Cps 391 Quiz 5, CpS 391 Test 1 (CWhich type of threat actor would benefit the most from accessing your enterprise's new machine learning algorithm research and development program?h 1-4)
Which of the following tools allow a mobile device to be managed remotely by an organization and typically involve a server sending out management commands to mobile devices?
MDM
Walter's organization is in the beginning stages of a new project. His team is tasked with finding a tool that must have the following features, allowing it to be remotely managed by the organization:
MDM, because it allows remote management and over the air updates.
Which one of the following is the most appropriate explanation of photoplethysmography?
Measuring heart rate by tracking changes in green light absorption, since human blood absorbs green light
The attacker has determined the names of different types of fields in the database.
Natasha, a network security administrator for an online travel portal, noticed that her website was the victim of an SQL injection. She decided to study the SQL queries to find which one made this vulnerability in the database, and she noticed the following SQL code piece executed on the database: 'whatever' AND email IS NULL; What has been accessed by the attacker running this SQL injection? 1. The attacker has used the SQL injection to delete the table in the database. 2. The attacker accessed the entirety of email address data from all users in the database. 3. The attacker has determined the names of different types of fields in the database. 4. The attacker accessed the data of specific users.
Simon is working in a telecom firm. Being an HOD, he was asked to suggest a lock pattern for their mobile devices with the following features:The device should have a prerecord of its user's walking and other body movement patterns, and on sensing any change in the regular movements, should be able to lock the device.Which lock pattern should Simon suggest?
On-body detection
Spimming
Over the last few days, several employees in your enterprise reported seeing strange messages containing links in their company's IM account. Even though no one has clicked on the messages, they are spreading throughout the network.Which type of malicious activity is this? 1. Spimming 2. Whaling 3. Vishing Spear phishing
Peter is a design engineer at a mobile device manufacturing company. He is designing the core components included in their flagship mobile device being launched during year-end 2020. Peter wants to design a tablet component that would detect vibrations and movements and determine the device's orientation so that the screen image is always displayed upright. Which of the following are materials he should use for developing this component?
Piezoelectric, piezoresistive, and capacitive components
Robert used mimikatz for credential harvesting, and should perform privilege escalation using a high-privileged account next.
Robert is a black box penetration tester who conducted pen testing attacks on all of the network's application servers. He was able to exploit a vulnerability and gain access to the system using a mimikatz tool. Which of the following activities did he perform using mimikatz, and which task should he perform next? 1. Robert used mimikatz for phishing, and should perform lateral movement next. 2. Robert used mimikatz for footprinting, and should install a backdoor next. 3. Robert used mimikatz for tailgating, and should perform phishing next. 4. Robert used mimikatz for credential harvesting, and should perform privilege escalation using a high-privileged account next.
Which of the following sets consists of only the core features of a mobile or computing device?
Small form factor, mobile operating system, wireless data network interface for internet access, app stores, local non-removable data storage
Smitha's computer is compromised by ransomware.
Smitha, an employee working in the accounts department, reported to the information security officer that she could not access her computer. James, the security officer, noticed the following on Smitha's system:On booting the computer, the following message was flashing on the computer screen with the IRS logo:"This computer is locked by the Internal Revenue Service. It has come to our attention that you are transferring funds to other agencies using this computer without compliance with the local income tax laws. As per section 22 of the U.S. Income Tax Act, the transmission of funds without applicable taxes is prohibited. Your IP address is identified in this fraudulent transaction and is locked to prevent further unlawful activities. This offense attracts a penalty of $400.00 for the first offense. You are hereby given 16 hours to resolve this issue, failing which you shall be prosecuted to the full extent of the law. You may make a secure payment by clicking on the following link. If you face any issues, you may reach out to us at [email protected]."The message will not close, nor is there access to applications or files on the computer; however, James can open shared files and folders on Smitha's computer through the network.What is your inference about the problem faced by Smitha on her computer? Correct! 1. Smitha's computer is compromised by ransomware. 2. Smitha's computer is compromised by spyware. 3. Smitha's computer is compromised by cryptomalware. 4. Smitha's computer is compromised by a PUP.
Which of the following are categories of vulnerabilities in mobile device connections that can also be exploited by threat actors?
Tethering, USB-on-the-go (OTG), malicious USB cable, hotspots
Kelly is asked to choose a mobile management tool that provides a single management interface for all applications, content, and device management. Which of the following is the best one-step solution?
Unified environment management (UEM) tool
Difficulty patching firmware
Which issue can arise from security updates and patches? 1. Difficulty resetting passwords 2. Difficulty patching firmware 3. Difficulty installing databases 4. Difficulty updating settings
AIS (Automated indicator sharing)
Which of the following can be used to mitigate a limitation of public sharing centers in OSINT? 1. HTTPS 2. KRI 3. AIS 4. TTP
PCIDSS
Which of the following compliance standards was introduced to provide a minimum degree of security to organizations who handle customer information such as debit card and credit card details daily? 1. FISMA 2. PCIDSS 3. SOX 4. GLB
Legacy
Which of the following computing platforms is highly vulnerable to attacks? 1. Cloud 2. Hybrid 3. Legacy 4. On-premises
In a memory leak attack, the threat actor takes advantage of the programming error of not freeing the memory after executing a process, taking advantage of the device's low memory conditions to attack.
Which of the following describes a memory leak attack? 1. A memory leak occurs when a process attempts to store data beyond a fixed-length storage buffer's boundaries. 2. In a memory leak attack, the threat actor takes advantage of the programming error of not freeing the memory after executing a process, taking advantage of the device's low memory conditions to attack. 3. In a memory leak attack, an attacker changes the variable's value to something outside the range the programmer had intended. 4. Memory leak attacks take advantage of the token generated and sent to the user's browser by the website as part of the authentication.
Photoplethysmography uses which type of light to measure heart rate on a wearable device?
Green
Implement measured boot with UEFI
An organization is planning a revamp of the existing computer hardware with new ones. The IT manager has informed department heads that some computers have faced BIOS attacks in the past. He has requested help in preventing future BIOS attacks. As an expert, which of these solutions can you use to effectively improve boot security when the new computers are implemented in the network? 1. Implement a Norton Antivirus solution 2. Use computers with flash memory for booting instead of BIOS 3. Implement measured boot with UEFI 4. Implement BIOS supplemented with CMOS
Making sure that the OS's security options are deployed, run the antivirus/antispyware on the files downloaded, run the software on HSTS/HTTPS mode, and then send a secure cookie to the server.
