Examkin

Threats, Vulnerabilities, and Mitigations

490 questions

All types490Multiple choice252Multiple select129Matching109
Question 141Question →

A Lead DevSecOps Engineer is configuring automated security testing within a continuous integration and continuous deployment (CI/CD) staging environment for a WebAssembly-based microservice application. The company requires a vulnerability assessment solution that evaluates the application while it executes, using embedded software agents within the runtime environment to correlate dynamic runtime behavior with the exact lines of source code causing vulnerabilities, thereby minimizing false positives. Which of the following security testing methods best fulfills these requirements?

Show answer & explanation

Answer: Interactive Application Security Testing (IAST)

Answer

Interactive Application Security Testing (IAST) is the correct choice because it evaluates application execution from within the runtime environment using instrumented agents to correlate dynamic flaws with precise source code locations.
Interactive Application Security Testing (IAST) combines static and dynamic analysis principles by instrumenting the runtime environment with software agents. As functional tests execute against the application, IAST monitors real-time memory, HTTP requests, and data flows internally, allowing it to pinpoint exact source code vulnerabilities with low false-positive rates.

Step-by-Step Solution

1
Analyze the operational constraints specified in the scenario.
The requirement demands evaluating application behavior during execution (runtime), utilizing internal agents, and mapping flaws to exact source code line numbers with minimal false positives.
Security assessment methods differ significantly based on whether code is analyzed at rest, externally during execution, or interactively within the runtime engine.
2
Evaluate candidate application security testing methodologies against the requirements.
IAST combines the benefits of static and dynamic testing by leveraging internal execution monitoring agents during runtime.
Only IAST embeds agents directly inside the execution environment to monitor real-time data flows and correlate execution states back to underlying source code.

Key Concept

Application Security Testing Methodologies (IAST vs. SAST vs. DAST)
Estimated Time:1m 30s
Question 142Question →

During an incident response investigation at a commercial satellite communications control facility, security analysts discover that several ground station modems were flashed with rogue firmware updates. The attackers compromised a third-party hardware vendor's build server nearly a year prior to steal private cryptographic signing keys, allowing the malicious firmware to pass signature validation without triggering alerts. The intrusion targeted long-term collection of orbital telemetry data without altering operational availability or attempting monetary extortion. Which threat actor type and attribute profile is primarily demonstrated in this scenario?

Show answer & explanation

Answer: A nation-state actor exhibiting high technical sophistication, extensive financial resources, and long-term espionage intent.

Answer

A nation-state actor exhibiting high technical sophistication, extensive financial resources, and long-term espionage intent.
The correct answer accurately maps the scenario attributes (supply chain key compromise, silent year-long persistence, orbital telemetry collection) to a nation-state threat actor. Nation-state actors possess advanced technical capabilities, extensive resources, and patience to carry out long-term espionage campaigns focused on strategic data collection without alerting targets through disruptive actions or extortion demands.

Step-by-Step Solution

1
Analyze the attack vector and operational tactics described in the scenario.
The attack involved compromising a third-party vendor's signing key months in advance (supply chain attack) to bypass firmware integrity controls.
This level of operational discipline and supply chain compromise requires high technical capability and substantial resources.
2
Evaluate the actor's intent and motivation based on post-exploitation behavior.
The actor maintained silent persistence for nearly a year to gather orbital telemetry without causing disruption or demanding ransom.
Stealthy, persistent data gathering aligns directly with strategic espionage rather than financial extortion or political activism.
3
Correlate tactical attributes and motivation with standard threat actor profiles.
High sophistication + high resources + long-term stealth + espionage intent = Nation-State / APT threat actor profile.
Nation-state actors are uniquely defined by state-backed funding, advanced technical capabilities, and long-term intelligence gathering goals.

Key Concept

Threat Actor Attributes, Motivations, and Attack Vectors
Question 143Question →

An enterprise security operations center (SOC) detects an incident where remote executive assistants received customized SMS text messages appearing to originate from the corporate IT department. The messages contained links to a credential-harvesting landing page hosted on a typosquatted domain and warned that email access would be permanently suspended within two hours unless password re-verification was completed immediately. Which social engineering attack vector and primary principle of influence were executed in this scenario?

Show answer & explanation

Answer: Smishing leveraging the principle of urgency

Answer

The attack vector is smishing, combined with the principle of urgency.
The correct response accurately identifies smishing as the attack vector because the communication took place over SMS text messages. It also correctly pairs this vector with the principle of urgency, as the attacker attempted to force quick compliance by establishing a two-hour deadline before access suspension.

