Examkin

Threats, Vulnerabilities, and Mitigations

490 questions

All types490Multiple choice252Multiple select129Matching109
Question 81Question →

A security analyst at a municipal emergency dispatch center is investigating a targeted network breach. The adversary gained initial access through compromised supply chain vendor credentials, utilized custom zero-day exploits to maintain persistent access across system reboots, and subtly modified dispatch routing tables without demanding a ransom or exfiltrating data. Threat intelligence reports indicate the threat group operates with state-sponsored backing, high technical sophistication, and extensive financial resources aimed at critical infrastructure disruption. Which of the following threat actor categories best describes the adversary behind this attack?

Show answer & explanation

Answer: Nation-state actor

Answer

Nation-state actor
The correct answer is the nation-state actor because the scenario describes state-sponsored backing, custom zero-day development, high financial resources, and stealthy operational disruption of critical public safety infrastructure without a financial motive.

Step-by-Step Solution

1
Analyze threat actor attributes from the scenario context
Identified high technical sophistication (custom zero-day exploits), state-sponsored funding, supply chain vector, and intent targeted at critical infrastructure disruption rather than financial extortion.
Threat actor categorization depends on aligning observed tactics, techniques, procedures (TTPs), funding level, and primary motivation.
2
Evaluate motivations and capabilities against standard threat actor profiles
Nation-state actors are characterized by advanced persistent threat (APT) capabilities, substantial backing, stealthy persistence, and strategic intent against vital infrastructure.
Differentiating nation-state actors from cybercriminals or hacktivists requires matching resource depth and operational goals.

Key Concept

Threat Actor Types, Attributes, and Motivations
Question 82Question →

A security analyst reviews a vulnerability assessment report for an internal application server host. The report contains the following network service scan snippet:

Host: 192.168.4.15
Port: 1099/TCP
Service: Java JMX RMI
Finding: Remote JMX agent accepting unauthenticated connections. Anonymous users can register MBeans and execute arbitrary code with host system privileges.

Which of the following represents the BEST remediation strategy to address this host vulnerability?

Show answer & explanation

Answer: Enable authentication and TLS transport security on the JMX agent configuration while restricting listener access.

Answer

The best remediation strategy is to enable authentication and TLS transport security directly on the JMX agent configuration and restrict network listener access.
Enabling native authentication and TLS encryption on the JMX agent addresses the vulnerability at its source by requiring valid credentials before any remote management commands or MBean registrations can take place.

Step-by-Step Solution

1
Analyze the vulnerability scan report.
Identified an unauthenticated Java JMX RMI service listening on port 1099/TCP that allows anonymous arbitrary code execution.
Understanding the specific host service vulnerability indicates whether application, protocol, or host configuration changes are needed.
2
Evaluate potential mitigations based on host hardening principles.
Disabling anonymous access and requiring authenticated, encrypted sessions prevents unauthorized invocation of management MBeans.
Host security vulnerabilities caused by insecure default service configurations must be hardened at the service level.
3
Assess alternative control choices for efficacy.
Perimeter firewalls, WAFs, and IDS controls either fail to block internal lateral movement, cannot parse RMI protocols, or merely detect rather than prevent exploitation.
Defense-in-depth requires root-cause host hardening rather than relying solely on secondary or misaligned network controls.

Key Concept

Host Service Hardening and Misconfiguration Remediation
Estimated Time:1m 30s
Question 83Question →

A security administrator needs to conduct a vulnerability assessment on internal workstations to identify missing operating system patches and software misconfigurations with high accuracy and a minimal false-positive rate. Which of the following testing methods should the administrator perform?

Show answer & explanation

Answer: Credentialed vulnerability scan

Answer

Credentialed vulnerability scan
A credentialed vulnerability scan uses system authentication credentials to access local system resources directly. This allows the scanner to accurately audit missing operating system patches, installed applications, and local security configurations with a very low rate of false positives.

