Chapter 4 CompTIA SEC+

Selah infects the ads on a website that users from her target company frequently visit with malware as part of her penetration test. What technique has she used? A. A watering hole attack B. Vishing C. Whaling D. Typosquatting

A. Watering hole attacks use compromised websites that their targets frequent to gain access to their systems. It uses the concept of watering holes, as in animals in nature must visit watering holes, so they are great places to lay traps.

Alaina wants to determine if a password spraying attack was used against her organization. Which of the following indicators would be most useful as part of her investigation? A. The time the login attempts happened B. The passwords used for failed attempts C. The source IP address of the attempts D. The number of failed attempts for each user

B. By checking the passwords used for failed attempts, Alaina will be familiarizing herself with the passwords that are likely being used in the spraying attack.

Sharif notices that his authentication logs have many different usernames showing failed logins with the same password. What type of attack has he discovered? A. Credential harvesting B. Impersonation C. BEC D. Spraying

D. Spraying uses the same password with multiple usernames in order to gain access to a system.

When you combine phishing with voicemail, it is known as A. Whaling B. Spoofing C. Spooning D. Vishing

D. Vishing is when you use phone calls or voicemail to perform phishing attacks.

Ben wants to determine if brute-force password attacks are being used against his company. What log information is least likely to be useful when working to detect brute-force attacks? A. Source IP address or hostname B. Failed login logs C. The password that was used for each attempts D. The geographic location of the system being logged into

D. is least likely to be useful as the geographic location of something which is connected to the internet will not help you with detecting brute-force attacks. Brute-force attack detecting requires things like password checking, failed login logs, and the source IP address can help if all the attempts are coming from the same location, you may want to block that address.

While reviewing her logs, Michele notices that a remote system has attempted to log into her server via SSH using the username admin and a variety of passwords like "password" and "ninja." What type of attack has Michele noticed? A. A brute-force attack B. Shoulder surfing C. An on-path attack D. Pretexting

A. Brute-force attacks rely on using different combinations of usernames and passwords to try and force your way into a system

Which of the following human vectors is primarily associated with nation-state actors? A. Misinformation campaigns B. Watering hole attacks C. Business email compromise D. Password spraying

A. Misinformation campaigns are typically used by nation-state actors to influence the media and beliefs in another country. This requires a lot of resources and time investment that you typically only see with nation-state actors.

Jack's organization wants to prevent typosquatting. What option should he select to address this issue? A. Copyright the domain name B. Purchase the most common typos for his organization's domain C. Trademark the domain name D. Disable typo resolution for the domain

B. Getting the most common typos will assist his organization with prevent typosquatting from occurring.

Melissa receives a call and the caller informs her a senior manager in her organization needs her to buy gift cards for an event that starts in an hour. The caller says that the senior leader forgot to get the cards, and that the even starts in an hour. Melissa buys the cards and sends them to the Gmail address the caller says that the senior leader needs them sent to. What type of attack has Melissa fallen for? A. Phishing B. Pretexting C. Business email compromise D. Carding

B. Phishing may be your first instinct, but phishing is focused more on gathering information, such as log ins to gain access to a system. Pretexting fits here as they are contacting her with a prefabricated story for why they are calling her in order to get her to send her the gift cards. Its a bit of a toss up, but phishing is a social engineering technique, whereas Pretexting is a TYPE OF ATTACK.

Joseph receives an email notifying him that he needs to change his password due to a recent account issue. He notices that the email links him to a website using the domain amaz0n.com. What type of attack should he describe this as? A. Typosquatting B. Phishing C. Smishing D. A watering hole attack

B. Since the attack comes through an email and is attempting to gather information, this is a phishing attack. It is almost Typosquatting, except for Typosquatting relies on accidental mistyping, not sending people links.

Naomi receives a report of smishing. What type of attack should she be looking for? A. Compressed files in phishing B. Text message-based phishing C. Voicemail-based phishing D. Server-based phishing

B. Smishing uses text-messaged based phishing in order to facilitate phishing attacks

Gwyne's company has been contacted by customers asking about a new social media account operating under the company's brand. The social media account is advertising cryptocurrency, which Gwyne's organization does not sell or work with. What type of attack best describes what Gwyne's organization has encountered? A. Impersonation B. Brand impersonation C. Mis-branding D. Crypto-phishing

B. The account is utilizing Gwyne's company name to push their own agenda, they are impersonating their brand.

One of the staff at Susan's organization has reported that a critical vendor has contacted them about an unpaid invoice. After Susan investigates, she discovers the invoice was sent from an email account that was not typically a contact and that the invoice requested payment to a PayPal account. What type of social engineering attack has Susan most likely discovered? A. Smishing B. Business email compromise C. Disinformation D. Typosquatting

B. This appears to be Business email compromise, as this attack utilizes a likely spoofed or compromised email. This attack forces a sense of urgency, and requested payment to an odd location, which is why this is a red flag for BEC.

Devon is a penetration tester and sets up malicious tools on his target organizations primary internal website. What type of attack is he conducting? A. A misinformation campaign B. A watering hole attack C. A typosquatting attack D. a disinformation campaign

B. This attack relies on the targets visiting compromised websites to gain access to the network.

Nation-state-driven social media campaigns about the trustworthiness of the U.S. election in 2016 are an example of what type of social engineering? A. Smishing B. Pretexting C. Disinformation D. Spraying

C. Disinformation campaigns often use wrong or outright false information to further their own agenda. In this case, causing the questioning of the validity of the election, leading to political unrest.

Joanna wants to detect password spraying attacks. What type of rule should she deploy through her security system? A. Match attempts to log into many systems with the same username and password. B. Match multiple attempts to log into the same user account using different passwords. C. Match repeated use of the same password during failed login attempts for multiple usernames D. Match all attempts to use passwords with slight changes for the same account

C. Password spraying is the use of the same password or a small list of passwords with different usernames to attempt to log in. This is a form of a brute-force attack

Fred is concerned about text message-based attacks. Which of the following attacks relies on text messages as its primary focus? A. Impersonation B. Watering hole attacks C. Smishing D. Business email compromise

C. Smishing utilizes the short message system to use phishing techniques in order to facilitate its attacks.

When a caller was recently directed to Amanda, who is a junior IT employee at her company, the caller informed her that they were the head of IT for her organization and that she needed to immediately disable the organization's firewall due to an ongoing issue with their e-commerce website. After Amanda made the change, she discovered that the caller was not the head of IT, and that it was actually a penetration tester hired by her company. What social engineering attack best describes this? A. Smishing B. Pretexting C. Impersonation D. Vishing

C. This person is attempting to impersonate the head of IT in order to gain access to the network.

Phishing emails sent pretending to be from a company that recipients are familiar with and likely to respond to is what type of attack? A. Phishing B. Pharming C. Brand impersonation D. Pretexting

C. This type of attack relies on attempting to look like a specific well-known company in order to facilitate trust.

Nicole accidentally types www.smazon.com into her browser and discovers that she is directed to a different site loaded with ads and pop-ups. Which of the following is the most accurate description of the attack she has experienced? A. DNS hijacking B. Pharming C. Typosquatting D. Hosts file compromise

C. Typosquatting is where you use typos and rely on mistypes to drive traffic to your websites.