Step-by-Step Solution

1
Identify the delivery medium utilized in the attack scenario.
The message was delivered via SMS text message, which defines the vector as smishing (SMS phishing).
Phishing over cellular text messaging is categorized specifically as smishing, distinguishing it from email-based phishing or voice-based vishing.
2
Analyze the psychological trigger used to compel victim action.
The threat of account suspension within a short two-hour timeframe leverages urgency.
Social engineering attackers use strict time limits to induce panic and force targets to act before consulting technical support or verifying legitimacy.

Key Concept

Social Engineering Attacks and Vectors
Estimated Time:1m 30s
Question 144Question →

Match each infrastructure risk scenario to its corresponding host, network, or architecture vulnerability classification.

Click a left item, then click its matching right item

Items

An enterprise server running an operating system past its vendor End-of-Life (EOL) date without security updates
A network management service transmitting administrative credentials across the local network in unencrypted plain text
A newly deployed network switch operating with factory administrative username and password settings
A corporate network environment designed without VLANs or subnet boundaries between guest users and critical database servers

Matches

Show answer & explanation

Answer

The enterprise server past EOL matches Unsupported software vulnerability; the network management service transmitting plain text credentials matches Cleartext transmission vulnerability; the network switch with factory credentials matches Default configuration vulnerability; and the corporate network without subnets or VLANs matches Architecture / Lack of network segmentation vulnerability.
Each scenario directly illustrates a core infrastructure vulnerability category: operating an unpatched EOL system creates an unsupported software vulnerability; transmitting unencrypted credentials creates a cleartext transmission vulnerability; retaining factory passwords creates a default configuration vulnerability; and placing all devices on a flat, unsegmented network creates an architecture vulnerability.

Step-by-Step Solution

1
Analyze host-level system lifecycle status
Identify that running software beyond vendor support end date leaves unpatched flaws exposed
Systems past EOL represent unsupported software vulnerabilities.
2
Analyze network protocol transmission behavior
Identify that transmitting sensitive administrative data without cryptographic protection allows packet sniffing
Unencrypted traffic constitutes a cleartext transmission vulnerability.
3
Evaluate system configuration hardening
Identify that active factory credentials on network hardware enable easy unauthorized initial access
Using factory settings creates a default configuration vulnerability.
4
Evaluate network topology and boundaries
Identify that missing subnets or logical isolation allow unrestricted network traffic between low-trust guests and high-trust servers
A flat network lacking isolation represents an architecture vulnerability.

Key Concept

Host, Network, and Architecture Vulnerabilities
Question 145Question →

Match each vulnerability assessment and security testing method to its corresponding operational characteristic.

Click a left item, then click its matching right item

Items

Credentialed Vulnerability Scanning
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Passive Network Vulnerability Monitoring

Matches

Show answer & explanation

Answer

Credentialed Scanning pairs with direct host queries using administrative rights; SAST pairs with non-execution analysis of source code; DAST pairs with external black-box testing of running applications; Passive Monitoring pairs with analyzing mirrored packet flows without active probes.
Each security assessment method maps directly to its core function: credentialed scanning uses administrative access for host audits; SAST analyzes uncompiled/static code; DAST tests executing web apps; and passive network monitoring analyzes mirrored traffic safely.

Step-by-Step Solution

1
Identify the operation mode of Credentialed Vulnerability Scanning.
It logs into host operating systems using administrative credentials to check patch levels.
Authenticating directly to target hosts yields internal configuration visibility without relying on network probing.
2
Distinguish SAST from DAST based on application execution status.
SAST checks static code prior to deployment, while DAST tests live, running web applications.
SAST identifies code-level security issues before execution, whereas DAST uncovers runtime configuration and input handling weaknesses.
3
Differentiate passive monitoring from active vulnerability scanning.
Passive monitoring relies on mirrored network telemetry without generating active probe traffic.
Observing traffic non-intrusively protects sensitive environments (such as OT/ICS) from network-induced destabilization.

Key Concept

Selecting appropriate vulnerability testing methodologies based on execution state, authentication level, and operational impact risk.
Question 146Question →

Match each technical telemetry scenario with its corresponding malware classification based on the observed indicators of compromise.

