that invoked PowerShell. The script executed directly within system memory, injected shellcode into a legitimate system process, established an encrypted reverse shell, and modified registry run keys for persistence without creating executable binary files on the local disk. Which of the following malware classifications best describes this threat?

A security analyst reviews a vulnerability scan report for an internal web application server. The scan output displays the following finding:

text
Host: 192.168.10.45:443
Plugin Name: TLS/SSL Server Supports Weak Cipher Suites / Legacy Protocols
Risk Factor: High
Description: The remote service accepts TLS 1.0 and SSL 3.0 protocol negotiations using CBC-mode ciphers.

Which of the following host and infrastructure vulnerabilities is directly identified by this report?

An incident response team at a critical defense manufacturing contractor is investigating a prolonged network intrusion. Analysis reveals that the attacker leveraged undisclosed zero-day exploits across third-party supply chain software, executed custom fileless malware directly in memory, and maintained persistent command-and-control communications over eight months using domain fronting techniques. The threat group operated during standard business hours of a foreign timezone, conducted targeted reconnaissance without exfiltrating immediate commercial value data or deploying extortion malware, and focused exclusively on long-term technological blueprint espionage. Which threat actor type and attribute profile best categorizes this adversary?