A company has approached you for their product testing, and you agree to do it. First, you have to install the necessary plugins for the software through the browser, install the software, and run the software again.What procedure should you adopt to ensure that you don't compromise the browser and the computer's operating system? 1. Make sure that the antivirus/antispyware is run on the plugins, run the software in the sandbox, check the CSP options before running the software, and send a secure cookie to the server. 2. Make sure that the browser's CSP policy is set, then quarantine the software file, then access the software using an active directory, use a sandbox to run the software. 3. Making sure that the OS's security options are deployed, run the antivirus/antispyware on the files downloaded, run the software on HSTS/HTTPS mode, and then send a secure cookie to the server. 4. Deploy the OS securities, check for vulnerabilities in the plugins, quarantine the software before installing, and send a secure cookie to the server.
Checking the dark web
A company has its network compromised. As an expert professional, the organization has hired you to identify the probable cause of the attack and fix it. As a security professional, you have noticed the pattern of compromise is unlike anything previously seen. You are looking to find new information on vulnerabilities like the attack that occurred. Which of the following actions would help achieve this objective? 1. Checking the surface web 2. Checking the dark web 3. Checking the green web 4. Implementing TCP/IP protocol across the network
KRI (key risk indicator)
A company monitors the network activity of the organization and stores the logs in a database. You have been asked to identify whether there are any malicious activities in the network. Which of the following can denote the upper and lower bounds of their various network activities? 1. TTP 2. Threat maps 3. KRI 4. OSI model
Scan the most important devices for as long as it takes for each device
A cyber analyst needs to quickly do a vulnerability scan on an enterprise network with many devices. Which approach should the analyst take? 1. Scan the most important devices for as long as it takes for each device 2. Scan all endpoint devices 3. Scan only infrastructure devices for a very short time 4. Scan all devices, each for a very short time
X-Frame
A cybercriminal attempts to trick a computer's user into sharing their personal information by implementing content to discreetly capture user information over the actual webpage.What should the user implement to avoid this situation? 1. X-XSS 2. HSTS 3. X-Frame 4. CSP
Hacktivists
A federal appeals court recently made a judgment that caused significant public outrage. Soon after the ruling, the court's website was hacked, and the content was replaced with the text "Equal justice for all."Which of the following type of threat actors attacked the court's site? 1. State actors 2. Cyberterrorists 3. Insiders 4. Hacktivists
This is a software keylogger attack, as screenshots, video captures, and keystrokes have been routinely monitored and periodically shared.
A few computers at a high-security software firm location have been compromised. The threat actor took user videos, confidential information like bank account IDs and passwords, email IDs and passwords, and computer screenshots. These confidential data have been shared every three hours from the computers to the threat actor. Which of the following is correct, based on the evaluation of the above observation? 1. This is a software keylogger attack, as screenshots, video captures, and keystrokes have been routinely monitored and periodically shared. 2. This is a hardware keylogger attack, as video capture functionality and periodic transfer of data are not possible with a software keylogger. 3. This is a hardware keylogger attack; it is only periodically sharing the information and is a manual transfer of information by a human agent. 4. This is a software keylogger attack, as it is sharing the information every three hours to the attacker.
Compiler
A learning management system application has been written in Python. While running the application code, the specific program or application that converts the program into machine language is called what? 1. Application software 2. Antimalware 3. Operating system 4. Compiler
a virtual machine
A machine where the operating system runs an application on top of an operating system is called _______. 1. a sandbox 2. a virtual machine 3. a quarantine 4. application whitelisting
Use privilege escalation
A vulnerability assessment engineer performed vulnerability scanning on active directory servers and discovered that the active directory server is using a lower version of Kerberos. To alert management to the risk behind using a lower version of Kerberos, he needs to explain what an attacker can do to leverage the vulnerabilities in it. Which of the following actions can the attacker perform after exploiting vulnerabilities in Kerberos? 1. Use a lateral movement 2. Use a vertical movement 3. Use privilege escalation 4. Use DLL injection
SQL Injection
A web application with an SQL server database is found to be compromised by an attacker. On examination, the email IDs of the database have been found modified. This was due to improper validation in the input fields exploited by the attacker. What is the probable attack in the above scenario? 1. SSRF 2. XML Injection 3. XSS 4. SQL Injection
The cybersecurity expert checked with CISCP and also investigated the dark web.
ABC Technologies had its computer network compromised through a cybersecurity breach. A cybersecurity expert was employed to analyze and identify what caused the attack and the damage caused by the attack. He checked an available database for this purpose and found the threat actor behind the attack. He also found out the cybercriminal has been attempting to sell the company's valuable data on the internet.Which are the most probable methods used by the cybersecurity expert to get to this stage of the investigation? 1. The cybersecurity expert used STIX and checked with CISCP. 2. The cybersecurity expert checked with CISCP and also investigated the dark web. 3. The cybersecurity expert checked the threat maps and used TAXII. 4. The cybersecurity expert checked the threat maps and used the MAR report.
Which of the following mobile device features senses movements that it then uses to ensure the screen is always oriented upright?
Accelerometer
Look at the priority and the accuracy of the vulnerability
Alice, a vulnerability assessment engineer at a bank, is told to find all the vulnerabilities on an internet-facing web application server running on port HTTPS. When she finishes the vulnerability scan, she finds several different vulnerabilities at different levels. How should she proceed? 1. Only look at the highest priority vulnerability 2. Look at the priority and the accuracy of the vulnerability 3. Only look at the accuracy of the vulnerability 4. Escalate the situation to a higher analyst
The attacker is using an integer overflow attack to initiate a buffer overflow that can allow them to take over the machine.
An attacker has changed the value of a variable used when copying files from one cloud server to a local drive. What is the most likely motive behind the attack? 1. The attacker is using a buffer overflow to initiate an integer overflow attack that will give them access to the machine's OS code. 2. The attacker is using an integer overflow attack to initiate a buffer overflow that can allow them to take over the machine. 3. The attacker is using a buffer overflow to initiate an integer overflow attack that can allow access to private data on the local drive. 4. The attacker is using an integer overflow attack that will change the state of the local drive's memory.
Impersonation and phishing
An unauthorized person recently accessed your enterprise network. The security team had received a call from the threat actor claiming to be a higher official. They followed the attacker's instructions to log them onto a specific webpage, leading to the exposure of enterprise network credentials. Which of the following social engineering techniques was used here? 1. Hoaxes and impersonation 2. Spam and phishing 3. Hoaxes and spam 4. Impersonation and phishing
Sara is asked to create a controller for light sensors. When the light falls on the sensor, it needs to indicate when a particular object is moved from its original position. For this, she needs a credit card-sized motherboard with a microcontroller on it. Which option should she select?