Click a left item, then click its matching right item

Items

PowerShell executing with `-EncodedCommand` and `-NoProfile` parameters, fetching payload instructions directly into volatile memory without writing binaries to local storage.
Ring 0 kernel driver execution that modifies Direct Kernel Object Manipulation (DKOM) structures to hide process IDs and files from system management utilities.
A database script scheduled to run a destructive query automatically 30 days after a specific employee account is set to inactive status in the directory.
Automated network telemetry showing a workstation self-propagating across port 445 to adjacent subnets without requiring human interaction.

Matches

Show answer & explanation

Answer

PowerShell memory-only execution matches Fileless Malware; Ring 0 DKOM manipulation matches Rootkit; Conditional script trigger matches Logic Bomb; Autonomous self-propagation matches Worm.
The paired classifications accurately reflect the technical behavior of each malware category: memory-only PowerShell execution represents fileless malware, Ring 0 DKOM manipulation represents a rootkit, conditional payload execution represents a logic bomb, and autonomous SMB scanning represents a worm.

Step-by-Step Solution

1
Analyze the technical indicators in each scenario.
Identified volatile memory execution, kernel-level cloaking, triggered execution, and autonomous network propagation.
Differentiating malware types relies on analyzing execution mechanics, persistence mechanisms, and propagation behavior.
2
Map execution mechanics to malware definitions.
Living-off-the-land memory execution aligns with fileless malware, while Ring 0 system cloaking maps to rootkits.
Fileless malware minimizes disk footprint; rootkits conceal artifacts by altering low-level OS operations.
3
Map trigger conditions and propagation characteristics.
Status-triggered malicious scripts map to logic bombs; self-directed SMB scanning maps to worms.
Logic bombs rely on specific logical triggers, whereas worms actively scan and infect network targets independently.

Key Concept

Malware Types and Indicators of Compromise
Question 147Question →

Match each threat actor profile to the primary attribute combination and attack strategy that most accurately characterizes their operations.

Click a left item, then click its matching right item

Items

Nation-state adversary
Hacktivist collective
Disgruntled insider
Organized crime syndicate

Matches

Show answer & explanation

Answer

Nation-state adversaries correspond to extensive funding, high sophistication, and geopolitical espionage goals. Hacktivist collectives match ideological motivation with public-facing attacks like DDoS and defacement. Disgruntled insiders possess internal credentials and act out of grievance or financial incentive. Organized crime syndicates deploy profit-driven ransomware operations with high capabilities.
Each threat actor type possesses distinct attributes: nation-states focus on strategic state-sponsored espionage with custom vectors; hacktivists aim for public awareness using disruption tactics; insiders utilize legitimate credentials for malicious exfiltration; and organized crime syndicates operate as sophisticated financial enterprises.

Step-by-Step Solution

1
Analyze the motivation, funding, and sophistication of nation-state actors.
Identified geopolitical espionage, high funding, stealth, and supply chain vectors.
Nation-states focus on long-term intelligence gathering backed by state resources.
2
Evaluate the primary drivers and vectors of hacktivist groups.
Matched to political/social ideology and high-visibility disruption tactics like DDoS.
Hacktivists seek publicity for their cause rather than covert intelligence or monetary gain.
3
Differentiate insider threats from external actors.
Matched to internal access capabilities and grievance-driven exfiltration.
Insiders exploit preexisting legitimate privileges to bypass perimeter controls.
4
Identify the core attributes of organized cybercrime syndicates.
Matched to monetary profit targets and ransomware extortion models.
Organized crime prioritizes financial returns over political or strategic objectives.

Key Concept

Threat Actor Profiling and Attributes
Question 148Question →

A security analyst conducts a comprehensive infrastructure security assessment across enterprise systems. Match each security assessment finding to its corresponding host, network, or architecture vulnerability classification.

Click a left item, then click its matching right item

Items

A containerized application process escapes its isolation boundary and accesses raw host operating system memory through a shared kernel vulnerability.
An internal management server exposes dynamic RPC endpoints across all network interfaces without authentication or access controls.
An edge security appliance firmware image utilizes static, vendor-hardcoded private cryptographic keys across all customer deployments.
An administrative web portal transmits session tokens in HTTP request headers over an unsegmented internal local area network.

Matches

Show answer & explanation

Answer

Container process namespace escape matches Host Operating System Isolation Vulnerability. Dynamic open RPC endpoint exposure matches Unauthenticated Network Service Exposure. Hardcoded firmware private keys match Embedded System Credential Flaw. Cleartext HTTP session transmission over flat subnets matches Cleartext Protocol Architecture Weakness.
Each security assessment finding maps directly to its specific vulnerability domain: kernel namespace breakouts represent host isolation flaws, open RPC management interfaces represent unauthenticated service exposure, hardcoded embedded keys represent firmware credential weaknesses, and HTTP session token transmission across unsegmented subnets represents cleartext protocol architecture weaknesses.

