Threats, Vulnerabilities, and Mitigations

A security analyst is inspecting a critical legacy host after an automated vulnerability assessment flagged multiple high-severity findings. The scanner provided the following port audit report and service banner details:

PORT STATE SERVICE VERSION / NOTES
21/tcp OPEN ftp vsftpd 2.3.4 (CVE-2011-2523 confirmed exploitable)
23/tcp OPEN telnet Linux telnetd (Plaintext authentication enabled)
80/tcp OPEN http Apache httpd 2.2.15 ((CentOS) OS end-of-life)
443/tcp CLOSED https No TLS listener configured

Which of the following identifies the primary host and architecture root cause vulnerability exposing this server to immediate remote privilege escalation and credential compromise?

A security team is selecting security testing methods and assessment techniques for different operational scenarios. Match each security assessment method on the left with its corresponding operational description on the right.

During a comprehensive security audit for a healthcare enterprise, a security analyst identifies several distinct threat profiles and attack vectors. Match each threat actor type or vector on the left with its defining operational attribute or scenario on the right.

An enterprise security operations team investigates anomalous traffic patterns within a corporate dual-stack subnetwork. Network monitoring alerts indicate that multiple workstations have dynamically updated their default gateway settings to route external traffic through an unapproved link-local address. Packet captures reveal continuous, unsolicited ICMPv6 Type 134 messages being broadcast across the segment with a high router preference flag enabled. Which of the following attack types is indicated by these findings?

A security team is reviewing a web microservice that accepts user-supplied remote image URLs to generate user avatar previews. During testing, an analyst discovers that submitting a URL directed to `http://169.254.169.254/latest/meta-data/` allows the server to fetch and return sensitive cloud instance credentials to the client.

Which of the following mitigation controls should the development team implement to remediate this application vulnerability? (Select TWO.)

A threat intelligence analyst at a commercial bank needs to obtain timely, industry-specific operational intelligence regarding emerging tactics, techniques, and procedures (TTPs) targeting core payment processing gateways. The security leadership wants to exchange attack indicators and vetted threat data directly with peer financial institutions in a trusted environment. Which of the following threat intelligence sources is most appropriate for this objective?

An enterprise security operations center (SOC) detects that several remote staff members were redirected to a fraudulent Single Sign-On (SSO) credential-harvesting page after scanning a Quick Response (QR) code on physical flyers posted in a corporate office building. The flyers purported to contain a link to a mandatory employee workplace survey. Which social engineering attack vector best describes this technique?

A security analyst is evaluating code remediation requirements following an assessment of an enterprise web portal. The evaluation identified two primary software flaws: database queries constructed by concatenating unsanitized user inputs, and user-submitted data reflected directly into rendered HTML responses without escaping. Which of the following mitigation strategies must developers implement to address these specific application vulnerabilities? (Select TWO).

A security analyst evaluates an enterprise environment where legacy monitoring agents running on internal host servers transmit host telemetry data using unencrypted broadcast traffic across a flat management subnet. Additionally, internal host-to-host administrative communication is automatically permitted based strictly on subnetwork IP address origin without requiring continuous session verification or microsegmentation.

Which of the following vulnerabilities are present in this architectural deployment? (Select TWO.)

A telecommunications enterprise security team detects covert data staging on an internal jump host. The activity was conducted during off-peak hours using valid domain administrative credentials, bypassing perimeter firewalls without triggering external traffic alerts. The entity utilized native system administration tools to clear system logs and pivot into restricted intellectual property repositories. Which TWO of the following threat actor attributes or capabilities are most characteristic of this adversary profile? (Select TWO)

A security analyst conducts an internal infrastructure assessment of an enterprise application environment. The assessment reveals two critical architectural findings:

1. Web application microservices communicate with back-end database servers across an unsegmented internal subnet using standard unencrypted HTTP endpoints.
2. No host-based firewalls or network access control lists (ACLs) are configured to restrict traffic between adjacent application servers on the same subnet.

Which of the following host, network, or architecture vulnerabilities are directly present in this environment? (Select TWO.)

A threat hunting team analyzes workstation artifacts following reports of compromised privileged account credentials. Network telemetry and host activity reveal an unauthorized background program that captures input typed into authentication forms and periodically exfiltrates this data to an external server over port 443. The software was installed after an employee executed a third-party utility download, does not attempt to scan or self-replicate across local subnet subnets, and does not modify kernel-level system routines. Which of the following malware classifications best describes this threat?

A security technician conducts an assessment of an embedded building control device connected to an enterprise network. A vulnerability scan produces the following finding:

Host: 192.168.4.12
Port: 8080/tcp (HTTP)
Finding: Embedded Web Interface Hardcoded Credentials
Risk Level: High
Description: The device firmware contains fixed administrative credentials transmitted in cleartext over HTTP. No vendor security patches are available.

The legacy device must remain operational for business operations. Which of the following architecture-level mitigations is the BEST solution to protect the enterprise from this host vulnerability?

A cybersecurity analyst needs to assess internal enterprise servers for missing software security patches and configuration flaws without sending intrusive exploit payloads or generating heavy network traffic across the subnet. Which of the following vulnerability assessment methods should the analyst perform?

A security team at a regional retail corporation is investigating a security incident involving unauthorized access to internal file servers. The attacker gained access using valid employee credentials purchased from an online broker, deployed commercially available ransomware within two hours of access, and left a ransom note demanding an immediate cryptocurrency payment. The investigation confirmed that no sensitive intellectual property was exfiltrated and no attempts were made to establish long-term persistence. Which threat actor category and attribute profile are most consistent with this attack?

A security operations team is organizing its threat intelligence pipeline to improve context, automation, and threat response capabilities across different enterprise monitoring tools. Match each threat intelligence source type on the left to its corresponding operational characteristic or operational capability on the right.

A systems administrator observes that unauthenticated, network-based vulnerability scans are failing to detect internal software patch status and host misconfigurations due to strict host-based firewall rules blocking network probes on corporate endpoints. The administrator needs to collect detailed vulnerability data across all endpoints without altering network firewall policies or exposing administrative credentials across network subnets. Which of the following vulnerability assessment methods should the administrator implement?

During a routine internal audit of an enterprise infrastructure, a security analyst reviews a vulnerability scan report for an Active Directory server host. The scan highlights that a custom system service executable path is configured as C:\Program Files\Enterprise Apps\Service Manager\service.exe without quotation marks, and the directory C:\Program Files\Enterprise Apps has write permissions granted to unprivileged users. Which of the following host vulnerabilities does this specific configuration represent?

An enterprise security audit reveals that workstations in a software development subnet can establish direct, unmonitored SSH and remote execution sessions to production database servers without passing through a centralized management gateway. Which of the following mitigation strategies should the security team implement FIRST to enforce strict administrative boundary isolation and prevent unauthorized lateral movement?

A security analyst reviews device logs following reports of abnormal wireless activity on an executive's smartphone during an off-site conference. The logs indicate that the smartphone first accepted an unsolicited vCard contact file over an unauthenticated Bluetooth Object Exchange (OBEX) connection. Immediately after, an unauthorized background process queried and exfiltrated the device's internal calendar entries and contact lists over Bluetooth without requesting user pairing approval. Based on these technical indicators, which of the following wireless attacks occurred? (Select TWO).