Scenario practice questions

MitM

Why wrong: MitM intercepts communications, not overloads servers.

DoS

Why wrong: DoS typically originates from a single source, not multiple systems.

Botnet

Why wrong: Botnet is the network of compromised systems used in DDoS, but the attack itself is DDoS.

DNS tunneling

Why wrong: DNS tunneling uses successful queries, not NXDOMAIN.

Legitimate website misconfiguration

Why wrong: Misconfiguration typically returns consistent NXDOMAIN for specific records, not high volume.

Normal DNS caching behavior

Why wrong: Caching does not generate high NXDOMAIN volume.

The SQL injection flaw in the application is a threat.

Why wrong: A threat is the potential danger that exploits a vulnerability.

The combination of the vulnerability and threat is the exploit.

Why wrong: An exploit is the actual attack, not the combination.

The possibility of an attacker exploiting the SQL injection is a vulnerability.

Why wrong: Vulnerability is the weakness, not the possibility.

True negative

Why wrong: True negative means no alert and no attack.

False negative

Why wrong: False negative means attack missed.

True positive

Why wrong: True positive would mean a real attack.

Remote administration

Why wrong: Remote administration is legitimate but the timing and volume suggest exfiltration.

DNS query

Why wrong: DNS uses port 53.

FTP file transfer

Why wrong: FTP uses port 21, not 22.

Non-repudiation

Why wrong: Non-repudiation is about preventing denial of actions, not directly related.

Risk

Why wrong: Risk is a broader measure; the specific event is more about threat and exploit.

Vulnerability

Why wrong: A vulnerability is a weakness; the scenario shows an attempt to exploit, not the weakness itself.

Monitor alerts and perform initial triage

Why wrong: That is Tier 1's role.

Make decisions on business impact and notification

Why wrong: That is usually CISO or management.

Conduct threat hunting and advanced forensics

Why wrong: That is typically Tier 3.

Coordinate with legal counsel for data breach notification

Why wrong: Legal counsel handles notifications, not Tier 1.

Develop new detection signatures

Why wrong: Signature development is often Tier 3.

Perform deep forensic analysis of the malware

Why wrong: Deep forensic analysis is typically Tier 3.

It stores threat intelligence locally

Why wrong: MISP or similar platforms store intelligence.

It is a platform for malware analysis

Why wrong: TAXII is not a platform.

It defines the format for threat indicators

Why wrong: STIX defines the format.

Deploy the patch only at the end of the business day

Why wrong: While better than waiting, emergency approval is still needed to reboot during business hours.

Wait for the next scheduled change window

Why wrong: Delaying patching exposes the organization to exploitation.

Install the patch without approval

Why wrong: Installing without approval bypasses change control and could have unintended consequences.

There is a network issue causing duplicate logs.

Why wrong: Unlikely.

The account is compromised.

Why wrong: Possible but not the most likely.

The account is being used by an automated script.

Why wrong: Scripts typically run from single IP.

The logging system is malfunctioning.

Why wrong: Not suggested by logs.

Change the database administrator password immediately

Why wrong: Password change is insufficient if the attacker has a remote access tool installed.

Check if the SSH connection was an authorized remote administration session

Why wrong: The connection originated from the database server, not from an admin; it is likely malicious.

Investigate the database server logs for signs of compromise before taking action

Why wrong: Containment must come before investigation to stop ongoing data loss.

The host is scanning for open NTP servers.

Why wrong: Scanning would show traffic to multiple ports, not just to port 123 on many IPs.

Data exfiltration via NTP tunneling.

Why wrong: NTP tunneling is possible but less common; the volume and pattern suggest amplification.

The host is performing an NTP time synchronization query.

Why wrong: The host does not run NTP services and the volume is too high for normal sync.

ARP spoofing

Why wrong: ARP spoofing is a specific technique used in MitM attacks, but the description is broader.

DNS poisoning

Why wrong: DNS poisoning corrupts DNS resolution, but not necessarily interception of existing communications.

Denial of Service (DoS)

Why wrong: DoS aims to disrupt availability, not intercept communications.

Social engineering

Why wrong: Social engineering is a broader category; the specific attack here is vishing.

Phishing

Why wrong: Phishing is usually via email or messages, not phone calls.

Malware

Why wrong: Malware involves malicious software, not phone calls.

Block the external IP address at the firewall

Why wrong: Blocking the IP may stop exfiltration but does not address the root cause or prevent other exfiltration methods.

Notify the server's administrator

Why wrong: Notification is important but should not delay containment; the immediate action is to disconnect.

Capture a packet capture (PCAP) of the traffic for analysis

Why wrong: PCAP is useful for analysis but is not an immediate containment action; data continues to be exfiltrated.

A successful HTTP connection from the outside to the inside server

Why wrong: The message clearly states "Deny", not "Permit".

A VPN tunnel initiation that was rejected due to authentication failure

Why wrong: There is no indication of VPN or authentication in the message.

A NAT translation failure for an outbound connection

Why wrong: The source is outside and destination inside, indicating an inbound connection; no NAT failure is mentioned.

An external host is scanning the router.

Why wrong: Source is internal IP 10.0.0.2.

The router is under a brute-force attack on the HTTP server.

Why wrong: The logs show denied packets, not multiple authentication attempts.

The router is infected with malware and generating traffic.

Why wrong: The traffic is from the server, not the router.