Step-by-Step Solution

1
Analyze host-level virtualization and container runtime security boundaries.
Determine that escaping container boundaries to access host memory breaks host kernel isolation.
Containers share the host operating system kernel, so kernel exploits compromise host isolation.
2
Evaluate network service configurations and access control policies.
Identify that unauthenticated RPC listener endpoints expose critical infrastructure interfaces to arbitrary network clients.
Exposing internal management services without authentication allows unauthenticated remote execution.
3
Inspect embedded hardware firmware key management implementation.
Classify static private keys burned into firmware images as embedded device credential flaws.
Shared hardcoded keys allow attackers to intercept traffic or impersonate any deployed hardware unit.
4
Review network protocol encryption and network segmentation controls.
Link unencrypted HTTP session token transit on unsegmented subnets to cleartext protocol architecture weaknesses.
Lack of transport-layer security combined with flat network topology permits credential sniffing by adjacent hosts.

Key Concept

Host, Network, and Architecture Vulnerabilities
Question 149Question →

A security analyst is reviewing telemetry logs and incident report artifacts following a series of network anomalies. Match each observed technical telemetry artifact on the left with its corresponding malware classification on the right.

Click a left item, then click its matching right item

Items

Execution of obfuscated PowerShell scripts pulling payloads directly into host RAM via WMI repository subscriptions without creating disk binaries
Modification of the Volume Boot Record (VBR) to execute malicious code prior to operating system kernel initialization
A database trigger configured to execute a destructive SQL script automatically when a specific user ID is purged from the HR database
An unexpected outbound C2 encrypted session established by svchost.exe spawned directly as a child process of winword.exe

Matches

Show answer & explanation

Answer

Execution of PowerShell via WMI matches Fileless Malware; VBR modification matches Bootkit; HR database deletion trigger matches Logic Bomb; Word spawning svchost for C2 matches Remote Access Trojan (RAT).
Each telemetry artifact distinctly maps to its underlying malware mechanism: in-memory execution via system binaries matches fileless malware; boot sector modification prior to OS load matches bootkit persistence; event-triggered malicious payloads represent logic bombs; and process tree anomalies establishing remote command channels indicate Remote Access Trojans.

Step-by-Step Solution

1
Analyze memory and file system artifacts
In-memory execution of obfuscated scripts via native tools (WMI/PowerShell) indicates Fileless Malware.
Fileless malware avoids traditional disk-based detection by operating exclusively in volatile memory.
2
Evaluate boot sequence persistence mechanisms
Pre-boot code execution altering the Volume Boot Record indicates a Bootkit.
Bootkits target the storage system's boot sectors to gain control before operating system security controls initiate.
3
Examine event-driven triggers
Code scheduled to run upon HR database user purging matches a Logic Bomb.
Logic bombs lie dormant until specific environmental conditions or administrative events execute the payload.
4
Analyze process tree lineage and network behavior
Productivity software spawning system host processes that initiate outbound command-and-control traffic matches a Remote Access Trojan (RAT).
RATs typically leverage process hollowing or malicious process spawn techniques to conceal C2 communications.

Key Concept

Malware Telemetry and Indicator Classification
Estimated Time:2m 0s
Question 150Question →

An administrator reviewing host infrastructure discovers an unauthenticated monitoring service running on an internal host inside the enterprise network. The service exposes internal environment variables and process memory to any connected endpoint. The service was left unauthenticated under the assumption that internal network segments are inherently secure. Which of the following vulnerabilities is primarily illustrated in this architecture scenario?

Show answer & explanation

Answer: Over-reliance on perimeter security and lack of host-level access verification

Answer

Over-reliance on perimeter security and lack of host-level access verification
The correct answer identifies over-reliance on perimeter security. Leaving services unauthenticated based on the assumption that internal network traffic is safe exposes host data whenever an attacker gains internal access or pivots across network segments.

Step-by-Step Solution

1
Analyze the reported host architecture vulnerability scenario.
Identified an unauthenticated service exposing host memory to any device on the internal network.
Understanding what resource is exposed and under what access conditions highlights the core weakness.
2
Evaluate the underlying design assumption mentioned in the scenario.
Recognized that reliance on internal network safety without local service authentication reflects legacy perimeter-based trust.
Zero Trust principles dictate continuous verification regardless of network location.