Arduino
Which of the following devices is similar to Raspberry Pi?
Arduino
Watering hole
Attackers have taken over a site commonly used by an enterprise's leadership team to order new raw materials. The site is also visited by leadership at several other enterprises, so taking this site will allow for attacks on many organizations. Which type of malicious activity is this? 1. Hoax 2. Spear phishing 3. Watering hole 4. Vishing
Which of the following sensors help generate security alerts to physicians regarding patient health?
BAN
In which of the following mobile device connectivity methods are transmitters connected through a mobile telecommunication switching office (MTSO) that controls all of the transmitters in the cellular network and serves as the link between the cellular network and the wired telephone world?
Cellular
Which of the following mobile device enterprise deployment models are implemented so that employees in an organization are offered a suite of security, reliability, and durability choices that the company has already approved?
Choose your own device (CYOD)
Zyan works for ABC Technology. The enterprise wants to provide smartphones to all its employees. They can choose from a limited list of approved mobile devices. But they need to pay for the device themselves. The company will pay them a monthly stipend. Which deployment method should Zyan suggest to meet his company's needs?
Choose your own device (CYOD)
James is a black hat hacker employed as an authorized officer at Apple. He has credentials and signed a non-disclosure agreement to perform advanced penetration testing on the iOS 6.1.6 operating system, and has already gained low-level access to the mobile device using a backdoor. Which of the following actions should James take to design/create his own custom firmware to exploit underlying vulnerabilities and gain a higher level of access to a UNIX shell with root privileges, essentially allowing them to do anything on the device?
Clone and inherit the source code of the open-source software "P0sixspwn"
Marcus is an information security architect at a product-based IT firm. He is responsible for developing policies for the most-secure mobile device enterprise-deploying model. The company will decide the level of choice and freedom for employees. Employees are supplied company-chosen and paid-for devices that they can use for both professional and personal activities. This action is performed under which enterprise deployment model?
Corporate-owned, personally enabled (COPE)
Social engineering and phishing attacks
Daniel accidentally installed a vulnerable application. Which of the following system exploitations would NOT be caused by the vulnerable application? 1. Social engineering and phishing attacks 2. Process spawning control 3. Executable files attack 4. System tampering
John has been appointed as a product manager at a large mobile device manufacturing company. He is designing the core features included in their flagship mobile device that will be launched during the holiday shopping season. Which of the following features should he primarily include?
Data synchronization with a remote server or separate device
Sean is an information security architect at a financial firm. As his first project, he must design and build an efficient, sure-shot, yet cost-effective solution to detect and prevent bank credit card fraud. How should Sean proceed?
Design a solution that keeps track of dates, times, locations of transactions, and geolocation of the authorized cell phone. When a user makes a purchase at a store, the bank can immediately check that the cell phone and the bank card are in the same place. If they are, the purchase is considered legitimate. But if they are not, then the payment is rejected.
Blue team
Dillip is assigned the role of a SOC developer who must build different teams under the SOC. He must build a new team that will put security defenses in place to prevent another team from penetrating the network. Which team should he build to monitor the other team's attacks and shore up security defenses as necessary? 1. Red team 2. White team 3. Purple team 4. Blue team
Which of the following is the most secure encryption solution to adopt for a Google Android mobile device?
File-based encryption
Which of the following sets only lists additional features of a mobile device or a computing device?
Global positioning system (GPS), microphone and/or digital camera, wireless cellular connection for voice communications, wireless personal area network interfaces such as Bluetooth or near-field-communications (NFC), removable storage media
Hacktivists misuse a computer system or network for socially or politically motivated reasons, whereas state actors are covertly sponsored by a government to attack its foes.
Hacktivists and state actors are huge threats to government systems. What is the main difference between hacktivists and state actors? 1. Hacktivists are covertly sponsored by a government to attack its foes, whereas state actors misuse a computer system or network for personal, social, or political reasons. 2. Hacktivists attack a nation's network and computer infrastructure to cause disruption and panic among citizens, whereas state actors attack their own enterprise network for political revenge or personal gain. 3. Hacktivists attack their own enterprise network for political revenge or personal gain, whereas state actors attack a nation's network and computer infrastructure to cause disruption and panic among citizens. 4. Hacktivists misuse a computer system or network for socially or politically motivated reasons, whereas state actors are covertly sponsored by a government to attack its foes.
It ensures the scan is designed to meet its intended goals by defining scope and sensitivity levels.
How can a configuration review reduce the impact of a vulnerability scan on the network's overall performance? 1. It ensures the scan is designed to meet its intended goals by defining scope and sensitivity levels. 2. It performs a fast initial scan that identifies open ports and responsive software. 3. It focuses the full scan by first comparing network configurations against known vulnerability databases. 4. It identifies configuration and security postures within the network.
A backdoor was installed previously and utilized over the weekend to access the computer and the programs.
Ian, a systems administrator, was checking systems on Monday morning when he noticed several alarms on his screen. He found many of the normal settings in his computer and programs changed, but he was sure no one had physically entered his room since Friday. If Ian did not make these changes, which of the events below is the most likely reason for the anomalies? 1. The security administrator ran a penetration test over the weekend and did not tell anyone. 2. The power went out over the weekend and caused the programs to move back to their default settings. 3. A backdoor was installed previously and utilized over the weekend to access the computer and the programs. 4. A firewall scan that was run over the weekend shut down the computer and the programs.
John is asked to design a specialized device that does not have any security features but operates on the basis of trust that assumes all other devices or users can be trusted. Which security constraint for the embedded system should John use?
Implied trust
Waterfall development
In an application development model, which of the following uses a sequential development process? 1. Waterfall development 2. Agile development 3. DevOps deployment 4. Rapid application development
Configuration vulnerability
In an interview, the interviewer introduced the following scenario:An enterprise is hosting all its computing resources on a cloud platform, and you need to identify which vulnerability is most likely to occur.Which of the following should you choose?! 1. Configuration vulnerability 2. Zero-day vulnerability 3. Third-party vulnerability 4. Physical access vulnerability
Script kiddies use automated attack software created by other hackers for personal gain, whereas gray hat hackers create their own attack software to showcase vulnerabilities present in a system to the world.