Step-by-Step Solution

1
Analyze the assessment requirements
The requirement calls for evaluating local endpoint patch levels and system configurations with minimal false positives.
Determining the correct assessment technique depends on the level of system access needed to gather accurate data.
2
Compare authenticated vs. unauthenticated vulnerability scanning methods
Credentialed vulnerability scanning provides authorized local access to inspect host-level settings and installed software details.
Using valid credentials enables the scanner to perform internal checks that produce more reliable and comprehensive results than external network banners.

Key Concept

Credentialed vs. Non-Credentialed Vulnerability Scanning
Question 84Question →

A system administrator receives an alert that several host files on a workstation have been encrypted unexpectedly, and a pop-up window on the desktop demands a cryptocurrency payment to obtain the decryption key. Which of the following malware types is described in this scenario?

Show answer & explanation

Answer: Ransomware

Answer

Ransomware
Ransomware encrypts a target's files or restricts access to the system, displaying a notice that demands payment in exchange for restoring functionality or providing a decryption key.

Step-by-Step Solution

1
Identify key technical indicators from the scenario.
The primary indicators are unauthorized encryption of user files and a visible ransom demand requiring cryptocurrency payment.
Recognizing the combination of file access loss and extortion allows accurate malware classification.
2
Map the observed behavior to malware categories.
Malware that locks or encrypts data to extort victims is categorized as ransomware.
Other malware types perform different primary functions, such as secret monitoring, stealth access, or self-replication across network nodes.

Key Concept

Ransomware Indicators of Compromise
Question 85Question →

A cybersecurity analyst is investigating an intrusion into a enterprise network belonging to a major financial institution. The attack demonstrated high sophistication, utilized custom zero-day vulnerabilities, maintained persistent covert access over several months, and required extensive financial funding and technical resources. Which of the following threat actor types is most likely responsible for this attack?

Show answer & explanation

Answer: Nation-state actor

Answer

Nation-state actor
Nation-state actors (state-sponsored threats) have access to extensive resources, advanced skills, and significant funding. They focus on long-term stealth (Advanced Persistent Threats), strategic objectives, and often utilize custom zero-day exploits.

Step-by-Step Solution

1
Analyze the threat actor attributes described in the scenario.
Identified key attributes: high sophistication, custom zero-day exploit usage, long-term covert persistence, and high financial/technical resources.
Threat actors are categorized by their motivation, sophistication, resources, and intent.
2
Evaluate the identified attributes against threat actor profiles.
Only nation-state actors (or state-sponsored APT groups) possess the massive resources and high technical capability required for custom zero-day development and stealthy persistence.
Matching threat attributes to the correct actor profile eliminates lower-capability or ideologically driven actors.

Key Concept

Threat Actor Attributes and Capabilities
Estimated Time:45s
Question 86Question →

A SOC analyst responds to an alert regarding anomalous outbound network connections from a critical enterprise server. During incident triage, the analyst gathers the following telemetry artifacts:

- Volatile memory inspection shows shellcode executing directly within the allocated memory space of a legitimate `lsass.exe` process via reflective DLL injection.
- System logs indicate persistence was achieved via a non-standard WMI event consumer executing an encoded script payload.
- Comprehensive storage forensics confirm no new binary files, modified system executables, or untrusted drivers exist on disk.

Which of the following malware classifications best describes this attack vector?

Show answer & explanation

Answer: Fileless malware

Answer

Fileless malware
Fileless malware operates entirely within volatile system memory (RAM) or uses built-in administrative framework tools (such as WMI and PowerShell) without dropping traditional executable files onto disk. The presence of reflective DLL injection in `lsass.exe` alongside WMI persistence and zero file system artifacts explicitly defines a fileless compromise.

Step-by-Step Solution

1
Analyze file system artifacts
Confirm no suspicious binaries or modified files exist on disk storage.
Eliminates traditional malware types that require standalone executable files on disk.
2
Analyze volatile memory and process injection indicators
Identify shellcode running inside legitimate system memory (`lsass.exe`) via reflective DLL injection.
Demonstrates memory-only execution that bypasses standard disk signature scanning.
3
Evaluate persistence mechanism and attack classification
WMI event subscription and encoded scripts execute directly in memory/living-off-the-land context.
Confirms the incident fits the definition of fileless malware.