Key Concept

Perimeter Trust Dependence vs. Host-Level Verification
Estimated Time:50s
Question 151Question →

Match each enterprise security incident scenario to the primary social engineering attack vector it exemplifies.

Click a left item, then click its matching right item

Items

An attacker compromises a legitimate, industry-specific news website frequently visited by target organization personnel to deliver drive-by exploit payloads.
An attacker sends highly tailored emails referencing internal project codes and executive names to trick specific financial staff into authorizing wire transfers.
An attacker carrying large packages closely follows an authorized employee through a card-restricted building entrance without presenting access credentials.
An attacker sends fraudulent SMS text messages impersonating corporate IT support to remote staff, directing them to a fake login portal to harvest credentials.

Matches

Show answer & explanation

Answer

The compromised industry news site matches Watering Hole Attack; the tailored executive emails match Spear Phishing; following an employee through a secure doorway matches Tailgating; and the fake IT support text messages match Smishing.
Each incident scenario aligns with a specific vector: Watering Hole attacks infect third-party websites commonly visited by target groups; Spear Phishing uses customized digital messages targeted at specific organizational roles; Tailgating exploits human politeness to breach physical entry points; and Smishing uses mobile SMS messaging to deceive targets.

Step-by-Step Solution

1
Analyze Scenario 1 involving the compromise of a trusted third-party website visited by target personnel.
Identified as a Watering Hole Attack because the vector relies on infecting a site known to be frequented by a specific target group.
This strategy avoids direct communication with targets and exploits implicit trust in external resources.
2
Analyze Scenario 2 involving customized emails sent to specific financial personnel with confidential internal context.
Identified as Spear Phishing because it targets specific individuals using recon-derived information.
Unlike bulk phishing, spear phishing relies on targeted context to increase credibility.
3
Analyze Scenario 3 involving physical entry behind an authorized employee carrying packages.
Identified as Tailgating, a physical social engineering method.
The attacker relies on social courtesy and physical distraction to bypass physical access controls.
4
Analyze Scenario 4 involving fake IT support messages delivered to mobile phones via SMS.
Identified as Smishing (SMS Phishing).
Smishing specifically uses cellular text messaging services to deliver phishing lures.

Key Concept

Classification of Social Engineering Vectors and Tactical Indicators
Question 152Question →

An enterprise Endpoint Detection and Response (EDR) agent raises a high-severity security alert on a database server. Inspection reveals a legitimate Windows system process, `svchost.exe`, executing inline PowerShell commands using encoded arguments directly in system memory without writing any executable binaries to disk. System monitoring logs show scheduled tasks calling WMI repositories to maintain execution across system reboots. Which of the following malware classifications is demonstrated by these indicators of compromise?

Show answer & explanation

Answer: Fileless malware

Answer

The telemetry describes fileless malware because it operates in volatile memory (RAM) utilizing legitimate system tools without dropping traditional malicious binaries onto the host disk storage.
Fileless malware relies on living-off-the-land techniques by hijacking legitimate system binaries (such as PowerShell and WMI) and running payloads directly inside volatile RAM memory, leaving no traditional payload file footprint on the filesystem disk.

Step-by-Step Solution

1
Analyze execution mechanism telemetry
Identified PowerShell executing encoded payloads directly in volatile system memory.
Execution without writing files to local disk storage distinguishes non-traditional execution methods.
2
Evaluate persistence mechanism artifacts
Observed WMI repository calls and scheduled tasks triggering native processes.
Fileless malware leverages 'living-off-the-land' binaries (LotL) and native OS frameworks for persistence.
3
Classify the malware category
Correlated memory-resident execution and native tool misuse into fileless malware.
Combining RAM-only operations with native binary abuse matches the core technical definition of fileless attacks.

Key Concept

Fileless Malware and Living-off-the-Land (LotL) Execution
Question 153Question →

A security technician is preparing to deploy a new server host into an enterprise network. To reduce common host-based vulnerabilities and strengthen the system's baseline security posture, which of the following hardening actions should the technician implement? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Disable unnecessary network ports and unneeded background services; Change default vendor administrative passwords to strong, unique credentials

Answer

Disabling unnecessary network ports and unneeded background services, and changing default vendor administrative passwords to strong, unique credentials.
Hardening host infrastructure requires reducing exposed entry points by closing unused network ports/services and enforcing proper credential management by removing default passwords.

