Domain 2: Threats, Vulnerabilities & Mitigations
15 questions · Instant feedback · 22% of the exam
Malware spread across a company's network after an employee visited a compromised industry blog. Which of the following best describes this type of attack?
A watering-hole attack targets a specific group by infecting websites that are commonly visited by members of that group, allowing malware to spread.
A security analyst is investigating unusual behavior on a web server and discovers that an attacker was able to manipulate the application’s memory at runtime to execute arbitrary code. Which of the following BEST describes this type of attack?
The correct answer is C. Buffer overflow. This attack occurs when an application writes more data to a memory buffer than it can hold, which can overwrite adjacent memory and allow attackers to execute arbitrary code at runtime. It’s a classic and well-known method for memory manipulation during program execution.
An employee installed an application on the wireless network. After investigation, it was found that the application was removed, and the employee is enrolled in re-training. What type of threat is this?
An insider threat refers to a security threat that comes from within the organization, typically from an employee or contractor. In this case, the employee installed an unauthorized application, potentially compromising the network. The response of re-training indicates a preventive measure to mitigate future risks from internal actors.
Which of the following metrics is used to quantify the severity of a vulnerability according to the CVSS? (Select two).
The CVSS uses the environmental score and temporal score to assess the severity of a vulnerability, providing a more accurate risk evaluation.
The Chief Information Security Officer (CISO) wants to add a section to the security training that details social engineering attacks against the company via telephone systems. Which of the following best describes the security topic the CISO wishes to address?
Vishing refers to social engineering attacks that use voice communication, typically over the phone, to manipulate targets.
An employee clicked a link in an email from a payment website that asked the employee to update contact information. The employee entered the log-in information but received a “page not found” error message. Which of the following types of social engineering attacks occurred?
Phishing involves tricking a user into entering personal information on a fraudulent website.
A government official receives a blank envelope containing photos and a note instructing the official to wire a large sum of money by midnight to prevent the photos from being leaked on the internet. Which of the following best describes the threat actor's intent?
This situation describes blackmail, where the threat actor is attempting to coerce the official into paying money to prevent the release of sensitive information.
While a user reviews their email, a host gets infected by malware that came from an external hard drive plugged into the host. The malware steals all the user's credentials stored in the browser. Which of the following training topics should the user review to prevent this situation from reoccurring?
Training on safe use of removable media teaches users about risks of infections from USB drives. It emphasizes scanning and policy compliance before connecting external devices.
An important patch for a critical application has just been released, and a systems administrator is identifying all of the systems requiring the patch. Which of the following must be maintained in order to ensure that all systems requiring the patch are updated?
An asset inventory is a comprehensive list of all hardware and software assets within an organization. Maintaining an up-to-date asset inventory is crucial for patch management, as it allows the administrator to quickly identify all systems running the critical application that requires patching.
Which of the following is an advantage of a microservice-based architecture over traditional software architectures?
Microservices allow each component to be deployed and updated independently, enabling rapid patches—sometimes multiple times a day—without redeploying the entire application. This agility helps address security issues quickly and reduces downtime.
An organization's web servers host an online ordering system. The organization discovers that the servers are vulnerable to a malicious JavaScript injection, which could allow attackers to access customer payment information. Which of the following mitigation strategies would be most effective for preventing an attack on the organization's web servers? (Choose two.)
Regularly updating software and using a web-application firewall are effective strategies for mitigating JavaScript injection attacks.
Which of the following is a type of vulnerability that involves inserting scripts into web-based applications in order to take control of the client’s web browser?
Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by users. These scripts can hijack sessions, steal cookies, or manipulate page content.
An organization is requesting a third-party full-scope analysis of its supply chain. Which of the following would the analysis team use to meet this requirement?
An illumination tool provides visibility into the entire supply chain by mapping dependencies, vendors, and software components. It helps third parties analyze and assess supply chain risks.
Which of the following should a systems administrator use to decrease the company’s hardware attack surface?
Virtualization abstracts physical hardware, allowing multiple VMs on fewer hosts and reducing the exposed physical surface. It simplifies patching and limits direct hardware access.
A systems administrator is concerned about vulnerabilities within cloud computing instances. Which of the following is most important for the administrator to consider when architecting a cloud computing environment?
VM escape allows attackers to break out of a virtual machine and compromise the host system, making it a key concern in cloud computing.
Quiz Complete!
Domain 2: Threats, Vulnerabilities & Mitigations