Key Concept

Fileless malware and Living-off-the-Land (LotL) execution techniques
Question 87Question →

During an incident response investigation, a Security Operations Center (SOC) analyst isolates an endpoint after Endpoint Detection and Response (EDR) telemetry alerts on anomalous process behavior. Further forensic analysis reveals that malicious payload execution occurred directly within system memory (RAM) via process injection into `explorer.exe` using encoded PowerShell commands, leaving zero binary artifacts on the local disk. Which of the following malware classifications best describes this attack?

Show answer & explanation

Answer: Fileless malware

Answer

Fileless malware is the correct classification because the attack relies on running malicious payloads strictly in volatile memory (RAM) via process injection and native administrative utilities without writing executable files to disk.
Fileless malware executes directly in system RAM by injecting code into trusted processes (such as `explorer.exe`) or executing scripts via administrative tools like PowerShell. Because no malicious binary file is saved to the hard drive, traditional file scanner antivirus mechanisms fail to detect it.

Step-by-Step Solution

1
Analyze the technical indicators of compromise (IoCs) described in the EDR alert.
The identified IoCs include memory-resident execution in RAM, process injection into `explorer.exe`, abuse of PowerShell, and the absence of file artifacts on local storage.
Categorizing malware requires identifying the execution environment, storage footprint, and persistence mechanisms.
2
Evaluate the identified IoCs against malware operating modes.
Malware that resides purely in RAM and abuses living-off-the-land binaries (LotL) matches the core characteristics of fileless malware.
Fileless attacks bypass conventional signature scanning by executing payloads entirely within legitimate host memory spaces.

Key Concept

Fileless malware and memory-resident execution techniques
Question 88Question →

A security analyst conducts an internal infrastructure vulnerability assessment on an enterprise network segment containing legacy servers. The assessment scan report reveals the following open ports and vulnerability indicators:

PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4 (Anonymous login permitted)
23/tcp open telnet Legacy router management service
445/tcp open smb Windows Server 2008 R2 (SMBv1 enabled / CVE-2017-0144 detected)

The security operations team must immediately address the threat of unauthenticated remote code execution (RCE) exploitation traversing the internal network while long-term migration plans are finalized. Which of the following mitigations is the MOST effective immediate action to eliminate this specific vulnerability vector?

Show answer & explanation

Answer: Disable SMBv1 host configurations and enforce SMB signing/SMBv2+ across internal group policies.

Answer

Disable SMBv1 host configurations and enforce SMB signing/SMBv2+ across internal group policies.
Disabling SMBv1 directly removes the legacy protocol vulnerability (CVE-2017-0144) responsible for unauthenticated remote code execution. This host protocol hardening action prevents exploitation regardless of network perimeter boundaries.

Step-by-Step Solution

1
Analyze the vulnerability scan report findings
Identify port 445 running legacy SMBv1 with known remote code execution flaw CVE-2017-0144 as the critical RCE attack vector.
Targeting the specific vulnerability requested (unauthenticated RCE) requires isolating SMBv1 on port 445 rather than cleartext authentication services (Telnet/FTP).
2
Evaluate candidate mitigation controls against the host vulnerability
Disabling the deprecated SMBv1 protocol removes the vulnerable code path directly from host operating systems.
Host protocol hardening eliminates the root cause vulnerability without relying solely on perimeter filters or unrelated web application controls.

Key Concept

Host Hardening and Vulnerability Mitigation for Legacy Network Protocols
Estimated Time:2m 0s
Question 89Question →

An investigation at a defense industrial base organization reveals a sophisticated, long-term intrusion targeting unreleased satellite telemetry software designs. Forensic analysis indicates the attackers breached the network by leveraging a zero-day exploit against a third-party supply chain management vendor, maintained persistent memory-only access for over eight months, and systematically exfiltrated specific intellectual property without altering operational data or attempting financial extortion. Which threat actor type and attribute profile is most likely responsible for this attack vector and operational methodology?

Show answer & explanation

Answer: Nation-state threat actor characterized by high technical sophistication, extensive financial resources, and stealthy geopolitical espionage intent.