In cybersecurity, a threat actor is an individual or an entity responsible for cyber incidents against the technical equipment of enterprises and users. How should you differentiate an attack by a script kiddie from that of a gray hat hacker? 1. Script kiddies are hired to probe systems for weaknesses and then privately provide that information back to the organization, whereas gray hat hackers break into systems for ideological or political reasons. 2. Script kiddies construct efficient scripts to perform attacks to fulfill their own needs, whereas gray hat hackers construct scripts for attacking organizational competitors. 3. Script kiddies use automated attack software created by other hackers for personal gain, whereas gray hat hackers create their own attack software to showcase vulnerabilities present in a system to the world. 4. Script kiddies lack the technical knowledge to carry out attacks, so they hire a hacker to do it, whereas gray hat hackers violate computer security to fulfill their financial needs.
In which of the following mobile device connectivity methods are light waves used as a communication channel?
Infrared
Jordan has been asked by his organization to help them choose a mobile device communication channel for their new mobile device build. Which of the following mobile device communication channels should Jordan NOT suggest to his company?
Infrared
Bot herder
Japan's cybercrime control center noticed that around 200,000 Tokyo computers are infected by bots, and all these bots are remotely controlled by a single attacker. What is this attacker referred to as? 1. Bot herder 2. Botnet 3. Zombie 4. Payload
Perform static code analysis
John is a project manager with an IT firm, and his current project of developing an ERP application is in the development stage. Currently, the application is not yet mature or stable enough to be placed in a test environment. Which of the following secure coding review techniques is applicable for his project? 1. Perform a static binary code analysis 2. Perform static code analysis 3. Perform dynamic code analysis 4. Perform a structured manual analysis of code
Virus
Juan, a cybersecurity expert, has been hired by an organization whose networks have been compromised by a malware attack. After analyzing the network systems, Juan submits a report to the company mentioning that the devices are infected with malware that uses a split infection technique on files. Which malware attack is Juan reporting? 1. Spyware 2. Cryptomalware 3. RAT 4. Virus
Kate has installed a potentially unwanted program (PUP)
Kate decides to download an extension to her favorite browser to quickly store links on her spreadsheet software. While downloading the software, she ignores the opt-out check box that allows the extension to download a search toolbar. What has occurred here? 1. Kate has installed a potentially unwanted program (PUP). 2. Kate has installed a backdoor. 3. Kate has installed an injection. 4. Kate has installed a Trojan.
Missing patches, lack of OS hardening, network design flaw, lack of application hardening, weak passwords, and misconfigurations
Keily is a vulnerability assessment engineer. She is told to find surface vulnerabilities on all internet-facing web servers in the network. Which of the following are surface vulnerabilities that she should initially chase? 1. Missing patches, lack of OS hardening, network design flaw, lack of application hardening, weak passwords, and misconfigurations 2. Lack of OS hardening, network design flaw, lack of application hardening, misconfigurations, and brute force 3. Lack of OS hardening, network design flaw, weak passwords, and misconfigurations 4. Lack of OS hardening, network design flaw, lack of application hardening, weak passwords, misconfigurations, and SQL Injections
Purple team
Khalid joins a security team where he is assigned a SOC developer role and has to build different teams under SOC. Which of the following teams should he build to deal with providing real-time feedback related to security incidents and threat detections, which can then be utilized to facilitate better prioritization of threats and a mature way of detecting threats? 1. White team 2. Purple team 3. Blue team 4. Red team
Kia must uninstall the toolbar software and the accompanying components she has recent installed on her browser.
Kia recently noticed that when she browses her favorite online shopping site, she is immediately redirected to a competitor's site. What is happening here, and what is the best option for Kia to fix this situation? 1. Kia must uninstall the toolbar software and the accompanying components she has recent installed on her browser. 2. Kia has installed spyware, and she has to close the browser and reboot the system to correct the problem. 3. Kia has accidentally installed a virus. She must close the browser and run a good antivirus program before browsing the website for shopping again. 4. Kia must reinstall a fresh copy of the operating system and all applications.
Footprinting
Kile is assigned a role as a grey box penetration tester in the financial sector. He has to conduct a pen testing attack on all the application servers in the network. Which of the following tasks should he perform first while conducting a penetration testing attack on a network? 1. Tailgating 2. Phishing 3. Footprinting 4. Vishing
Fuzzing
Makayla has created software for automating the accounting process at ABL Manufacturing. She completed the software development, with testing done during development at individual stages. Before putting the software into production, Mary, who is in charge of the testing software, ran the application using tools and generated a report giving the various inputs and corresponding exceptions generated by the application. What process did Mary use? 1. Fuzzing 2. Camouflaged coding 3. Dead coding 4. Code signing
Dan uses his personal laptop for writing the script for an upcoming high-budget, highly anticipated movie. To keep the script private, he decided not to connect his laptop to any network and updated his system with the latest virus definitions and security patches. Which of the following is Dan's laptop still vulnerable to?
Malicious USB
Ronald can employ the SecDevOps model to meet the requirements of the client.
Ronald is a software architect at MindSpace Software. He has been approached to develop a critical application for a finance company. The company has asked him to ensure that the employed coding process is secure. They have also requested that the project be completed in a few months, with a minimum version of the identified functionalities provided. The other functionalities can be developed later and added to the software while the application is live. Which development process would be ideal for Ronald to employ to achieve this objective? 1. Ronald can employ an agile development model to meet the requirements with penetration testing done on the modules. 2. Ronald can employ the SecDevOps model to meet the requirements of the client. 3. Ronald can employ the rapid development model to meet the requirements of the client. 4. Ronald can employ a waterfall model to meet the requirements by testing the code at every phase of development.
Typo squatting
Several websites use URLs similar to one of the most globally popular websites, attempting to attract traffic if a user misspells the popular website's URL. What is this social engineering technique called? 1. Pharming 2. Typo squatting 3. Tailgating 4. Spam
CSRF attack
Shanise is an IT security professional for a large private bank. She got an alert that the bank website received a funds transfer request that was correctly credentialed but flagged as being out of the account owner's usual pattern. If the alert is correct, what type of attack has likely occurred? 1. SQL injection 2. CSRF attack 3. XSS attack 4. Replay attack
Only visit websites that are hosted over HTTPS or HSTS
Sheena wants to make sure that her browser activity is safe and prevent others from intercepting her data as it is transmitted over the browser. What should Sheena do to achieve this objective? 1. Only visit websites that are hosted over HTTPS or HSTS 2. Fill all her forms through hidden fields only 3. Make sure that the content security policy is in place 4. Send a secure cookie over the browser to the server
Phishing involves sending an email message or displaying a web announcement that falsely claims to be from a legitimate enterprise, whereas pharming is a redirection technique that attempts to exploit how a URL is converted into its corresponding IP.
