Network Attacks And Defense Strategies

During an incident response engagement, a security analyst discovers that an attacker executed a Server-Side Request Forgery (SSRF) vulnerability on an internal web application to access cloud instance metadata services (IMDS). Which remediation step should be applied immediately to the cloud application architecture to prevent future SSRF exploitation against IMDS?

A wireless security audit reveals that an unauthorized rogue access point has been deployed within the corporate perimeter, configured with the exact same SSID as the corporate enterprise network to perform an evil twin attack. Which enterprise wireless feature should the network administrator configure on the Wireless LAN Controller (WLC) to automatically detect and contain this rogue AP?

An enterprise network utilizes 802.1X port-based authentication with a RADIUS server. An attacker performs a port-stealing attack by spoofing the MAC address of an authenticated, active wired client to gain network access on a different switch port. Which switch security feature should be enabled to prevent this attack?

A security analyst suspects that an internal host has been compromised and is communicating via an encrypted Command and Control (C2) channel utilizing DNS tunneling. Which Wireshark filter and analysis technique should the analyst employ to definitively identify this anomaly?

An organization's Security Information and Event Management (SIEM) system alerts on suspicious Active Directory enumeration activity. An internal workstation is executing frequent unauthenticated LDAP queries requesting large numbers of user and group attributes. Which protocol mechanism and defensive configuration should be implemented to mitigate this reconnaissance technique?

A security team receives alerts indicating that an attacker is performing ARP cache poisoning on the local subnet to conduct a Man-in-the-Middle (MitM) attack. Which switch feature should the network administrator enable to mitigate this threat?

An organization is hardening its public-facing email infrastructure against spoofing and phishing attacks. The security engineer needs to configure a DNS record that specifies which mail servers are authorized to send email on behalf of the domain. Which DNS record type must be created?

A network administrator observes continuous SYN flooding targeting a primary public-facing web server on a Cisco ASA 5500-X firewall. To mitigate this attack without disrupting legitimate traffic, which specific feature should the administrator enable globally via the command-line interface?

A company's intrusion detection system (IDS) flags multiple suspicious packets containing shellcode signatures destined for an internal database server. However, the security team determines that the application was updated and the traffic was a false positive. Which action should the security analyst take within the Snort configuration to prevent this specific signature from generating future alerts?

An attacker attempts a Kerberoasting attack by requesting a Service Ticket (TGS) for a service account running with a Service Principal Name (SPN) from a compromised domain user account, then attempts to crack the service account's password offline. Which security hardening practice should be implemented in Active Directory to mitigate this risk?

An administrator notices unusual traffic volume exiting an internal server toward an unknown external IP address on TCP port 4443. Further investigation reveals data exfiltration. Which firewall feature should be configured at the perimeter to inspect and block unauthorized outbound application traffic and unknown protocols?

An attacker compromises an internal workstation and attempts to perform lateral movement using PsExec. The security team wants to detect and block this activity across the internal Windows domain. Which Windows Defender Firewall with Advanced Security rule or Group Policy setting should be deployed?

A security analyst is hardening a Linux-based web server and wants to implement mandatory access control (MAC) to restrict processes to only the resources necessary for their function. Which built-in Linux kernel security module should the analyst configure?

An enterprise network is subjected to a distributed denial-of-service (DDoS) volumetric UDP reflection and amplification attack utilizing Network Time Protocol (NTP) monlist queries. Which configuration change should be applied to enterprise NTP servers to prevent them from participating in amplification attacks?

A security engineer is configuring a Snort Intrusion Prevention System (IPS) rule to detect ICMP echo requests with payloads larger than 1000 bytes, which may indicate covert channel data exfiltration. Which rule header and options combination is correct?

An organization's web application is vulnerable to SQL injection (SQLi). An attacker is using union-based queries to extract database contents. Which defensive technology placed in front of the web application can inspect HTTP parameters and block SQLi signatures dynamically?

A network security analyst observes an ongoing brute-force attack against an SSH service running on a Linux server. Which tool can the analyst configure to automatically inspect authentication failure logs and dynamically block attacker IP addresses via iptables?