Answer

Nation-state threat actor characterized by high technical sophistication, extensive financial resources, and stealthy geopolitical espionage intent.
The combination of a zero-day supply chain vector, eight months of undetected memory-only persistence, and focused exfiltration of defense sector intellectual property without extortion demands aligns directly with nation-state threat actors (APTs). These groups possess the extensive funding, high sophistication, and strategic motivation required to execute complex cyber espionage campaigns.

Step-by-Step Solution

1
Analyze the attack vector and access mechanism described in the scenario.
The entry point was an advanced third-party supply chain software zero-day vulnerability, indicating an external breach requiring significant exploit development capabilities.
Identifying the vector distinguishes external advanced attackers from insider threats leveraging valid internal credentials.
2
Evaluate the operational tactics and duration.
Maintaining eight months of undetected memory-only persistence demonstrates advanced technical capability, discipline, and substantial funding.
Distinguishes high-sophistication Advanced Persistent Threats (APTs) from lower-capability actors like hacktivists or script kiddies.
3
Evaluate the intent and motivation.
Exfiltrating sensitive defense intellectual property while intentionally avoiding data destruction or extortion demands aligns strictly with geopolitical espionage.
Differentiates state-sponsored espionage from financial cybercrime syndicates.

Key Concept

Threat Actor Classification and Attribute Mapping
Question 90Question →

Match each technical host telemetry artifact and indicator of compromise with its corresponding malware classification.

Click a left item, then click its matching right item

Items

Kernel callback object modification paired with active process unlinking via Direct Kernel Object Manipulation (DKOM) in kernel memory structures.
Persistent WMI event subscription executing an obfuscated PowerShell payload directly in RAM via reflective DLL injection without writing binary files to disk.
System process executing commands to disable volume shadow copies while recursively encrypting specific file headers using AES-GCM algorithms.
Dormant code segment embedded in a legitimate application that monitors Active Directory domain controller time and executes a destructive payload upon reaching a specified date.

Matches

Show answer & explanation

Answer

Kernel memory modification via DKOM matches Kernel-level Rootkit; WMI persistent memory injection matches Fileless Malware; cryptographic file encryption and shadow copy deletion match Ransomware; condition-triggered dormant execution matches Logic / Time Bomb.
Each malware classification is accurately paired with its distinct technical operational footprint: kernel rootkits modify core OS memory structures via Ring 0 privileges; fileless malware executes in RAM without traditional disk artifacts; ransomware inhibits host recovery while encrypting data storage; and logic/time bombs depend on specific environmental triggers.

Step-by-Step Solution

1
Analyze the telemetry artifact describing kernel memory manipulation and hidden execution pathways.
Identified DKOM and kernel callbacks operating in Ring 0 context.
Rootkits at the kernel layer modify OS data structures to evade detection.
2
Analyze the telemetry artifact referencing non-disk execution mechanisms.
Identified WMI persistence and reflective RAM injection.
Fileless malware relies on living-off-the-land techniques and memory resident code execution.
3
Evaluate indicators of data unavailability combined with recovery inhibitor commands.
Identified AES-GCM encryption paired with volume shadow copy purge.
Ransomware actively prevents recovery while denying access to user data.
4
Evaluate the trigger-based execution criteria.
Identified date-based execution criteria within dormant host code.
Logic and time bombs require specified pre-conditions before detonating.

Key Concept

Distinguishing Malware Categories via Technical Telemetry and Indicators of Compromise
Question 91Question →

A security analyst is defining standard testing procedures for an enterprise vulnerability management program. Match each security assessment method to its corresponding operational description.

Click a left item, then click its matching right item

Items

Passive Vulnerability Scanning
Credentialed Vulnerability Scanning
Dynamic Application Security Testing (DAST)
Static Application Security Testing (SAST)

Matches

Show answer & explanation

Answer

Passive Vulnerability Scanning corresponds to monitoring network traffic silently without probes. Credentialed Vulnerability Scanning corresponds to logging into target systems with valid accounts to audit configuration and patches. Dynamic Application Security Testing (DAST) corresponds to testing a running application by sending simulated malicious requests. Static Application Security Testing (SAST) corresponds to analyzing source code or binaries offline without code execution.
Each assessment method is paired according to its execution environment and access model: Passive scanning observes network traffic without active probing; Credentialed scanning uses valid host credentials for accurate internal assessment; DAST tests live applications at runtime; SAST analyzes unexecuted source code or binaries.

