Security +
Which of these states are the result of an erroneous action triggering from a benign event?
False positive
Spearfishing
Targets certain employees in certain departments, roles, and responsibilities
Smishing
A cyber attack that uses SMS texting as the vector
Which of these statements is true regarding zero-day attacks?
All malware and exploits were a zero-day at one time or another.
Which of these would commonly not be considered a benign usage of a man-in-the-middle?
Application Layer Gateway *ARP proxy* Web proxy server Network Address Translator
Pharming
Attacker poisons a DNS server to redirect users to unintentionally go to a fake site
A prank that takes advantage of sending contact information automatically without authentication
Bluejacking
Can steal data from a wireless device using a Bluetooth connection
Bluesnarfing
Attacker sends larger than expected input and a server accepts it and writes to memory areas
Buffer Overflow
In a distributed denial-of-service account what does the zombified system communicate with?
C2C Server
What component will typically store the instances of all organizational configuration items?
CMDB
In a Linux-based privilege escalation attack what is the typical first step?
Check the OS release of the vulnerable system
Removing all footprints and artifacts of the attack chain
Cleanup
Which of these scanning techniques would decide if a system is configured in agreement with a recognized governance or regulatory policy?
Compliance scan
Which variant of XSS attacks leverages an insecurely written HTML page on an end user's system or endpoint gadgets and widgets?
DOM-based
An overlay network that is not indexed by search engines
Darkweb
It is also known as a "dot slash" attack
Directory Traversal
Compromises various control and management frames when MPP is not used
Dissassociation
What cryptographic attack takes advantage of an application's ability to give up a more secure method of communication and revert to an older, less-optimal mode?
Downgrade attack
A timing-based side-channel attack against WPA3
Dragonblood
Replaces an existing wireless service set so that users will connect to a fake one
Evil twin
What penetration testing technique would involve having some level of limited knowledge of the internal workings of the target?
Gray Box
Which type of threat actor has some level of information about the target but often needs more?
Gray hat
What is most likely the first step in a scam or hoax attack?
IP Spoofing
Which of these represents a likely primary or secondary loss due to using unsecure and unpatched legacy platforms?
Identity Theft Data Exfiltration Loss of availability Loss of reputation
An error when the result of a math operation does not fit within the allocated memory space
Integer overflow
Network or host-based cyber observables or artifacts of an incursion
IoC
What are threat hunters attempting to quickly recognize to counter cyber criminals and mitigate threats?
IoCs
Which of these refers to malicious scripts as opposed to malicious code?
It is rarely sent through email attachments It is an unwanted and unsolicited malicious program *It affects only those applications for which it has been written* It is another generic term for malware
KeyGhost captures passwords, credit card numbers, and other personal information
Keylogger
Pivoting from one domain or VLAN to another
Lateral movement
Which of these represents passive reconnaissance instead of active reconnaissance?
Less intrusive process to daily operations Leaving no footprints Conducting packet tracing Using a network tap
Which of these attacks triggers a certain event occurs such as mouse movement or file access?
Logic bomb
Which of these attacks takes advantage of inadequate mechanisms to stop clients from automated attempts through credential stuffing?
Login Attacks
What technique can overwhelm the content addressable memory tables on Layer 2 switches?
MAC Flooding
What technologies with learning, reasoning, and decision-making abilities are rapidly being incorporated into security, analysis, defense, and military systems?
Machine learning Artificial Intelligence Robotic technologies
What is another term used to describe an influence campaign?
Misinformation Operation
Which of these is more related to an on-premise provider as opposed to a cloud-based provider?
More experience and familiarity with system
Which of these represents practical reasons for the effectiveness of social engineering?
No policy enforcement Lack of acceptable use policy Outdated antivirus tools and utilities No buy-in from management
Data or information that can be collected legally from free, public sources concerning an individual or organization
OSINT
Which of these are valid examples of weak configuration vulnerabilities?
Open ports and services Unhardened systems and protocol Weak cryptosystems Default passwords
Which of these third-party risks would most likely occur due to the use of unsecure coding practices and lack of testing?
Outsourced container development
Which attacks takes advantage of Windows Safe Mode?
Pass the hash
Forcing the exploit to remain even with a reboot or network disconnect
Persistence
Which of these are attributes of a structured attack?
Persistent Organized Planned Multi-phased
Attempting to get root or administrative credentials of a database
Privilege Escalation
Which role will offer initiatives and information sharing between teams to improve the organizational security posture?
Purple team
Infected PC serves a session back to C2C server acting as client
RAT
Which source of research would be published by the IEEE?
RFC
Client and server handshake before the server generates two cryptographic keys
Ransomware
Conducting planning, preparation, and information gathering
Reconnaissance
What process involves changing an application's source code without modifying the characteristics?
Refactoring
Agreeing to the target customers bug bounty program
Rule of engagement
What service allows organizations to aggregate threat management, incident response, and repeatable security operations?
SOAR
A structured language for cyber threat intelligence
STIX
Web application allows reusing old session credentials for authorization
Session Replay
Which of these attacks is most likely to be conducted with a cell phone camera?
Shoulder Surfing
What technique uses devices that overlay an ATM machine or point-of-sale scanner to steal the information from the victim?
Skimming
Which of these password attacks tries to access many accounts using a few commonly used passwords with a "low-and-slow" methodology?
Spraying
Malware that can show advertisements, track information, and make changes to endpoints without user knowledge
Spyware
What type of attack involves infiltrating a system through an outside partner, vendor, or provider with access to your systems and/or data?
Supply chain attack
BEC
Targets companies who outsource, conduct wire transfers, and have suppliers abroad
Whaling
Targets high-level employee or someone in senior management
What term describes the technique or method used to exploit a vulnerability or deliver a malware payload?
Threat Vector
Which is an advantage of on-premise database solution as opposed to a cloud service provider?
Threat actors are typically internal privileged users.
A condition when an attacker tries to gain privilege to a system by racing it to a resource
Time of Check
Which of these are terms that describe an attacker sitting on sites under someone else's brand and targeting Internet users who erroneously type into their browser address bar?
URL hijacking, typosquatting, fake URL, sting sites.
A collection and distribution of information about exposed computer security exposures
Vulnerability databases
Which of these SYSLOG messages would have the code number "4"?
Warning
A special form of self-replicating malware that typically spreads without user action
Worms
What type of attack is also known as SOAP injection?
XML Injection