An enterprise wireless network uses WPA2-Enterprise for authentication. A security administrator wants to upgrade the security posture to protect against offline dictionary attacks on handshakes and provide enhanced cryptographic cipher suites. Which standard should be implemented?

An attacker performs a pass-the-hash attack to move laterally across an enterprise network using compromised NTLM hashes. The security architecture team wants to implement host-based mitigations to render harvested NTLM hashes unusable for authentication. Which Windows security feature should be enabled?

An internal security assessment reveals that an attacker with access to a low-privilege domain user account can enumerate Active Directory group memberships and trust relationships using LDAP. To secure Active Directory against anonymous and excessive unauthenticated enumeration, which specific Active Directory feature and setting should be configured?

A security engineer discovers that an attacker is exploiting a vulnerability in a web application's JSON Web Token (JWT) implementation by modifying the algorithm header to 'none' and bypassing signature verification. How should the application's JWT validation code be updated to fix this vulnerability?

An organization is implementing cloud security posture management (CSPM) for its multi-cloud environment. The security team needs to ensure that Amazon S3 storage buckets are not publicly accessible due to misconfigurations. Which automated preventive control should be enforced?

An organization wants to protect its internal network against unauthorized DHCP servers (DHCP spoofing and rogue DHCP starvation attacks). Which switch security feature should be enabled on all untrusted access switch ports?

An attacker targets an enterprise Active Directory domain by performing a DCSync attack, successfully replicating domain controller password data without being a domain controller. Which Active Directory access control rights must be audited and protected to prevent non-administrative users from executing DCSync?

A security engineer is hardening a corporate Linux server against privilege escalation. A local user account executes a poorly written binary with the SUID (Set Owner User ID) permission set, gaining root privileges. Which command should the engineer run to locate and remove SUID permissions from unauthorized binaries across the filesystem?

A security analyst notices unusual outbound traffic matching command-and-control (C2) beaconing patterns over HTTPS. The organization wants to inspect outbound encrypted traffic to detect malicious payloads without violating compliance policies. Which enterprise security architecture technique should be implemented?

A security analyst is reviewing network traffic logs and discovers indicators of an Advanced Persistent Threat (APT) utilizing covert command-and-control (C2) communication. Which TWO methods are commonly used by attackers to obfuscate C2 traffic through legitimate network services? (Choose TWO)

An enterprise is updating its email security controls to prevent phishing, credential harvesting, and spoofing attacks. Which THREE protocols and DNS records should be implemented and strictly enforced? (Choose THREE)

An organization's security team is designing a defense-in-depth network architecture to protect critical internal data zones. Which THREE architectural principles and controls should be implemented to align with an adaptive defense strategy? (Choose THREE)

An attacker compromises an internal Active Directory domain and attempts to leverage Kerberos vulnerabilities and misconfigurations to elevate privileges or establish persistence. Which TWO attacks rely on Kerberos protocol mechanics? (Choose TWO)

A network administrator is hardening a Cisco switch infrastructure against Layer 2 attacks. Which THREE features should be enabled and configured on the access and distribution layers? (Choose THREE)

A security operations center (SOC) analyst is investigating a compromised Linux web server. Which TWO log files and forensic artifacts should the analyst examine to determine the initial access vector and persistence mechanisms used by the attacker? (Choose TWO)

A security team is implementing defense-in-depth controls to protect an enterprise wireless network against advanced attacks. Which TWO advanced hardening and security configurations should be deployed? (Choose TWO)

An enterprise cloud security team is reviewing common cloud security vulnerabilities and misconfigurations that lead to data breaches. Which TWO threats are primary vectors in cloud environments? (Choose TWO)

An organization is hardening its network architecture against supply chain attacks targeting third-party software dependencies and vendor integrations. Which TWO best practices and controls should be implemented? (Choose TWO)

An enterprise incident response team is analyzing a ransomware attack that encrypted network file shares and endpoints. Which TWO immediate containment and eradication actions should the team execute? (Choose TWO)

An organization's security engineer is configuring a Web Application Firewall (WAF) to protect against common web attacks. Which TWO attack types should the WAF rules be specifically tuned to detect and block? (Choose TWO)