Step-by-Step Solution

1
Differentiate network-level scanning approaches (passive vs. credentialed active).
Identify that non-intrusive traffic capture maps to passive scanning, while authenticated endpoint auditing maps to credentialed scanning.
Passive scanning relies on packet sniffing, whereas credentialed scanning logs into host operating systems.
2
Differentiate application security testing techniques (SAST vs. DAST).
Identify that SAST operates on source code/binaries statically before execution, whereas DAST operates dynamically on running web applications.
SAST requires access to code without running it, while DAST evaluates real-time HTTP requests and server responses during execution.

Key Concept

Vulnerability Assessment and Security Testing Methods
Question 92Question →

During a post-incident analysis of an unexpected enterprise database outage, incident responders discover dormant malicious SQL routines embedded within a core payroll application stored procedure. Telemetry reveals that the script continuously queries the human resources database to verify whether a specific administrator account remains marked as active. The code contains logic specifying that if the account status changes to inactive, or if a designated calendar date passes, the routine automatically executes commands to purge database logs and overwrite primary table records. Which of the following malware types is described in this scenario?

Show answer & explanation

Answer: Logic bomb

Answer

Logic bomb
The correct answer is Logic bomb. A logic bomb is malicious code deliberately inserted into a software system that remains dormant until specific conditions are met, such as a date/time threshold, an employee termination event, or a database query output. In this scenario, checking the HR database status flag and trigger dates matches the classic IoCs of a logic bomb.

Step-by-Step Solution

1
Analyze the technical indicators of compromise described in the scenario
Identified dormant code embedded inside a legitimate stored procedure that checks for specific system conditions (account status flag and date threshold).
Understanding the execution mechanism is critical to categorizing malware types.
2
Evaluate the trigger condition and payload behavior
The malicious payload executes automatically only when specific logical criteria are fulfilled.
Code that waits for predefined logical or temporal conditions before executing a malicious payload defines a logic bomb.
3
Differentiate from alternative malware classifications
The threat does not self-replicate over a network (worm), hide as a benign application installer (Trojan), or subvert OS kernel functions to maintain stealth (rootkit).
Proper classification requires eliminating mechanisms that do not match the observed IoCs.

Key Concept

Logic Bomb Indicators of Compromise
Question 93Question →

A system administrator captures network traffic between an application host and a centralized authentication server on an internal network segment:

text
14:22:05.819201 IP 172.16.40.12.51234 > 172.16.40.50.389: Flags [P.], length 88: LDAP
bindRequest(1) "cn=svc_auth,ou=services,dc=internal,dc=net" simple

Which of the following is the BEST mitigation strategy to resolve the infrastructure vulnerability demonstrated in this log snippet?

Show answer & explanation

Answer: Reconfigure the directory service and client application to enforce LDAPS over TCP port 636 or enable STARTTLS.

Answer

Reconfigure the directory service and client application to enforce LDAPS over TCP port 636 or enable STARTTLS.
The packet capture shows an unencrypted LDAP simple bind request over standard TCP port 389. Simple bind sends directory credentials in cleartext. Enforcing LDAPS (which encrypts LDAP traffic over TCP port 636) or upgrading to STARTTLS establishes TLS encryption, protecting credentials from being intercepted by unauthorized network sniffing.

Step-by-Step Solution

1
Analyze the network packet capture snippet to identify the active protocol and port.
The log shows traffic destined for TCP port 389 using the LDAP protocol with a 'simple' bind request.
Port 389 running standard LDAP with simple bind authentication transmits directory credentials in cleartext across the network.
2
Determine the security risk associated with cleartext authentication traffic.
An attacker performing network sniffing on the internal segment can intercept and harvest administrative credentials.
Cleartext protocols violate confidentiality requirements and fail to secure credential transport.
3
Select the appropriate protocol-level remediation control.
Upgrade the transport protocol to LDAP over TLS (LDAPS) on port 636 or mandate TLS session negotiation via STARTTLS on port 389.
Encrypting the directory communication channel secures credentials in transit against network interception.