Step-by-Step Solution

1
Identify effective host-hardening practices that directly minimize host vulnerability.
Disabling unneeded ports/services minimizes entry points for potential exploits.
Host attack surface reduction is a foundational security baseline practice.
2
Evaluate default account configuration management on new systems.
Changing default credentials prevents known administrative password exploitation.
Default credentials are widely documented and actively targeted by malicious actors.

Key Concept

Host Hardening and Attack Surface Reduction
Question 154Question →

A financial clearing house experiences a silent, prolonged intrusion where an adversary maintained persistence for nine months without disrupting operations or attempting immediate data exfiltration. Threat intelligence analysts discover custom-compiled memory-only implants, specialized zero-day exploits targeting perimeter security appliances, and detailed reconnaissance focused on critical national infrastructure dependencies. Which of the following threat actor types and attribute profiles most accurately characterizes this adversary?

Show answer & explanation

Answer: A nation-state threat actor operating with high sophistication, extensive funding, and a focus on long-term strategic intelligence gathering

Answer

A nation-state threat actor operating with high sophistication, extensive funding, and a focus on long-term strategic intelligence gathering.
The combination of zero-day exploits, multi-month undetected persistence, custom memory-only malware, and targeting critical national infrastructure dependencies directly aligns with the intent, sophistication, and funding of a nation-state Advanced Persistent Threat (APT) actor.

Step-by-Step Solution

1
Analyze the operational objective and timeline described in the scenario
The adversary maintained nine months of undetected persistence focused on mapping critical national infrastructure without data exfiltration or operational disruption.
Espionage and long-term strategic intelligence gathering are hallmarks of nation-state Advanced Persistent Threats (APTs), contrasting with financially motivated or disruptive actors.
2
Evaluate the technical sophistication and attack vector
The attack utilized zero-day perimeter exploits and custom memory-only implants.
Zero-day vulnerability discovery and custom weaponization require significant funding, advanced research capabilities, and high technical sophistication typical of state-backed entities.
3
Synthesize attributes to determine threat actor classification
High sophistication, strategic intent, state-level funding, and persistent access align exclusively with a nation-state actor profile.
Other threat actor types (organized crime, insiders, hacktivists) exhibit different primary motivations and lower levels of capital-intensive capability.

Key Concept

Threat Actor Attributes, Motivations, and Capabilities
Question 155Question →

During a threat hunting exercise, a security analyst reviews network logs from a Kubernetes host node running enterprise microservices. The log entries indicate that a compromised container instance successfully issued a request to extract infrastructure credentials:

[2026-07-20 09:14:02 UTC] TCP 10.244.1.45:49152 -> 169.254.169.254:80 GET /latest/meta-data/iam/security-credentials/node-role HTTP/1.1
[2026-07-20 09:14:02 UTC] HTTP 200 OK (Content-Length: 1248, IAM Role: NodeInstanceRole)
[2026-07-20 09:14:15 UTC] AWS STS API call initiated directly from container IP 10.244.1.45 using retrieved token

Which host and architecture vulnerability is the root cause of this credential exposure?

Show answer & explanation

Answer: Reliance on Instance Metadata Service Version 1 (IMDSv1) without session tokens, combined with unrestricted container access to the host link-local metadata endpoint

Answer

Reliance on Instance Metadata Service Version 1 (IMDSv1) without session tokens, combined with unrestricted container access to the host link-local metadata endpoint
The root cause vulnerability is the reliance on Instance Metadata Service Version 1 (IMDSv1), which processes unauthenticated HTTP GET requests for cloud node IAM credentials, paired with a lack of host network namespace isolation for container workloads. Because IMDSv1 does not require session tokens (unlike IMDSv2), any process or container with access to the link-local IP 169.254.169.254 can extract the host's IAM role credentials and assume those privileges.

Step-by-Step Solution

1
Analyze the log entry to identify the targeted IP address and request method
The container IP (10.244.1.45) made a plain HTTP GET request to 169.254.169.254 targeting security credentials.
The IP address 169.254.169.254 is a standard link-local address used in cloud infrastructure to host the Instance Metadata Service (IMDS).
2
Determine the vulnerability inherent in the request design
IMDSv1 responds to basic HTTP GET requests without requiring session tokens or pre-authentication.
Because IMDSv1 does not enforce token-based headers (introduced in IMDSv2) or hop-limit restrictions, microservices sharing the host network namespace can freely extract node IAM privileges.
3
Identify the primary architectural root cause
The combination of unauthenticated IMDSv1 endpoints and lack of pod egress isolation allowed credential theft.
Enforcing IMDSv2 and restricting access to 169.254.169.254 via network policies mitigates this cloud host vulnerability.