Social engineering is a means of eliciting information by relying on the weaknesses of individuals. How should you differentiate between the social engineering techniques of phishing and pharming? 1. Phishing involves digging through trash receptacles to find information that can be useful in an attack, whereas pharming involves sending millions of unsolicited emails to a large volume of users. 2. Phishing involves sending customized emails to recipients, including their names and personal information, to make the message appear legitimate, whereas pharming is a variant of phishing that specifically targets wealthy individuals or senior executives within a business. 3. Phishing involves sending millions of generic email messages to a large volume of users, whereas pharming targets specific users by sending emails customized to the recipients, including their names and personal information. 4. Phishing involves sending an email message or displaying a web announcement that falsely claims to be from a legitimate enterprise, whereas pharming is a redirection technique that attempts to exploit how a URL is converted into its corresponding IP.
Which alert utility can identify theft in a smart meter?
Tamper protection
Alpha Tech started a charitable competition in which every team is asked to submit a proposal for a public health contract asking for a new viral transmission mitigation app.Which team has selected the correct option?
Team B has selected BAN.
Logic-bomb
Terrence, an executive VP of IT at Sigma Bank, noticed that yesterday, there was a major attack on several thousands of bank employees' computers located at geographically different locations where files and data from the computers got deleted. It was also noticed that several confidential files containing customer data were deleted from the bank's server in multiple locations, and the CEO's emails were deleted from the mail server. Since the bank was compliant with cybersecurity measures, Terrence suspects an internal hand in this activity. While going through the records of all employees working in the IT security of the bank, both past and present, he notices that there is an employee, Chris, who has enough experience to launch this attack, was unhappy with his annual review last year, and had left the bank three months ago. If Terrence were able to single Chris out as the one responsible for the attack, what kind of an attack would this be? 1. Logic-bomb 2. Spyware 3. Backdoor 4. Keylogger
This is a typical characteristic of an endpoint device infected with a file-based virus attack.
The files in James's computer were found spreading within the device without any human action. As an engineer, you were requested to identify the problem and help James resolve it. During file code inspection, you noticed that certain types of files in the computer have similar codes. You found that the problem is coming from a set of codes that are not part of the actual files, appended at the bottom of the file. You also noticed a transfer control code written at the beginning of the files giving control to the code at the bottom of the file. Which type of infection is this a characteristic of? 1. This is a typical characteristic of an endpoint device infected with a file-based virus attack. 2. This is a typical characteristic of files infected by keystrokes in an endpoint. 3. This is a typical characteristic exhibited by files attacked by ransomware in the device. 4. This is a typical characteristic of a spyware infection in the endpoint device.
Vulnerability scanning is performed using an automated tool to scan a network for known vulnerability signatures. Penetration testing involves attempting to manually uncover deep vulnerabilities just as a threat actor would, and then exploiting them.
There is often confusion between vulnerability scanning and penetration testing. What is the best explanation of the difference between vulnerability scanning and penetration testing? 1. Vulnerability scanning checks a network for outdated versions of services. Penetration testing is attempting to manually uncover deep vulnerabilities just as a threat actor would, and then exploiting them. 2. Vulnerability scanning is performed by manually scanning a network for known vulnerabilities. Penetration testing is attempting to manually scan a network for known vulnerability signatures using an advanced scanning tool. 3. Vulnerability scanning is performed using an automated tool to scan a network for known vulnerability signatures. Penetration testing involves attempting to manually uncover deep vulnerabilities just as a threat actor would, and then exploiting them. 4. Vulnerability scanning checks a network for open ports and services. Penetration testing is attempting to manually scan a network for known vulnerability signatures using an advanced scanning tool.
Individual users
Threat actors focused on financial gain often attack which of the following main target categories? 1. REST services 2. Individual users 3. Social media assets 4. Product lists
Which of the following vulnerabilities involves connecting a flash drive infected with malware to a mobile device?
USB-on-the-go (OTG)
Anola is the security administrator in XYZ consulting. She is asked to suggest a deployment method where the data is stored in a completely secure, centralized server and accessed by authorized employees using their own devices. Which deployment should Anola choose?
Virtual desktop infrastructure (VDI)
Implement hardening at endpoints with patch management and operating system safeguards
What additional measure should be enacted to increase the security on a computer network after secure boot, protective measures from attacks like antimalware, and intrusion detection systems are implemented in all the computers on the network? 1. Implement an antivirus solution in all systems and servers 2. Disable operating system patch updates to prevent malicious attacks 3. Implement hardening at endpoints with patch management and operating system safeguards 4. Disable connections on the Wi-Fi network
Aggregation, correlation, event deduplication, time synchronization, and alerting
What are the primary features of a security information event management (SIEM) tool? 1. Filtering, alerting, packet dropping, packet capturing, and traffic analyzing 2. Aggregation, correlation, event deduplication, time synchronization, and alerting 3. Bandwidth monitoring, alerting, and volume measuring 4. Aggregation, deep packet investigation, and policy creation
Ransomware attacks the endpoint device holding it hostage by preventing it from functioning unless the user fulfills the ransom payment demanded.
What does ransomware do to an endpoint device? 1. Ransomware attacks the endpoint device holding it hostage by preventing it from functioning unless the user fulfills the ransom payment demanded. 2. Ransomware attacks the endpoint device without the consent of the user or the device, discreetly collecting and transmitting information, causing harm to the end user. 3. Ransomware gets accidentally installed in the endpoint device as software along with other programs during the installation process. This happens when the user's installation and download options are overlooked, thus affecting the user application adversely. 4. Ransomware infects the endpoint devices and launches attacks on the infected endpoint and other devices connected to the network.
Follow rigid sequential processes
What is NOT a principle of agile development? 1. Satisfy the customer through early and continuous delivery 2. Pay continuous attention to technical excellence 3. Business people and developers work together 4. Follow rigid sequential processes
Tainted training data for machine learning
What is a risk to data when training a machine learning (ML) application? 1. Improper exception handling in the ML program 2. Tainted training data for machine learning 3. ML algorithm security 4. API attack on the device
Spear phishing
What is a variation of a common social engineering attack targeting a specific user? 1. Watering holes 2. Spear phishing 3. Redirection Spam
Patch
What is an officially released software security update intended to repair a vulnerability called? 1. Vector 2. Default 3. Patch 4. Firmware
Client-side request forgery
What is another term commonly used to define cross-site request forgery (CSRF): 1. Client-side request forgery 2. Cross-server request forgery 3. Server-side request forgery 4. Client-server request forgery
SecDevOps method of managing software and hardware using principles of developing code
What is meant by "infrastructure as code" in SecDevOps? 1. SecDevOps method of managing software and hardware using principles of developing code 2. SecDevOps method of managing the infrastructure as a service 3. SecDevOps method of managing code as infrastructure 4. SecDevOps method of managing the infrastructure as a software
Each step in the boot sequence relies on the confirmation from the previous boot sequence step.