Key Concept

Host and Network Infrastructure Vulnerabilities - Unencrypted Legacy Protocols
Estimated Time:1m 30s
Question 94Question →

During an infrastructure security review of a high-frequency financial transaction processing service, security operations observed that active credentialed vulnerability scanning triggered service account lockouts and unacceptable latency spikes on production database nodes. The engineering team requires an assessment approach that identifies software security flaws and system configuration weaknesses without initiating active network probes, modifying authentication states, or disrupting live operations. Which security testing methodology best addresses these operational constraints?

Show answer & explanation

Answer: Deploy passive network traffic monitoring alongside offline static application security testing (SAST) of codebase repositories.

Answer

Implementing passive network traffic monitoring combined with offline static application security testing (SAST) provides comprehensive vulnerability visibility without sending active network probes, causing latency spikes, or triggering account lockouts on production services.
Combining passive network monitoring with static application security testing (SAST) provides effective vulnerability identification while adhering to strict non-intrusive operational boundaries. Passive scanning inspects network traffic out-of-band without injecting packets or performing authentication attempts, eliminating account lockouts and server latency. SAST inspects source code directly without requiring execution in a live production environment.

Step-by-Step Solution

1
Analyze operational constraints
Identified strict requirements: no active probing, no account state modifications, no latency spikes, and zero disruption to live database nodes.
Active credentialed vulnerability scans currently cause production degradation and lockouts.
2
Evaluate testing methodologies against non-intrusive requirements
Passive network monitoring observes packet headers and signatures via SPAN/TAP ports without generating traffic, while SAST analyzes application logic offline.
Both techniques operate out-of-band and introduce zero overhead to live database processes.
3
Differentiate correct methodology from unsuitable assessment and defense controls
Active fuzzing, inline deception technologies, and network firewalls either fail to assess flaws or actively disrupt live services.
Only non-intrusive passive monitoring paired with static analysis fulfills both flaw identification and operational uptime requirements.

Key Concept

Passive Vulnerability Assessment and Static Testing Methods
Question 95Question →

A security analyst reviews a network packet capture taken from an internal segment connecting an administrative system to an embedded host management interface. The packet capture reveals the following HTTP request:

GET /api/v1/system/status?session_token=9f8e7d6c5b4a3210 HTTP/1.1
Host: 10.20.30.50:8080
User-Agent: EnterpriseAdminConsole/3.4
Accept: */*

A subsequent vulnerability assessment confirms that the embedded host management server lacks Transport Layer Security (TLS) support and processes cleartext HTTP requests. Which of the following represents the primary host and network vulnerability exposed in this scenario?

Show answer & explanation

Answer: Unencrypted transmission of sensitive session tokens combined with credential exposure in URI query parameters

Answer

The primary vulnerability is the unencrypted transmission of sensitive session tokens over cleartext HTTP combined with credential exposure in URI query parameters.
The correct answer accurately identifies the root vulnerability shown in the packet capture: transmitting sensitive session tokens across an unencrypted transport layer (HTTP over TCP/8080) while simultaneously exposing those tokens inside the URI query string where they can be intercepted or logged.

Step-by-Step Solution

1
Analyze the log snippet and host configuration.
The HTTP GET request reveals `session_token=9f8e7d6c5b4a3210` passed directly in the URL over plain HTTP (port 8080) without TLS encryption.
Cleartext transport allows network eavesdropping (man-in-the-middle attacks), while URI query parameters are regularly recorded in access logs, referrer headers, and browser histories.
2
Identify the underlying host and network vulnerability.
The combination of cleartext protocol usage and insecure credential placement in the request line exposes sensitive authentication tokens.
Host services accepting plain HTTP for administrative actions expose credentials and session integrity to network-level interception.
3
Evaluate candidate answer choices against the observed vulnerability.
The choice identifying unencrypted transmission and URI query token exposure directly accurately pinpoints the root cause.
Other choices either confuse architectural design assumptions (Zero Trust reliance), misclassify web application attack vectors (XSS), or propose ineffective boundary mitigations.

