Domain 2: Threats, Vulnerabilities & Mitigations
15 questions · Instant feedback · 22% of the exam
Attackers created a new domain name that looks similar to a popular file-sharing website. Which of the following threat vectors is being used?
Typosquatting is when attackers register domains that closely resemble legitimate ones, hoping users will mistype and visit the fake site. This differs from phishing or brand impersonation because it relies on URL similarity rather than email deception.
A security analyst receives alerts from a web server showing requests such as GET /image?filename=../../../etc/passwd. Which of the following attacks is being attempted?
Directory traversal (path traversal) is an attack where an attacker manipulates input paths to access restricted files outside the intended directory, such as /etc/passwd or /etc/shadow. This bypasses application controls and exposes sensitive system files.
Which of the following is a type of vulnerability that may result from outdated algorithms or keys?
Cryptographic vulnerabilities arise when algorithms or key lengths become weak or deprecated, making them susceptible to attacks. Regularly updating cryptographic standards prevents exploitation of these weaknesses.
A penetration tester enters an office building at the same time as a group of employees despite not having an access badge. Which of the following attack types is the penetration tester performing?
Tailgating occurs when an unauthorized person follows an authorized person into a restricted area without using their own access credentials.
Which of the following is the MOST effective control against tailgating?
A mantrap physically prevents tailgating by allowing only one person to enter at a time, making it the most effective control against this type of physical security breach.
A systems administrator notices that the research and development department is not using the VPN when accessing various cloud-related services and systems. Which of the following scenarios describes this activity?
Shadow IT refers to employees using unauthorized or unapproved technology solutions, such as bypassing security policies to access cloud services.
An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?
Vishing (voice phishing) is a social engineering technique where an attacker impersonates a trusted figure over the phone.
While browsing a web page, a user receives a pop-up with a link telling them to navigate to another site. To which of the following is the site vulnerable?
A pop-up that injects a malicious link into a page is symptomatic of a Cross-Site Scripting (XSS) vulnerability. XSS allows attackers to execute scripts in a user’s browser, potentially leading to phishing or session hijacking. Proper input validation and output encoding are required to prevent these script injections.
Which of the following is a benefit of launching a bug bounty program? (Select 2 Answers)
Bug bounties incentivize external researchers to identify flaws quickly, accelerating vulnerability discovery. Publicly running a bounty program also enhances the organization’s reputation by demonstrating commitment to security.
A new employee logs in to the email system for the first time and notices a banner from human resources about phishing. The employee hovers over a few of the links within the email and discovers that the links do not correspond to links associated with the company. Which of the following attack vectors is most likely being used?
Social engineering involves manipulating individuals to gain access to information or systems. In this case, the phishing email with deceptive links is a form of social engineering, aiming to trick the employee into clicking on malicious links.
An IT team rolls out a new management application with MFA tokens, but a security breach still occurs. Which of the following describes this kind of attack?
Pretexting occurs when attackers create a believable scenario to trick users into disclosing sensitive information or bypassing security controls. Even with MFA, attackers may impersonate trusted roles to deceive users into revealing access details.
Which of the following is a risk of conducting a vulnerability assessment?
One of the main risks of vulnerability assessments is false positives, where the system flags non-existent issues. While they do not indicate real threats, they consume time and resources during investigation and remediation.
A user receives an aggressive text from an unknown sender who is demanding money. Which of the following attacks is this an example of?
Smishing is a form of social engineering delivered via SMS, where attackers use urgent or threatening language to trick victims into sending money or revealing credentials. The aggressive tone and the demand over text clearly classify this as smishing rather than mere scareware or impersonation.
A security analyst is reviewing a log file and finds the following entries: 4624 Logon Success Windows Security Audit Microsoft; 4624 Logon Success Windows Security Audit Microsoft; 4624 Logon Success Windows Security Audit Microsoft; 4625 Logon. Failure Windows Security Audit Microsoft; 4625 Logon Failure Windows security Audit: Microsoft; 4625... Logon failure Windows security >> Microsoft= ens Lbgon. Windows seedrity Bigzoaore 4625 Logon Windows Security Aud: 0 Microsoft; 4626 Logon Failure |5 Windows setyrity < 3 Began Windows. decd:: Logea curity Windows security Hlcroxctt 4625.0 - tegen: Windows security Mitrosott; 4628 Logon Failure Windows security. Which of the following best describes the action captured in this log file?
The log file shows multiple failed login attempts (event ID 4625) followed by a successful login (event ID 4624). This pattern suggests a brute-force attack, where an attacker tries multiple passwords until they successfully gain access.
A security analyst notices an increase of vulnerabilities on workstations after deploying a group policy. Which of the following is the most likely cause?
The increase in vulnerabilities after applying a group policy suggests that the configuration applied was insecure. This is considered a misconfiguration rather than a new zero-day or a malicious update.
Quiz Complete!
Domain 2: Threats, Vulnerabilities & Mitigations