Key Concept

Cloud Host Instance Metadata Service Vulnerabilities (IMDSv1 vs IMDSv2) and Workload Egress Isolation
Question 156Question →

A system administrator at a retail organization notices automated scans targeting the company's public web server using off-the-shelf, publicly available exploit toolkits. The activity demonstrates minimal technical expertise and relies entirely on well-known vulnerabilities without using custom tools or zero-day exploits. Which threat actor type is most likely responsible for this activity?

Show answer & explanation

Answer: Script kiddie

Answer

Script kiddie
The term 'script kiddie' refers to an attacker who uses existing, publicly available tools and automated scripts created by others due to a lack of deep technical capability to develop original exploits.

Step-by-Step Solution

1
Analyze the threat actor attributes described in the scenario
Identified minimal technical sophistication, reliance on off-the-shelf tools, and lack of custom exploits
Evaluating key adversary traits allows proper classification of the threat actor type
2
Map the identified attributes to threat actor profiles
Script kiddies uniquely match the profile of using existing scripts without deep technical expertise
Distinguishing actor capability levels is essential for accurate security threat assessment

Key Concept

Threat Actor Attributes and Sophistication Levels
Question 157Question →

A security analyst at a healthcare technology firm is investigating a network intrusion. Analysis reveals that an external group gained access through a zero-day vulnerability in an edge device, established undetected long-term persistence for over nine months, and specifically targeted proprietary medical diagnostic algorithms. The adversary did not deploy ransomware, make extortion demands, or disrupt operations. Which threat actor type and attribute profile is most likely responsible for this attack?

Show answer & explanation

Answer: Nation-state threat actor possessing high technical sophistication, extensive financial resources, and espionage-driven intent.

Answer

Nation-state threat actor possessing high technical sophistication, extensive financial resources, and espionage-driven intent.
The scenario describes an Advanced Persistent Threat (APT) profile characteristic of a nation-state threat actor. Key indicators include significant financial backing, high technical sophistication (utilizing zero-day vulnerabilities), covert long-term persistence (nine months), and targeted exfiltration of intellectual property (diagnostic algorithms) for strategic gain rather than immediate financial extortion.

Step-by-Step Solution

1
Analyze the adversary's capability and attack vector indicators.
The use of an unpatched zero-day vulnerability and undetected nine-month persistence demonstrates advanced technical capability, high sophistication, and deep funding.
Acquiring or developing zero-day exploits and maintaining long-term stealth require substantial resources.
2
Evaluate the adversary's primary intent and motivation.
The targeted exfiltration of proprietary diagnostic algorithms without ransom demands or operational destruction indicates corporate or state espionage.
Financial threat actors (e.g., cybercriminals) monetise intrusions rapidly via ransom demands, whereas nation-state actors focus on strategic value and intellectual property.
3
Correlate attributes to threat actor taxonomy profiles.
High sophistication + high funding + long-term stealth + espionage intent = Nation-state (APT).
These specific attributes align directly with nation-state actor profiles.

Key Concept

Threat Actor Classifications, Motivations, and Sophistication Attributes
Question 158Question →

A security technician reviews a vulnerability scanner report for an unpatchable host operating critical legacy services:

`[WARN] Host 10.0.4.15 (Legacy_SCADA_GW): Outdated SSLv3 enabled on port 443`
`[WARN] Host 10.0.4.15 (Legacy_SCADA_GW): Active unencrypted Telnet service detected on port 23`
`[INFO] Host 10.0.4.15 shares a flat Layer 2 broadcast domain with 150 user workstations.`

Because replacing or patching the legacy system would interrupt critical operations, which of the following is the MOST effective architectural control to mitigate network-based exploitation of these host vulnerabilities?

Show answer & explanation

Answer: Implement microsegmentation to place the legacy host in an isolated VLAN with restricted jump box access controls.

Answer

Implementing microsegmentation and isolating the host within a restricted VLAN via a secure jump box is the most effective architectural mitigation.
Microsegmentation compensates for unpatchable host vulnerabilities by placing the vulnerable device in an isolated VLAN and restricting network access strictly to authenticated administrative jump hosts. This prevents lateral attack traffic within the internal broadcast domain.