Key Concept

Host and Network Infrastructure Vulnerabilities - Cleartext Protocols and Insecure Data Transmission
Question 96Question →

An organization is conducting a baseline security audit of its internal servers and infrastructure. Match each identified host or architecture vulnerability on the left with its corresponding primary risk on the right.

Click a left item, then click its matching right item

Items

Legacy / End-of-Life Operating System
Open Unnecessary Network Ports
Default Factory Credentials
Unquoted Windows Service Path

Matches

Show answer & explanation

Answer

Legacy / End-of-Life Operating System pairs with absence of vendor security patches; Open Unnecessary Network Ports pairs with unintended expansion of the system attack surface; Default Factory Credentials pairs with high susceptibility to initial unauthorized access using publicly known passwords; Unquoted Windows Service Path pairs with potential for local privilege escalation.
Each host and infrastructure vulnerability directly correlates to its primary risk: unsupported operating systems suffer from a lack of vendor security patches, open ports expand the host network attack surface, default credentials enable trivial authentication bypass, and unquoted service paths enable local privilege escalation.

Step-by-Step Solution

1
Analyze each host and network architecture vulnerability term.
Identify the distinct risk vector introduced by each misconfiguration or unsupported system state.
Host vulnerabilities stem from unpatched software, excessive running services, weak authentication defaults, or file path misconfigurations.
2
Match each vulnerability directly to its primary security consequence.
EOL software corresponds to missing vendor patches; open listening ports correspond to expanded attack surface; default passwords correspond to unauthorized credential access; unquoted service paths correspond to local privilege escalation.
Aligning specific host vulnerabilities with their corresponding exploit mechanics allows proper risk assessment and remediation prioritization.

Key Concept

Host, Network, and Architecture Vulnerabilities
Question 97Question →

Match each threat actor category with its defining attribute or primary motivation.

Click a left item, then click its matching right item

Items

Nation-State Actor
Hacktivist
Insider Threat
Script Kiddie

Matches

Show answer & explanation

Answer

Nation-State Actor matches with highly sophisticated, extensively funded, and focused on long-term geopolitical espionage; Hacktivist matches with driven by political, social, or ideological goals; Insider Threat matches with possesses legitimate, authorized access; Script Kiddie matches with unskilled individual who executes pre-made automated tools.
Nation-state actors are backed by sovereign government resources focused on covert espionage. Hacktivists carry out disruption or defacement for ideological reasons. Insider threats leverage authorized internal privileges. Script kiddies rely on automated exploit kits due to limited personal coding capability.

Step-by-Step Solution

1
Analyze the primary attributes, resources, and motivations that define each threat actor category.
Identified nation-state actors by state resources/espionage, hacktivists by political intent, insiders by legitimate credentials/access, and script kiddies by lack of technical sophistication.
CompTIA Security+ distinguishes threat actors based on sophistication, funding, intent, and access.
2
Pair each threat actor on the left with its corresponding description on the right.
All four threat actor types are accurately paired with their core defining traits.
Validates proper classification against standard threat intelligence taxonomy.

Key Concept

Threat Actor Types and Attributes
Question 98Question →

Match each malware classification to its primary characteristic or technical indicator.

Click a left item, then click its matching right item

Items

Ransomware
Keylogger
Logic Bomb
Rootkit

Matches

Show answer & explanation

Answer

Ransomware matches with encrypting target system data for payment; Keylogger matches with capturing user keystrokes; Logic Bomb matches with lying dormant until specific trigger conditions occur; Rootkit matches with operating at a deep system level to hide unauthorized processes.
Each malware term correctly maps to its defining characteristics: Ransomware locks files for payment, Keyloggers capture keystroke data, Logic Bombs detonate under preset conditions, and Rootkits manipulate operating system routines to evade detection.

