- A company implements a vulnerability management program that includes regular scanning, prioritization by severity, and patch deployment within defined SLAs. The primary purpose of this program is to:
Answer: Systematically identify and remediate known security weaknesses before they can be exploited by attackers.
Vulnerability management proactively identifies and fixes security weaknesses - reducing the attack surface before adversaries can exploit known vulnerabilities. Answer B is correct. Real-time attack detection (A) is security monitoring. Phishing training (C) is security awareness. Traffic monitoring (D) is detection/SOC function.
- An organization discovers that an attacker had persistent access to its network for eight months before being detected. This type of attack is known as:
Answer: An advanced persistent threat (APT) - a sophisticated, long-duration attack where the attacker maintains stealthy presence to achieve strategic objectives such as data exfiltration.
APTs are characterized by persistence, sophistication, and stealth - attackers maintain long-term access to pursue specific objectives without triggering detection. Answer D is correct. Ransomware (A) manifests visibly. DDoS (B) is immediately disruptive. Phishing (C) is a delivery mechanism, not a long-term presence.
- Which of the following best describes a 'supply chain attack' in cybersecurity?
Answer: An attack that compromises a trusted vendor or software update to deliver malware to the vendor's customers - targeting organizations indirectly through their trusted supply chain.
Supply chain attacks compromise trusted software, hardware, or service providers to reach a broader set of targets - exemplified by the SolarWinds attack where malware was distributed through a software update. Answer A is correct. Physical supply chain disruption (B), procurement system attacks (C), and physical access attacks (D) are different threat scenarios.
- Which of the following describes a 'brute force' password attack?
Answer: Systematically attempting every possible password combination until the correct one is found.
Brute force attacks exhaustively try all possible password combinations - computationally intensive but effective against weak or short passwords. Answer A is correct. Using breached credentials (B) is credential stuffing. Hash cracking (C) is an offline cracking attack. Social engineering (D) is a non-technical attack.
- A vulnerability assessment differs from a penetration test primarily in that:
Answer: A vulnerability assessment identifies and reports weaknesses without actively exploiting them; a penetration test actively attempts to exploit vulnerabilities to demonstrate impact.
Vulnerability assessments scan and report on weaknesses. Penetration tests go further by attempting to exploit those weaknesses, demonstrating real-world attack scenarios and impact. Answer A is correct. Both can be internal or external (B). Both can cover various attack surfaces (C). Both use automation and manual techniques (D).
- A distributed denial-of-service (DDoS) attack primarily threatens which element of the CIA triad?
Answer: Availability - by overwhelming systems with traffic to make them inaccessible to legitimate users.
DDoS attacks overwhelm systems with traffic, making them unavailable - directly attacking the availability principle. Answer A is correct. DDoS does not typically expose data (B), modify data (C), or bypass authentication (D).
- A company's employees receive emails appearing to be from the CEO asking them to urgently wire transfer funds to an external account. This attack is best described as:
Answer: A spear phishing / business email compromise (BEC) attack using impersonation to fraudulently induce financial transfers.
BEC/spear phishing attacks impersonate executives to trick employees into authorizing fraudulent financial transactions - a major source of financial fraud. Answer B is correct. Ransomware (A) encrypts data. DDoS (C) disrupts availability. MITM (D) intercepts active communications rather than impersonating via email.
- Which of the following best describes a 'watering hole' attack?
Answer: An attacker compromises a legitimate website frequently visited by the target group, infecting visitors with malware when they visit the site.
A watering hole attack compromises websites that the target group is known to visit, turning a trusted resource into a malware delivery mechanism. Answer B is correct. Targeted emails (A) describe spear phishing. Traffic flooding (C) describes DDoS. Software update injection (D) describes supply chain attacks.
- Which of the following best describes a 'zero-day vulnerability'?
Answer: A previously unknown vulnerability that has no available patch, giving defenders zero days to protect themselves before it can be exploited.
Zero-day vulnerabilities are unknown to the vendor and have no patch available - attackers can exploit them before any defense can be deployed. Answer D is correct. Patched old vulnerabilities (A), outdated systems (B), and new systems (C) are not the definition of zero-day.
- Which of the following best describes an 'insider threat' in cybersecurity?
Answer: Security risks posed by current or former employees, contractors, or partners who misuse their authorized access - whether maliciously or inadvertently.
Insider threats come from individuals with authorized access - including malicious insiders (data theft, sabotage), negligent insiders (accidental data disclosure), and compromised insiders (whose credentials are stolen). Answer B is correct. Perimeter-breaching attackers (A) are external threats. Vulnerability scanning (C) is a security activity. Policy unawareness (D) is a training gap, not an insider threat category.
