Threats, Vulnerabilities, and Mitigations

A security technician is reviewing Wireless Intrusion Prevention System (WIPS) alerts after several wireless industrial sensors lost connectivity simultaneously. The WIPS telemetry reveals a sudden, sustained rise in the physical RF noise floor to $-50\text{ dBm}$ across all channels in the $2.4\text{ GHz}$ spectrum, resulting in a severely degraded Signal-to-Noise Ratio (SNR) and a high rate of corrupted frame retransmissions. Which of the following wireless attacks is indicated by these metrics?

A lead security analyst at a financial enterprise is optimizing the organization's security operations center (SOC) workflows. The analyst requires an external threat intelligence source that provides professionally verified, machine-readable technical Indicators of Compromise (IoCs)—such as malicious IP addresses, domain names, and file hashes—updated in real time for direct automated ingestion into their SIEM. Which of the following threat intelligence sources best satisfies these requirements?

A security operations team at a commercial enterprise needs to proactively monitor illicit underground marketplaces and non-indexed digital forums for stolen employee credentials and compromised API keys. Which threat intelligence source type best fulfills this requirement?

A security auditor is examining backend service logs following an unauthorized access report on a cloud microservice. The auditor observes two distinct request patterns:

1. `GET /documents/download?path=../../../../etc/shadow` returning HTTP `200 OK` along with system credential hashes.
2. `PUT /api/v1/profile` with payload `{"username": "jdoe", "is_admin": true}` resulting in a regular user successfully assigning themselves administrator rights.

Based on these findings, which of the following software vulnerabilities are present in the application? (Select TWO.)

A security analyst is hardening administrative workstations used by system engineers to manage enterprise infrastructure. Security monitoring reveals that attackers frequently attempt to execute unauthorized scripts and portable binaries directly from user temporary directories such as `%TEMP%` and `%APPDATA%`. Which mitigation strategy best prevents the execution of these unapproved binaries while maintaining administrative functionality?

During a security audit of a cloud-hosted web application, an analyst reviews HTTP traffic for a feature that imports custom user avatars from external URLs. The logs show an HTTP request to the endpoint `/api/v1/fetch-avatar?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/`. The application returned secret access keys for the underlying cloud server instance to an unauthenticated remote user. Which of the following vulnerabilities was exploited, and what is the primary developer-side remediation?

Match each observed network or wireless technical indicator on the left to its corresponding attack classification on the right.

Match each threat intelligence source classification on the left with its primary enterprise operational use case on the right.

An enterprise security team is defining enterprise hardening requirements for a fleet of Linux-based edge compute gateways deployed at remote industrial facilities. A recent security audit highlighted two critical vulnerabilities: field technicians currently perform local configuration updates using a shared administrative account, and automated firmware updates are downloaded over unencrypted channels without integrity verification. Which TWO of the following mitigation controls should the team implement to directly address these findings?

During a security assessment of a web application's user search module, an analyst inspects the backend implementation and observes two main security weaknesses:
1. User input from the search query parameter is directly concatenated into a dynamic database command string without prior validation or parameterization.
2. The raw search input is included verbatim in the application's HTML response page to display the search term without sanitization or output encoding.

Which of the following application vulnerabilities are present in this module? (Select TWO.)

An incident response team discovers that an attacker uploaded a malicious script disguised as an image file to a public web application's uploads directory. The web server process subsequently executed the script, providing the attacker with an interactive remote command shell. Investigation reveals that the file upload folder resides on a standard file system volume where the web daemon user account has both write and execute permissions. Which of the following host hardening practices is the MOST effective mitigation strategy to prevent web shell execution from this directory?

A security operations team is configuring an automated threat intelligence pipeline to enrich SIEM alerts and dynamically update perimeter firewall defense rules with real-time indicators of compromise and vulnerability data. Which of the following sources or protocols should the team integrate to achieve structured, machine-readable threat sharing and standardized vulnerability context? (Select TWO.)

During a security audit of an enterprise network management tool, an analyst reviews source code responsible for diagnostic ping tests. The function constructs shell commands using unvalidated user input:

c
char command[256];
sprintf(command, "ping -c 3 %s", user_input);
system(command);

An attacker submits the payload `127.0.0.1 && cat /etc/passwd` into the input field. Which of the following vulnerabilities is present in this application code, and what is the most effective remediation?

A security analyst is investigating internal credential harvesting alerts resulting from unauthorized network traffic interception. The investigation reveals that attackers on the local subnet are capturing user authentication hashes by spoofing responses to unresolvable broadcast requests for local network resources. Which of the following enterprise hardening practices should the security team implement to BEST mitigate this vulnerability?

A security analyst is investigating a service disruption on a C-based legacy network daemon. Examination of the stack memory dump reveals that an incoming request sent a payload exceeding the allocated array bounds, overwriting the adjacent memory locations and altering the function return address to execute injected instructions. Which of the following application vulnerabilities is demonstrated in this scenario?

A security audit of an organization's internal infrastructure reveals two major compliance failures: administrative credentials and configuration data are being transmitted in cleartext across management subnets, and active administrative sessions on management consoles remain authenticated indefinitely without user activity. Which of the following enterprise hardening practices should the security team implement to directly address these findings? (Select TWO.)

A network engineer is investigating security alerts after several host systems on an enterprise subnet unexpectedly autoconfigured IPv6 address interfaces and began routing outbound network traffic through an unknown link-local address. Which of the following technical indicators directly confirm that a Rogue IPv6 Router Advertisement (RA) attack is taking place? (Select TWO).

A security analyst reviews Wireless Intrusion Detection System (WIDS) logs after users report sudden drops in wireless network connectivity followed by requests to re-enter network credentials. The logs show a rapid burst of IEEE 802.11 broadcast deauthentication frames sent from MAC address 00:11:22:33:44:55, followed immediately by client devices associating with a nearby access point displaying MAC address 00:11:22:33:44:99 that advertises the exact same SSID. Which of the following attack types is most consistent with these technical indicators?

A chief information security officer is preparing an executive risk assessment for the board of directors regarding potential cyber risks associated with an upcoming international expansion. The assessment must focus on high-level adversary motivations, geopolitical threat trends, and overall business risk impact rather than low-level technical indicators such as file hashes or malicious IP addresses. Which classification of threat intelligence is most appropriate for this report?

During a security review of a modern banking web application API, an analyst examines backend request logs and identifies two distinct malicious activity patterns:

1. Requests sent to `/api/v1/profile/upload` include multipart form payload parameters containing filename strings structured as `../../../../etc/passwd`.
2. Requests sent to `/api/v1/statements?account_id=1042` allow authenticated user `1042` to retrieve financial statements belonging to user `1043` simply by changing the `account_id` value in the URL query string.

Which of the following application and software vulnerabilities are directly demonstrated by these log findings? (Select TWO.)