Step-by-Step Solution

1
Analyze each malware type on the left
Identified Ransomware, Keylogger, Logic Bomb, and Rootkit.
Each malware type exhibits distinct behavior and indicators of compromise.
2
Map each malware category to its corresponding operational mechanism
Ransomware locks/encrypts files for extortion; Keylogger intercepts keystrokes; Logic Bomb triggers on condition; Rootkit hides deeply within the OS.
Matching technical behaviors to malware definitions provides clear identification during incident analysis.

Key Concept

Malware Types and Indicators of Compromise
Question 99Question →

A enterprise security operation center (SOC) analyst is categorizing threat actors and attack vectors identified during a comprehensive threat landscape assessment. Match each threat actor type or attack vector on the left with its primary operational attribute or delivery mechanism on the right.

Click a left item, then click its matching right item

Items

Shadow IT
Advanced Persistent Threat (APT)
Software Supply Chain Attack
Insider Threat

Matches

Show answer & explanation

Answer

Shadow IT matches with introducing unapproved software/hardware without IT oversight. Advanced Persistent Threat (APT) matches with high resource capability, stealth, and geopolitical motivations. Software Supply Chain Attack matches with injecting malicious code into trusted third-party updates. Insider Threat matches with leveraging legitimate access rights to exfiltrate data.
Shadow IT is characterized by unauthorized applications or services deployed without IT department knowledge or approval. An APT (Advanced Persistent Threat) is characterized by nation-state funding, extreme sophistication, and persistent stealthy intelligence gathering. A Software Supply Chain attack compromises trusted vendor software build systems to push malicious code into updates. An Insider Threat relies on legitimate access rights granted to an employee, contractor, or partner to bypass perimeter controls.

Step-by-Step Solution

1
Analyze threat actor profiles and operational attributes.
Differentiate nation-state actors (APTs) driven by geopolitical goals from internal personnel (insider threats) possessing authorized credentials.
Threat actors are categorized by funding, sophistication, intent, and access levels.
2
Evaluate attack vector mechanisms.
Distinguish between third-party software supply chain distribution mechanisms and internal deployment of unauthorized infrastructure (Shadow IT).
Vectors specify how access is initially gained or expanded within an target infrastructure.
3
Align each left-side concept with its definitive right-side attribute.
Pair Shadow IT to unapproved systems, APT to nation-state stealth/resources, Supply Chain to compromised upstream software updates, and Insider Threat to legitimate privilege misuse.
Matches align directly with CompTIA Security+ threat taxonomy definitions.

Key Concept

Threat Actor Attributes and Attack Vector Characteristics
Question 100Question →

An incident response team investigating a breach at a regional cloud healthcare provider discovers that infrastructure automation scripts were modified to disable TLS verification across internal microservices. Forensic analysis shows the modification was performed using an active API token originally issued to a former system Administrator who recently left the organization on poor terms. Although the connection originated from an anonymized VPN node commonly associated with political hacktivist campaigns, no external software vulnerabilities or social engineering attacks were involved. Which threat actor type and attack vector combination primary characterizes this incident?

Show answer & explanation

Answer: Insider threat utilizing a direct credential access vector

Answer

An insider threat utilizing a direct credential access vector best characterizes the incident.
An insider threat includes current or former employees who retain authentic credentials or possess inside knowledge of infrastructure operations. Because the attack utilized legitimate API keys previously assigned to an offboarded administrator, the primary threat actor classification is an insider threat, and the attack vector is direct credential abuse.

Step-by-Step Solution

1
Analyze the threat actor attributes
The perpetrator is a former employee possessing inside knowledge and pre-existing valid access keys.
Threat actors with current or retained authorized access fall under the insider threat classification, regardless of post-employment political affiliations or routing proxies.
2
Analyze the attack vector
The intrusion relied on valid API tokens directly authenticating to administrative services.
Direct credential access via orphaned or un-revoked keys constitutes a direct administrative vector rather than social engineering, malware, or exploit-based vectors.

Key Concept

Threat Actor Classification and Attack Vector Identification
Estimated Time:2m 30s
PreviousPage 5 / 25Next
Threats, Vulnerabilities, and Mitigations Practice Questions — CompTIA Security+ — Page 5 | Examkin