What is meant by "the chain of trust" in boot security? 1. Each step in the boot sequence relies on the confirmation from the previous boot sequence step. 2. Each step in the boot sequence relies on the operating system logs of the previous boot sequence for boot security. 3. Each step in the boot sequence relies on the confirmation of the hardware root of trust. 4. Each step in the boot sequence follows its own process independently, trusting the previous sequence step.
Non-credentialed scans perform fundamental actions such as looking for open ports and finding software that will respond to requests.
What is the fastest-running vulnerability scan, and why does this type of scan run so fast? 1. Intrusive scans can provide a deeper insight into the system by accessing the installed software by examining the software's configuration settings and current security posture. 2. Non-credentialed scans perform fundamental actions such as looking for open ports and finding software that will respond to requests. 3. Non-intrusive scans find deep vulnerabilities that would have otherwise gone unnoticed. 4. Credentialed scans perform fundamental actions such as looking for open ports and finding software that will respond to requests.
Windows 10 tamper protection
What is the inbuild application available to prevent threat actors from modifying the registry in a Windows 10 operating system? 1. Windows 10 command prompt 2. Windows 10 registry editor 3. Window 10 user interface 4. Windows 10 tamper protection
Using text analysis techniques and IBM QRadar to interpret and classify emotions (positive, negative, and neutral) within text data
What is the most accurate explanation of sentiment analysis, and what kind of a tool or product can be utilized to perform this operation? 1. Using Wireshark for detecting hidden and persistent threats from a network 2. Using SIEM for combining many logs into one record based on IP addresses, usernames, and port numbers 3. Using Cisco Firepower for computationally identifying and categorizing opinions, usually expressed in response to textual data, to determine the writer's attitude toward a particular topic 4. Using text analysis techniques and IBM QRadar to interpret and classify emotions (positive, negative, and neutral) within text data
Sanitizing
What is the name of the process where a website validates user input before the application uses the input? 1. Sanitizing 2. Eliminating 3. Authorizing 4. Tokening
Credentialed scans use valid authentication credentials to mimic threat actors, while non-credentialed scans do not provide authentication credentials.
What is the primary difference between credentialed and non-credentialed scans? 1. Credentialed scans are legal, while non-credentialed scans are illegal. 2. Credentialed scans are performed by pen testers, while non-credentialed scans are performed by authorized officers. 3. Credentialed scans use advanced scanning tools, while non-credentialed scans do not use tools. 4. Credentialed scans use valid authentication credentials to mimic threat actors, while non-credentialed scans do not provide authentication credentials.
Attempt to uncover deep vulnerabilities and then manually exploit them
What is the primary goal of penetration testing? 1. Attempt to uncover deep vulnerabilities and then manually exploit them 2. Scan a network for open FTP ports 3. Perform SYN DOS attack towards a server in a network 4. Attempt to perform an automated scan to discover vulnerabilities
Normalization
What is the secure coding technique that organizes data within the database for minimum redundancy? 1. Dead code 2. Code signing 3. Normalization 4. Stored procedure
Replay
What type of attack occurs when the threat actor snoops and intercepts the digital data transmitted by the computer and resends that data, impersonating the user? 1. Replay 2. Trojan 3. Buffer overflow 4. Device driver manipulation
X-Frame-Option
Which HTTP response header should be used to prevent attackers from displaying their content on a website? 1. HSTS 2. X-Frame-Option 3. X-XSS 4. CSP
Spim
Which attack embeds malware-distributing links in instant messages? 1. Tailgating 2. Spam 3. Spim 4. Phishing
First-party cookie
Which cookie is created by the website a user is currently browsing to store the customer's browsing preference information? 1. Third-party cookie 2. Session cookie 3. First-party cookie 4. Secure cookie
HIDS (Host intrusion detection system)
Which endpoint application runs on an endpoint device that only detects an attack in an endpoint device? 1. EDR 2. HIPS 3. HIDS 4. Cookies
The SQL injection inserts specially created structured query language statements to manipulate the database server, giving control of the database to the attacker, who can then manipulate the database.
Which of the following describes the action of an SQL injection into a database server? 1. The SQL injection inserts specially created extensible markup language to manipulate the database taking control of the database giving control to the attacker to manipulate the database. 2. The SQL injection inserts code into the DLL running process, causing the program to function differently than intended. 3. The SQL injection is specially created code inserted into a legitimate program, which then lies dormant unless a special logical event triggers it. 4. The SQL injection inserts specially created structured query language statements to manipulate the database server, giving control of the database to the attacker, who can then manipulate the database.
ELK Stack
Which of the following is NOT an automated vulnerability scanning tool? 1. ELK Stack 2. OpenVAS 3. W3AF 4. Nikto
A PUP interferes and obstructs the user with web browsing and pop-up windows.
Which of the following is a characteristic of a potentially unwanted program (PUP)? 1. A PUP interferes and obstructs the user with web browsing and pop-up windows. 2. A PUP gives the threat agent remote access to the user's device using specially configured communication protocols. 3. A PUP pretends to perform natural activities while also performing malicious activities. 4. A PUP gives access to the computer, program, or a service, circumventing the system's normal security protections.
A vulnerability scan is usually automated.
Which of the following is a characteristic of a vulnerability scan that is not a characteristic of a penetration test? 1. A vulnerability scan identifies deep vulnerabilities. 2. A vulnerability scan is usually a manual process. 3. A vulnerability scan can be done when a regulatory body requires it or on a pre-determined schedule. 4. A vulnerability scan is usually automated.
Weak encryption
Which of the following is a configuration vulnerability? 1. Weakest link 2. Weak encryption 3. Zero day 4. Direct access
It makes third party non-vendor-approved software difficult to implement.
Which of the following is a disadvantage of the secure boot process? 1. It requires an operating system like Microsoft OS to ensure secure boot. 2. It slows down considerably, affecting the performance of the computer. 3. It makes third party non-vendor-approved software difficult to implement. 4. It does not validate the boot process.
Fileless viruses are persistent.
