Domain 2: Threats, Vulnerabilities & Mitigations
15 questions · Instant feedback · 22% of the exam
A technician needs to apply a high-priority patch to a production system. Which of the following steps should be taken first?
Before applying a patch to a production system, it's essential to create a change control request. This documented process ensures that changes are reviewed, approved, and tracked, minimizing potential disruptions to critical systems.
A security administrator receives multiple reports about the same suspicious email. Which of the following is the most likely reason for the malicious email's continued delivery?
If reported phishing emails aren’t fed back into filter configurations, the same messages will continue bypassing defenses. Regularly tuning spam and phishing filters based on incidents is essential to block recurring threats.
Which of the following is a use of CVSS?
The Common Vulnerability Scoring System (CVSS) assigns numeric severity scores to vulnerabilities. Organizations use these scores to rank and prioritize remediation efforts.
A user attempts to visit a company's website but is redirected to a fake login page that looks identical to the legitimate site. Which of the following attacks is the user experiencing?
Pharming redirects users from legitimate websites to fraudulent ones to steal credentials or sensitive information.
Which of the following provides the best protection against unwanted or insecure communications to and from a device?
A host-based firewall enforces network policy directly on the device by filtering inbound and outbound traffic. It prevents unauthorized connections and potential data leaks.
Which of the following would be the best way to handle a critical business application that is running on a legacy server?
Isolation places the legacy system in a separate environment, reducing the risk of a compromised legacy server affecting other systems on the network.
A forensic engineer determines that the root cause of a compromise is a SQL injection attack. Which of the following should the engineer review to identify the command used by the threat actor?
Application logs record the SQL statements executed by the application, capturing queries and parameters. By reviewing these logs, the engineer can pinpoint the exact malicious commands injected by the attacker.
A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most difficult to remediate due to the company's reliance on open-source libraries?
Zero-day vulnerabilities in open-source libraries are particularly difficult to remediate because they can be present before a patch or fix is available.
An administrator discovers that some files on a database server were recently encrypted. The administrator sees from the security logs that the data was last accessed by a domain user. Which of the following best describes the type of attack that occurred?
An insider threat occurs when someone with legitimate access to a system misuses their privileges. In this case, the domain user encrypted the files, making it an insider threat.
A company's online shopping website became unusable shortly after midnight on January 30, 2023. When a security analyst reviewed the database server, the analyst noticed the following code used for backing up data: SQL\n\nIF DATE() ='01/30/2023' THEN\n BACKUP DATABASE WebshopOnline TO DISK ='C:\\temp\\backup.bak';\n DROP DATABASE WebshopOnline;\nEND\nWhich of the following should the analyst do next?
The SQL code indicates the possibility of a command injection attack. Reviewing the WAF logs would help identify any such attempts.
A security analyst is reviewing the following logs: 10:00:00 AM] Login rejected - username jsmith - password Spring2023; 10:00:01 AM] Login rejected - username guest - password Spring2023; 10:00:01 AM] Login rejected - username cpolk - password Spring2023; 10:00:02 AM] Login rejected - username fmartin - password Spring2023; 10:00:03 AM] Login rejected - username jsmith - password Spring2023. Which of the following attacks is most likely occurring?
The logs show login attempts with different usernames but the same password ('Spring2023'). This pattern indicates a password spraying attack, where attackers try a common password across multiple accounts to find vulnerable users.
An engineer has ensured that the switches are using the latest OS, the servers have the latest patches, and the endpoints' definitions are up to date. Which of the following will these actions most effectively prevent?
These actions help prevent known exploits by keeping systems up to date with the latest patches and security updates.
Which of the following threat actors would most likely deface the website of a high-profile music group?
Unskilled attackers are the most likely group to deface a website for notoriety, often without advanced skills or resources.
A malicious actor is trying to access sensitive financial information from a company's database by intercepting and reusing log-in credentials. Which of the following attacks is the malicious actor attempting?
The malicious actor is attempting an on-path attack, where they intercept and reuse login credentials to gain unauthorized access.
An unexpected and out-of-character email message from a Chief Executive Officer's corporate account asked an employee to provide financial information and to change the recipient's contact number. Which of the following attack vectors is most likely being used?
Business Email Compromise (BEC) involves attackers spoofing or hijacking executive email accounts to trick employees into fraudulent transactions. This scenario matches a targeted attempt to manipulate payroll or payments.
Quiz Complete!
Domain 2: Threats, Vulnerabilities & Mitigations