Threats, Vulnerabilities, and Mitigations practice questions

Answer: A) End-of-life system; isolate it on a restricted segment with compensating controls and fund its replacement

An OS that no longer gets vendor security updates is an end-of-life/legacy vulnerability. If it can't be replaced right away, isolate it, apply compensating controls and plan its replacement.

• ACorrect. Once a vendor ends support, new flaws are never patched, so the risk keeps growing. If migration must wait, the standard response is to reduce exposure with network segmentation, strict access control and extra monitoring, and to commit to a replacement plan.
• BIncorrect. A zero-day is a flaw that is unknown or unpatched when it is first exploited. This is a known unsupported state, and the vendor has said it won't release more security updates, so waiting for a fix leaves the server exposed.
• CIncorrect. The scanner is correct. The OS really is unsupported, and passing earlier scans doesn't protect it from flaws found after updates stopped.
• DIncorrect. Hardening reduces the attack surface but can't fix code flaws that the vendor will never patch. The root cause is lack of vendor support, not a configuration setting.

Answer: A) Configuration enforcement

• AAutomated tools detect and correct drift, keeping systems on the approved baseline.
• BMasking hides parts of data values.
• CDecommissioning retires systems, not their configuration drift.
• DSteganography hides data inside other content.

Answer: A) Throttling or temporarily locking out repeated failed sign-ins, plus MFA

Online brute-force and password spraying are best countered by limiting failed attempts (lockout, throttling, rate limiting) and requiring MFA. Hashing, password expiration and TLS address other threats.

• ACorrect. Lockout and throttling slow online guessing. MFA means a correctly guessed password isn't enough to sign in on its own. Microsoft's smart lockout, for example, locks accounts after repeated failures and increases the lockout time on later failures.
• BIncorrect. Salted slow hashing protects stolen hash databases from offline cracking. It doesn't limit how many guesses an attacker can submit to the live login form.
• CIncorrect. Forced expiration doesn't limit guessing attempts. Spraying works by trying common passwords, which users often pick again when forced to rotate.
• DIncorrect. TLS and HSTS protect credentials in transit from interception and downgrade attacks. They don't stop an attacker from submitting many guesses over a valid encrypted connection.

Answer: A) Use 802.1X/EAP and have clients validate the RADIUS server certificate

An evil twin is defeated by mutual authentication. When clients validate the RADIUS server's certificate under 802.1X/EAP, a rogue AP cannot impersonate the network. Hiding the SSID, MAC filtering and a shared PSK do not authenticate the AP to the client.

• AWith server certificate validation, the client checks that the authentication server presents a certificate issued by a trusted CA. A rogue AP cannot present that certificate, so the client refuses to complete authentication.
• BHidden SSIDs still appear in probe requests and responses, so they are easy to discover. An attacker can still broadcast the same name.
• CMAC filtering limits which clients can join the real APs. It does nothing to stop clients from joining an attacker's AP, and MAC addresses are easy to spoof.
• DEveryone who knows a pre-shared key can use it, and it does not prove which AP the client is talking to. Anyone with the key, such as an insider or someone who obtained it, can run an evil twin that clients will accept.

Answer: A) Business email compromise

Impersonating an executive by email to get an employee to send a fraudulent wire transfer is business email compromise (CEO fraud). Pharming, watering-hole attacks and vishing use different methods or channels.

• ABEC spoofs or takes over a trusted sender's email, such as an executive, to trick staff into sending money by wire transfer or similar payments. That matches the scenario exactly.
• BPharming sends victims to a fraudulent website by poisoning DNS or hosts-file entries. No redirection is involved here, only a fake email asking for a payment.
• CA watering-hole attack compromises a website the target group often visits so that visitors get infected. It does not involve an impersonated executive email asking for a transfer.
• DVishing is social engineering by voice or phone call. This attack happens entirely by email.

Answer: A) Memory injection

• AMemory (DLL or process) injection places code inside another process's address space to hide and inherit its privileges.
• BA race condition exploits timing between two operations; it doesn't inject code into a process.
• CDirectory traversal manipulates file paths in an application to access unintended files.
• DSide loading installs mobile apps from unofficial sources; it isn't process injection.

Answer: A) Privilege escalation

• AMoving from limited to higher privileges on the same host, by exploiting a flaw or misconfiguration, is privilege escalation.
• BLateral movement is spreading to other hosts, not gaining more rights on the current one.
• CReconnaissance is information gathering before exploitation.
• DExfiltration is stealing data out of the environment.

Answer: A) It's a rogue access point

• AAn unauthorized AP can bypass perimeter controls and give outsiders a path into the internal network.
• BAn evil twin imitates an existing network's name; this AP is an unauthorized addition.
• CThe AP doesn't disable the firewall, but it may bypass it.
• DA personal AP doesn't encrypt other users' traffic.

Answer: A) A finance workstation sending large outbound transfers at evenly spaced intervals to an unfamiliar external IP address around 3 a.m.

Indicators of compromise are deviations from baseline that have no legitimate explanation. Regular, high-volume, off-hours outbound traffic to an unknown external host points to beaconing or exfiltration, while each distractor has a documented benign cause.

• ARegular, evenly timed connections to an unknown external host suggest command-and-control beaconing. Large off-hours outbound volume suggests data exfiltration. Nothing documented explains this traffic, so it should be triaged.
• BThe timing lines up with a known change. Users entering their old, expired passwords explains the spike, so it is an expected side effect and not evidence of a breach.
• CHigh resource use that matches a documented scheduled job is baseline behavior for that window, not an anomaly.
• DA recorded hardware refresh explains the new device. This is an approved change, not an indicator of compromise.

Answer: A) An unsecured wired network

• ALive jacks without port security or 802.1X let anyone connect to the internal network.
• BNo encryption is involved in getting an address from a live jack.
• CBloatware is unnecessary preinstalled software.
• DA logic bomb is malicious code awaiting a trigger.