Which of the following is a feature of a fileless virus? 1. Fileless viruses are easy to detect. 2. Fileless viruses grant limited control. 3. Fileless viruses are easy to defend. 4. Fileless viruses are persistent.
RAT
Which of the following is a form of malware attack that uses specialized communication protocols? 1. RAT 2. Bot 3. Spyware 4. Keylogger
Dumpster diving
Which of the following is a physical social engineering technique? 1. Watering hole 2. Hoaxes 3. Dumpster diving 4. Pharming
The red team scans for vulnerabilities and exploits them manually, whereas the white team defines the rules of the penetration testing.
Which of the following is a primary difference between a red team and a white team? 1. The red team uses an automated vulnerability scanning tool to find vulnerabilities, whereas the white team defines the rules of penetration testing. 2. The red team provides real-time feedback to enhance the threat detection capability, whereas the white team defines the rules of penetration testing. 3. The red team scans for vulnerabilities and exploits them manually, whereas the white team defines the rules of the penetration testing. 4. The red team uses an automated vulnerability scanning tool to find vulnerabilities, whereas the white team decides which tool to use in automated vulnerability scanning.
Prepending
Which of the following is a social engineering method that attempts to influence the subject before the event occurs? 1. Watering hole 2. Spear phishing 3. Redirection 4. Prepending
Machine learning
Which of the following is a subset of artificial intelligence? 1. Artificial intelligence algorithm 2. Data science 3. Machine intelligence 4. Machine learning
Which of the following is an attack vector used by threat actors to penetrate a system? 1. Email 2. Phishing 3. Urgency 4. Intimidation
CSRF
Which of the following is an example of a request forgery malware? 1. CSRF 2. DLL injection 3. SQL injection 4. Ransomware
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
Which of the following is considered an industry-specific cybersecurity regulation? 1. Sarbanes-Oxley Act of 2002 (SOX) 2. Health Insurance Portability and Accountability Act of 1996 (HIPAA) 3. Gramm-Leach-Bliley Act (GLB) 4. Personal Information Protection and Electronic Documents Act (PIPEDA)
Disabling default passwords and unnecessary ports
Which of the following is part of the OS security configuration? 1. Disabling default passwords and unnecessary ports 2. Giving all users administrator privileges 3. Installing the latest version of OS 4. Enabling the most secure OS platform
Risk management framework (RMF)
Which standardized framework was developed by NIST to be used as a guidance document designed to help organizations assess and manage risks to their information and systems, and are also used as a comprehensive roadmap that organizations can use to seamlessly integrate their cybersecurity? 1. Cybersecurity framework (CSF) 2. CIS Controls 3. ISO 27001 4. Risk management framework (RMF)
Brokers
Which threat actors sell their knowledge to other attackers or governments? 1. Cyberterrorists 2. Competitors 3. Criminal syndicates 4. Brokers
Penetration testing uncovers and exploits deep vulnerabilities, while vulnerability scanning only discovers surface vulnerabilities.
Which of the following is the advantage of penetration testing over vulnerability scanning? 1. Penetration testing performs SYN DOS attacks towards a server in a network, while vulnerability scanning only discovers versions of the running services. 2. Penetration testing scans a network for open FTP ports to prevent penetration, while vulnerability scanning only discovers versions of the running services. 3. Penetration testing uncovers and exploits deep vulnerabilities, while vulnerability scanning only discovers surface vulnerabilities. 4. Penetration testing performs automated scans to discover vulnerabilities and prevent penetration, while vulnerability scanning requires manually scanning for vulnerabilities.
Which of the following is the most common method for delivering malware? 1. Removable media 2. Email 3. Identity theft 4. Social media
War flying
Which of the following is the most efficient means of discovering wireless signals? 1. Wardriving 2. War cycling 3. War chalking 4. War flying
Mimikatz and hashcat
Which of the following offensive tools can be used by penetration testers post-exploitation or successful compromise of a user account in a network that dumps passwords from memory and hashes, PINs, and Kerberos tickets, and thus are used for privilege escalation attacks? 1. Ophcrack and John-the-Ripper 2. Mimikatz and hashcat 3. Powershell and procdump 4. Tor and NMAP
Gray box
Which of the following penetration testing consultants have limited knowledge of the network and some elevated privileges? 1. Bug bounty 2. White box 3. Gray box 4. Black box
A hardware-based keylogger must be physically installed and removed without detection.
Which of the following statements correctly describes the disadvantage of a hardware-based keylogger? 1. A hardware-based keylogger's data can be easily erased by the antimalware software installed in the device. 2. A hardware-based keylogger must be physically installed and removed without detection. 3. A hardware-based keylogger can easily be detected in a network by an antivirus. 4. A hardware-based keylogger can be detected by an antivirus when it scans for ports.
Open Source Intelligence (OSINT)
Which of the following techniques is a method of passive reconnaissance? 1. Port scanning 2. War driving 3. Open Source Intelligence (OSINT) 4. War flying
SIEM and SOAR
Which of the following technologies can be used together for data management in security infrastructure and collecting and analyzing data. 1. SIEM and SOAR 2. SIEM and IPS 3. SOAR and packet sniffer 4. Firewall and IDS
Nessus Essentials
Which of the following tools can be used to scan 16 IP addresses for vulnerabilities? 1. App Scan 2. Nessus Essentials 3. QualysGuard 4. Nessus
Legacy platform
Which of the following types of platforms is known for its vulnerabilities due to age? 1. Online platform! 2. Legacy platform 3. On-premises platform 4. Cloud platform
System tampering
Which of the following uses vulnerable applications to modify Microsoft registry keys? 1. Executable files attack 2. Quarantine 3. System tampering 4. Process spawning control
Threat hunting
Which operation is carried out by proactively searching security logs for cyber threats that have thus far gone undetected. 1. Vulnerability hunting 2. Data hunting 3. Threat hunting 4. Vulnerability scanning
Black box
Which penetration testing consultants are not given any knowledge of the network nor any elevated privileges? 1. White box 2. Black box 3. Gray box 4. Bug bounty
Black hat hackers
Which threat actors violate computer security for personal gain? 1. Black hat hackers 2. Gray hat hackers 3. Red hat hackers 4. White hat hackers
Rootkit, a malware that uses the lower layers of the operating system or undocumented functions to make alterations to the operating system's processes
Which type of malware can hide its agenda inside other processes, making it undetectable, and what is it usually used for? 1. Backdoor, which gives access to a computer, program, or service that overrides any normal security protections 2. Rootkit, a malware that uses the lower layers of the operating system or undocumented functions to make alterations to the operating system's processes 3. Trojan, an executable program that pretends to perform a harmless activity while doing something malicious 4. RAT, an executable program that gives unauthorized remote access to a user's computer
Competitors
Which type of threat actor would benefit the most from accessing your enterprise's new machine learning algorithm research and development program? 1. Competitors 2. Criminal syndicates 3. Shadow IT 4. Brokers
CSRF
While Andel is logging into his email through a browser, the login window disappears. Andel attempts to log in again and is successful. Days later, he goes to log into his email, and his attempt fails. He receives a message indicating that his username and/or password are invalid. What is Andel likely a victim of? 1. CSRF 2. Keyloggers 3. Spyware 4. RAT
IOC
While going through the network log, Sarah, a network security administrator, noticed substantial outbound network traffic. Which activity did Sarah perform? 1. IOC 2. HTTP 3. STIX 4. Telnet
Flash memory provides stability to the BIOS framework and makes update installation much easier than with CMOS.