- A SQL injection attack targets web applications by:
Answer: Inserting malicious SQL code into input fields to manipulate the underlying database, potentially exposing or modifying data.
SQL injection exploits insufficient input validation to inject database commands - potentially enabling attackers to read, modify, or delete database contents. Answer C is correct. Traffic flooding (A) is DDoS. Data interception (B) is MITM. Cookie theft (D) is session hijacking.
- An attacker sends an email that appears to come from a bank asking users to click a link and 'verify their account.' The link leads to a fake website that captures credentials. This attack is best described as:
Answer: Phishing - fraudulent email impersonating a trusted entity to steal credentials.
Phishing uses fraudulent emails impersonating trusted organizations to trick users into clicking malicious links or providing credentials. Answer C is correct. Vishing (A) uses phone calls. Smishing (B) uses text messages. Pharming (D) manipulates DNS rather than using deceptive emails.
- An organization's email system is used to send thousands of spam emails to external parties from a compromised employee account. This scenario is consistent with which threat?
Answer: The employee's account being compromised and used as part of a botnet or spam campaign.
A compromised account sending spam is consistent with botnet activity - the attacker controls the account and uses it as infrastructure for malicious campaigns. Answer B is correct. Ransomware (A) would encrypt files, not send spam. DDoS (C) overwhelms the server. Deliberate insider activity (D) is possible but less common than account compromise.
- Social engineering attacks are most dangerous because they:
Answer: Bypass technical controls by exploiting human psychology - manipulating people rather than systems.
Social engineering targets the human element - the weakest link in security - using deception, urgency, or authority to convince people to take actions that compromise security. Technical controls cannot fully prevent socially engineered attacks. Answer C is correct. Software vulnerabilities (A) and nation-state actors (B) describe technical attacks. Outcomes vary (D).
- Pretexting is a form of social engineering in which an attacker:
Answer: Creates a fabricated scenario (pretext) to manipulate a victim into revealing information or taking an action they otherwise wouldn't.
Pretexting involves fabricating a believable story - posing as IT support, an auditor, or a vendor - to manipulate the victim. Answer C is correct. Fake websites (A) describe pharming/website spoofing. Mass credential harvesting emails (B) describe phishing. Keystroke capture (D) describes a keylogger.
- An employee unknowingly installs software that appears to be a legitimate productivity tool but secretly creates a backdoor for attackers to access the corporate network. This malware type is called:
Answer: A Trojan horse - malware disguised as legitimate software that creates unauthorized access.
A Trojan horse disguises itself as legitimate software to trick users into installing it, then executes malicious functionality like creating backdoors. Answer D is correct. Worms (A) spread without user action. Ransomware (B) encrypts data. Adware (C) displays ads.
- Ransomware is best described as:
Answer: Malware that encrypts a victim's files or systems, rendering them inaccessible, and demands payment (usually cryptocurrency) in exchange for the decryption key.
Ransomware encrypts data and extorts payment for decryption - one of the most financially damaging cyberthreats to organizations. Answer A is correct. Silent monitoring and data exfiltration (B) describes spyware/RATs. Traffic flooding (C) describes DDoS. Password extraction through deception (D) describes phishing.
- An organization's security team receives an alert that a large volume of data is being transferred from an internal server to an external IP address at 2 AM. This behavior is most consistent with which threat?
Answer: Data exfiltration - an attacker or insider moving sensitive data to an external location, potentially as part of a breach or theft.
Large overnight data transfers to external locations are a classic data exfiltration pattern - an attacker or insider copying sensitive data out of the organization. Answer D is correct. DDoS originates from external attacks (A). Ransomware encrypts but doesn't typically transfer data outbound (B). Phishing is an email-based delivery mechanism (C).
- Which of the following best describes the concept of 'attack surface' in cybersecurity?
Answer: The sum of all points where an unauthorized user can try to enter or extract data from a system or organization - including network entry points, applications, users, and physical access.
Attack surface encompasses everything an attacker could exploit - network interfaces, web applications, user accounts, email, physical access points, third-party connections. Reducing attack surface is a fundamental security principle. Answer D is correct. Attack frequency (A), physical perimeter (B), and vulnerability lists (C) are components but not the full definition.
- Which of the following vulnerabilities is most commonly exploited in ransomware attacks?
Answer: Unpatched software vulnerabilities, weak remote access controls (RDP), and phishing emails delivering malicious attachments.
Ransomware commonly enters through phishing emails, unpatched vulnerabilities, and exposed remote desktop protocol (RDP) ports - making patch management, email security, and remote access controls the primary defenses. Answer A is correct. Database permissions (B), data classification (C), and logging gaps (D) are not primary ransomware entry vectors.
