Threats, Vulnerabilities, and Mitigations

Match each observed network or wireless technical indicator on the left with its corresponding attack classification on the right.

Match each threat intelligence source classification on the left with its corresponding operational security use case on the right.

During a security assessment of a microservices-based web application, an analyst reviews API traffic logs for the user settings service. The logs show that an authenticated user transmitted an HTTP PATCH request to update their profile information. By adding the property "is_admin": true to the JSON request payload, the user successfully elevated their permissions on the platform because the backend automatically bound the request fields directly to the internal data model. Which of the following best identifies the root cause vulnerability and the most effective developer remediation?

A cybersecurity analyst is establishing an automated intelligence pipeline to ingest threat indicators from external industry peers. The analyst needs a standardized language format to represent attack patterns, indicators of compromise, and threat actor tactics in a structured, machine-readable format, independent of how the data is transmitted across the network. Which of the following standards should the analyst implement for data representation?

During network traffic monitoring, a security administrator observes high volumes of unicast traffic being unexpectedly flooded to every physical port on a managed Layer 2 Ethernet switch. Packet analysis reveals that a single connected workstation is transmitting thousands of Ethernet frames per second, each using a unique, randomized source MAC address. As a result, the switch's Content Addressable Memory (CAM) table has become completely full, forcing the switch to broadcast incoming traffic across all ports in the broadcast domain. Which of the following network attacks is indicated by these observed behaviors?

A security engineer is establishing host-hardening baselines for web servers to mitigate memory corruption and buffer overflow exploits. The engineer must configure controls that randomize memory locations assigned to system processes and mark stack memory regions as non-executable. Which of the following technical mitigations best satisfies these security requirements?

A security software engineer is performing a code audit on an enterprise data processing service written in C. The service reads user-supplied binary data streams containing a length header field ($length$) and a payload array ($data$). During review, the engineer identifies the following code segment used to process incoming data chunks:

c
unsigned short length = get_user_header_length();
char *buffer = (char *)malloc(length + 1);
if (buffer == NULL) return -1;
memcpy(buffer, user_data, length);
buffer[length] = '\0';

Based on this code snippet, which of the following vulnerabilities and security risks are present in this implementation? (Select TWO)

A security analyst is designing an automated threat intelligence integration strategy for an enterprise network. The strategy requires feeds that provide real-time, machine-readable indicators of compromise (IoCs) formatted for direct ingestion into edge firewalls and SIEM systems, as well as trusted sector-specific collaborative threat sharing. Which of the following intelligence sources or delivery mechanisms should the analyst select to meet these specific operational requirements? (Select TWO.)

A security analyst investigates anomalous wireless activity at a corporate branch office. Users report being prompted to re-enter their domain credentials on an unfamiliar web page while connected to the corporate Wi-Fi, and a Wireless Intrusion Prevention System (WIPS) flags abnormal access point behaviors. Which of the following technical indicators specifically point to an active Evil Twin attack performing credential harvesting? Select TWO.

Match each enterprise system hardening practice to the specific security risk or operational vulnerability it is primarily designed to mitigate.

A security analyst reviews a vulnerability assessment report for an enterprise web application that processes uploaded XML documents. The report indicates that the application parser evaluates Document Type Definitions (DTDs) containing external system references and subsequently passes unvalidated XML node content into backend database calls. Which of the following statements accurately identify the security risks present and their appropriate application-level remediations? (Select TWO.)

During an active ransomware campaign impacting healthcare infrastructure, a security analyst at a regional hospital network needs to obtain verified indicators of compromise (IOCs) and threat actor tactics specifically targeting medical equipment. The analyst requires a trust-based, sector-focused intelligence pool that facilitates sanitized peer-to-peer telemetry exchange without exposing internal infrastructure details to commercial third parties. Which intelligence resource is best suited for this operational requirement?

A network administrator receives alerts regarding unauthorized network configuration changes on several enterprise workstations. Inspection of client packet captures reveals that the affected systems received IP configuration leases containing an unexpected primary DNS server address ($10.0.50.254$) and default gateway, originating from an unrecognized device sending unauthorized DHCPACK messages on the local subnet. Which of the following attacks is indicated by these symptoms?

During a security posture review of a enterprise cloud infrastructure, an audit reveals that newly provisioned virtual machine instances frequently drift from established secure configuration baselines over time due to manual administrator modifications and unapproved emergency changes. Which enterprise hardening practice provides the MOST effective mechanism to continuously prevent and remediate host baseline configuration drift across all deployed instances?

An application developer is reviewing security logs following an incident where a backend microservice was compromised. The investigation reveals that an external attacker submitted a base64-encoded serialized object within an HTTP header, triggering execution of arbitrary system commands on the hosting server. Which of the following vulnerabilities was exploited, and what is the most effective code-level remediation to prevent future occurrences?

A security analyst is investigating network and wireless security alerts recorded in an enterprise environment. Match each observed technical attack indicator on the left with its corresponding attack classification on the right.

During a security review of a cloud-hosted feedback portal, an analyst discovers that user comments submitted to the support forum are stored in the application database without sanitization. When an administrator views the support dashboard, script tags embedded inside user comments execute within the administrator's browser session, attempting to transmit session tokens to an external host.

Which of the following correctly identifies the vulnerability type demonstrated in this incident and the most effective code-level remediation?

A security analyst is hardening an enterprise domain environment after an internal audit revealed two critical weaknesses: unauthenticated network hosts can execute anonymous directory queries to enumerate domain user accounts, and internal authentication traffic is susceptible to credential relay attacks. Which of the following mitigation strategies should the analyst implement to address these specific vulnerabilities? (Select TWO.)

A security analyst reviews network traffic captures following reports of credential leakage on an internal subnet. The analyst observes frequent UDP port 5355 multicast traffic where an unauthenticated endpoint rapidly responds to failed host name resolution requests from legitimate clients, prompting those clients to attempt NTLMv2 authentication against the endpoint. Which of the following attack types is most directly indicated by this activity?

Match each enterprise system hardening control to its primary technical mitigation objective.