Why was the BIOS framework relocated to flash memory from a complementary metal-oxide-semiconductor (CMOS) in later development? 1. Flash memory provides stability to the BIOS framework and makes update installation much easier than with CMOS. 2. Using CMOS, when in ROM, BIOS could not correctly locate the address of the OS, which is not a problem with flash memory. 3. Flash memory solves the problem of poor CMOS performance during the low-battery process, which hampered the BIOS function. 4. Unlike a CMOS, flash memory prevents malicious activities from taking place within the framework.
William should run an antimalware program and scan for all known RATs, then quarantine and remove the infected file(s). To prevent this in the future, he should only download software from trusted websites.
William downloaded some free software to help him with photo editing. A few days later, William noticed several personal photographs were modified and posted to various social media pages with obscene comments. He also noticed that there were videos of him that were morphed and circulated on adult websites. The videos were obviously taken using his webcam.What should William do to fix his problem and prevent it from happening again in the future? 1. William should run an antivirus program and scan for all known worms, then download a worm-removal program to ensure all infected files are fully removed from his system. To prevent this in the future, he should run the backdoor check every time he installs a new program. 2. William should run an antimalware program and scan for all known RATs, then quarantine and remove the infected file(s). To prevent this in the future, he should only download software from trusted websites. 3. William should run an antivirus program and scan for all known backdoor viruses, then remove the infected file(s). To prevent this in the future, he should run the backdoor check every time he installs a new program. 4. William should disable his network devices, then run an antimalware program to scan for keyloggers while his computer is not connected to the internet and delete all infected files. To prevent this in the future, William should never download free software off the internet.
Automation
You have been assigned to decide the process used for software application development at your company. Since the products need to be developed and deployed as each module is completed, you chose to go with agile application development. Your manager has requested you consider SecDevOps. Which of the following is a significant and key feature of using SecDevOps that can be considered for selecting this project's development model? 1. Automation 2. Quarantine 3. Rigid process 4. Reuse of code
Platform vulnerability
You work for an enterprise that provides various cybersecurity services. You are assigned to examine an enterprise's network and suggest security measures modifications, if necessary. On examining the network, you find that the enterprise hosts most of its computing resources on a cloud platform and few resources on-premises, and both seem to have secure settings implemented. You also find that the enterprise computers use the Windows XP operating system.Which of the following vulnerabilities should you insist on fixing first? 1. Configuration vulnerability 2. Third-party vulnerability 3. Zero-day vulnerability 4. Platform vulnerability
Weakest link
Your company is considering updating several electronic devices used in the enterprise network. The third-party service provider that your company approached says that they require access to the enterprise network in order to implement the updates. As the chief information security officer, you are asked to analyze the requirement and submit a report on potential vulnerabilities when giving a third-party access to the network.Which of the following vulnerabilities should you list as the most likely to affect the enterprise network? 1. Zero day 2. Weak encryption 3. Default settings 4. Weakest link
Configuration vulnerability
Your company recently purchased routers with new and updated features and deployed them in the highly secure enterprise network without changing the default settings. A few days later, the enterprise network suffered a data breach, and you are assigned to prepare a report on the data breach. Which of the following vulnerabilities should you identify as the source of the breach? 1. Platform vulnerability 2. Configuration vulnerability 3. Third-party vulnerability 4. Zero-day vulnerability
Vishing
Your enterprise experienced several technical issues over the last few days. There were multiple instances of passwords needing to be changed and other issues causing downtime. Management has started receiving voicemails regarding fraudulent activities on their accounts. While the voicemails sound authentic, the help desk concludes that they are fake. What type of malicious activity will this be considered? Correct! 1. Vishing 2. Whaling 3. Spamming 4. Spimming
Hacktivist
Your enterprise has played fast and loose with customer information for years. While there has been no significant breach of information that could damage the organization and/or their customers, many in the enterprise feel it is only a matter of time before a major leak occurs. Which type of threat actor is an employee who wishes to personally ensure that the enterprise is exposed and blocked from accessing their customers' information until they ensure more secure protocols? 1. Insider 2. Hacktivist 3. Script kiddy 4. State actor
This is an API attack.
Zeda Corporation provides online training solutions to global customers. To provide e-learning solutions, it integrates with multiple vendor platforms. This ensures seamless transfer to multiple operators' solutions through sign on. Joe, an IT security administrator, noticed that a threat actor has attacked the platform and stolen the user data. The source of this vulnerability was identified as one of the integrated external applications. What type of attack is this? 1. This is a backdoor attack. 2. This is an AI attack. 3. This is a device driver manipulation attack. 4. This is an API attack.
A zero-day vulnerability is an unknown vulnerability in released software that is found and exploited by a threat actor, whereas a configuration vulnerability is caused by improper settings in hardware or software.
Zero-day vulnerabilities and configuration vulnerabilities can heavily impact a system if exploited. How should you differentiate between a zero-day vulnerability and a configuration vulnerability? 1. A zero-day vulnerability is an unknown vulnerability in released software that is found and exploited by a threat actor, whereas a configuration vulnerability is caused by improper settings in hardware or software. 2. A zero-day vulnerability is an easily fixable vulnerability recognized by a software developer, whereas a configuration vulnerability is a major vulnerability present in a system exploited by a threat actor before the software developer can fix it. 3. A zero-day vulnerability results from improper hardware configurations, whereas a configuration vulnerability results from improper software configuration. 4. A zero-day vulnerability results from users improperly configuring software, whereas a configuration vulnerability results from the developers improperly configuring the software.