Step-by-Step Solution

1
Analyze host constraints and vulnerability findings.
The target system runs unencrypted/legacy services (Telnet, SSLv3) on an unpatchable host situated in a flat broadcast domain alongside internal workstations.
Host-level software changes or patches are not viable due to legacy system stability requirements.
2
Evaluate control types and architectural boundary requirements.
Network microsegmentation creates a secure boundary around legacy infrastructure, limiting exposure over open ports to authorized jump hosts only.
Isolation compensates for host-level vulnerabilities by blocking unauthorized network paths without modifying the host OS.

Key Concept

Compensating Controls for Legacy Infrastructure Vulnerabilities
Question 159Question →

A security analyst inspecting web application access logs discovers the following HTTP POST request payload targeting an enterprise search endpoint:

`POST /api/v1/products/search HTTP/1.1`
`Host: portal.example.com`
`Content-Type: application/x-www-form-urlencoded`
`Payload: item_query=gadget' UNION SELECT credit_card_num, CVV FROM customer_payment_data WHERE '1'='1`

Which of the following vulnerabilities is being exploited in this scenario, and what is the primary application-level mitigation control required to prevent it?

Show answer & explanation

Answer: SQL injection; mitigated primarily by implementing parameterized database queries and prepared statements.

Answer

SQL injection; mitigated primarily by implementing parameterized database queries and prepared statements.
The HTTP payload contains classic SQL injection syntax, specifically using single quotes to break out of data context and `UNION SELECT` to retrieve data from sensitive database tables (`customer_payment_data`). The definitive mitigation for SQL injection is adopting parameterized queries (prepared statements), which separate user data from SQL command logic at the application layer.

Step-by-Step Solution

1
Analyze the log payload syntax
Identified database manipulation keywords (`UNION SELECT`), string terminator (`'`), and boolean evaluation (`'1'='1`).
Determines the specific class of application vulnerability (SQL Injection).
2
Differentiate SQL injection from client-side or authorization flaws
Confirmed payload targets backend relational database tables (`customer_payment_data`), ruling out XSS or IDOR.
Prevents misdiagnosis of vulnerability types.
3
Evaluate appropriate remediation control layer
Selected parameterized queries/prepared statements as the effective software control rather than network-level firewalls.
Ensures remediation acts on application code where input interpretation occurs.

Key Concept

Application SQL Injection Identification and Parameterized Query Mitigation
Estimated Time:2m 0s
Question 160Question →

A forensic analyst investigating an unexpected data wipe on a critical financial server discovers an obfuscated script embedded within a routine system backup routine. The script performs no malicious activity during normal execution; however, it regularly queries the enterprise LDAP directory. Inspection reveals that if a specific senior database administrator's account status transitions to 'Inactive' or 'Disabled', the script triggers an automated payload that executes a multi-pass overwrite of disk sectors and purges transaction logs. Which of the following malware classifications best describes this threat based on its operational behavior?

Show answer & explanation

Answer: Logic bomb

Answer

The threat is classified as a logic bomb because it remains dormant within a legitimate routine until a specific predefined logical condition (an account status change in LDAP) triggers the execution of its destructive payload.
The correct answer identifies the malware as a logic bomb. Logic bombs consist of malicious code snippets embedded into legitimate applications or scripts that lie dormant until a specific condition or event occurs—such as a specific date, time, file creation, or in this case, an administrator's account being marked as disabled in LDAP. Once triggered, the code executes its malicious payload.

Step-by-Step Solution

1
Analyze the observed behavior and persistence mechanism of the embedded script.
Identified that the code runs inside a standard backup routine without causing harm during ordinary system operation.
Establishing baseline execution behavior helps distinguish active background attacks from dormant conditional threats.
2
Evaluate the activation criteria specified within the payload logic.
Determined that payload execution depends directly on the LDAP status change of a targeted administrator account.
Dormancy combined with conditional event-based execution is the defining characteristic of a logical trigger.
3
Correlate the activation mechanism with formal malware definitions.
Concluded that code executing destructive actions exclusively upon reaching a designated logical state matches the classification of a logic bomb.
Differentiating malware by activation vector (propagation vs. masking vs. conditional triggers) yields the precise security classification.

Key Concept

Logic Bomb Identification and Operational Triggers
PreviousPage 8 / 25Next
Threats, Vulnerabilities, and Mitigations Practice Questions — CompTIA Security+ — Page 8 | Examkin