Network Attacks And Defense Strategies

During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?

An organization's Security Information and Event Management (SIEM) system alerts on suspicious Active Directory enumeration activity. An internal workstation is executing frequent unauthenticated LDAP queries requesting large numbers of user and group attributes. Which protocol mechanism and defensive configuration should be implemented to mitigate this reconnaissance technique?

A security team receives alerts indicating that an attacker is performing ARP cache poisoning on the local subnet to conduct a Man-in-the-Middle (MitM) attack. Which switch feature should the network administrator enable to mitigate this threat?

An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

An attacker performs a cross-site scripting (XSS) attack against a web application, successfully stealing sensitive session cookies from victim browsers. The security team is tasked with updating the application's cookie configuration attributes. Which two cookie flags must be set to protect session cookies against theft via XSS and network sniffing?

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?

An attacker performs a pass-the-hash attack to move laterally across an enterprise network using compromised NTLM hashes. The security architecture team wants to implement host-based mitigations to render harvested NTLM hashes unusable for authentication. Which Windows security feature should be enabled?

A security engineer discovers that an attacker is exploiting a vulnerability in a web application's JSON Web Token (JWT) implementation by modifying the algorithm header to 'none' and bypassing signature verification. How should the application's JWT validation code be updated to fix this vulnerability?

An organization is implementing cloud security posture management (CSPM) for its multi-cloud environment. The security team needs to ensure that Amazon S3 storage buckets are not publicly accessible due to misconfigurations. Which automated preventive control should be enforced?

An organization wants to protect its internal network against unauthorized DHCP servers (DHCP spoofing and rogue DHCP starvation attacks). Which switch security feature should be enabled on all untrusted access switch ports?

An attacker targets an enterprise Active Directory domain by performing a DCSync attack, successfully replicating domain controller password data without being a domain controller. Which Active Directory access control rights must be audited and protected to prevent non-administrative users from executing DCSync?

A security engineer is hardening a corporate Linux server against privilege escalation. A local user account executes a poorly written binary with the SUID (Set Owner User ID) permission set, gaining root privileges. Which command should the engineer run to locate and remove SUID permissions from unauthorized binaries across the filesystem?

A security analyst notices unusual outbound traffic matching command-and-control (C2) beaconing patterns over HTTPS. The organization wants to inspect outbound encrypted traffic to detect malicious payloads without violating compliance policies. Which enterprise security architecture technique should be implemented?

A security analyst is reviewing network traffic logs and discovers indicators of an Advanced Persistent Threat (APT) utilizing covert command-and-control (C2) communication. Which TWO methods are commonly used by attackers to obfuscate C2 traffic through legitimate network services? (Choose TWO)

An enterprise is updating its email security controls to prevent phishing, credential harvesting, and spoofing attacks. Which THREE protocols and DNS records should be implemented and strictly enforced? (Choose THREE)

An organization's security team is designing a defense-in-depth network architecture to protect critical internal data zones. Which THREE architectural principles and controls should be implemented to align with an adaptive defense strategy? (Choose THREE)

A network administrator is hardening a Cisco switch infrastructure against Layer 2 attacks. Which THREE features should be enabled and configured on the access and distribution layers? (Choose THREE)

A security operations center (SOC) analyst is investigating a compromised Linux web server. Which TWO log files and forensic artifacts should the analyst examine to determine the initial access vector and persistence mechanisms used by the attacker? (Choose TWO)

A security team is implementing defense-in-depth controls to protect an enterprise wireless network against advanced attacks. Which TWO advanced hardening and security configurations should be deployed? (Choose TWO)

An enterprise cloud security team is reviewing common cloud security vulnerabilities and misconfigurations that lead to data breaches. Which TWO threats are primary vectors in cloud environments? (Choose TWO)

An organization is hardening its network architecture against supply chain attacks targeting third-party software dependencies and vendor integrations. Which TWO best practices and controls should be implemented? (Choose TWO)

An enterprise incident response team is analyzing a ransomware attack that encrypted network file shares and endpoints. Which TWO immediate containment and eradication actions should the team execute? (Choose TWO)

An organization's security engineer is configuring a Web Application Firewall (WAF) to protect against common web attacks. Which TWO attack types should the WAF rules be specifically tuned to detect and block? (Choose TWO)

A SOC analyst reviewing perimeter firewall logs notices a high volume of inbound TCP SYN packets with randomized source IP addresses targeting multiple open ports on a public-facing web server, and the server's connection table is nearly exhausted. The organization wants to stop this activity at the network edge without blocking legitimate clients. Which solution should the analyst recommend?

A hospital's network team observes that a single internal host is flooding the Layer 2 CAM table of an access switch with thousands of frames, each carrying a different source MAC address. As a result, the switch begins flooding all unicast traffic out of every port, allowing the attacker to capture traffic destined for other hosts. Which attack is being executed, and which countermeasure most directly addresses it?

A security analyst reviewing firewall logs notices periodic outbound connections from an internal engineering workstation to a small set of foreign IP addresses, always at roughly 60-second intervals, with payload sizes that vary slightly and destinations that rotate through a hardcoded list. The traffic uses TCP port 443 but the TLS certificate presented by the remote endpoint is self-signed and the User-Agent string is unusual. Which technique is most consistent with these observations?

An attacker on the same wireless network as a corporate user sets up a rogue access point that broadcasts the same SSID as the legitimate corporate network and offers a stronger signal. Users connect automatically, and the attacker captures their credentials through a fake captive portal. Which attack has been performed?

A company suspects that an insider is using a DNS tunneling tool to exfiltrate small amounts of sensitive data through the corporate recursive resolver. The tool encodes data in the leftmost labels of queries to a domain the company does not own. Which detection approach is most likely to reveal this activity on existing network telemetry?

A retail company's security team is designing defenses against Distributed Denial of Service (DDoS) attacks targeting its public web tier. The team wants to reduce the impact of volumetric floods while preserving legitimate customer traffic. Which THREE measures are appropriate components of the defense strategy? (Choose three.)