CCNA Threats Vulnerabilities Questions — Page 3 of 4

151

Multi-Selecthard

A packet capture from a branch office shows the default gateway IP mapped to a MAC address that does not belong to the router. The same suspicious MAC also answers for the DNS server IP, and gratuitous ARP replies appear every 30 seconds. Which two attacks best match this evidence? Select two.

Select 2 answers

A.ARP spoofing or poisoning is occurring on the local network.

B.A man-in-the-middle interception is likely happening between clients and internal services.

C.The network is experiencing a SYN flood against the gateway.

D.An external host is performing broad port scanning on public services.

E.A password-spraying campaign is targeting remote logins.

AnswersA, B

The evidence fits ARP poisoning because an unauthorized MAC address is associating itself with trusted IP addresses such as the gateway and DNS server. Gratuitous ARP replies reinforce the cache manipulation and allow the attacker to redirect traffic at the layer 2 level. This is the classic setup for a local network spoofing attack.

Why this answer

The evidence shows the default gateway IP is mapped to a MAC address that does not belong to the router, and the same suspicious MAC also answers for the DNS server IP. This is a classic indicator of ARP spoofing or poisoning, where an attacker sends forged ARP replies to associate their MAC address with the IP addresses of critical network devices, such as the gateway and DNS server. Gratuitous ARP replies every 30 seconds further confirm an active ARP poisoning attack, as the attacker repeatedly broadcasts these unsolicited replies to maintain the poisoned ARP cache entries on victim hosts.

Exam trap

The trap here is that candidates may confuse ARP spoofing with a SYN flood or other denial-of-service attacks, failing to recognize that the specific evidence of a mismatched MAC address and gratuitous ARP replies directly points to ARP cache poisoning, not a network-level flood.

Practice this question →

152

MCQmedium

Threat intelligence reports that an adversary changes domains daily and uses disposable cloud hosting, but the malware binary hash and a unique mutex name remain unchanged across incidents. Which indicator is the best candidate for immediate detection rule creation?

A.The daily domain names, because they are the easiest items to collect.

B.The malware file hash, because it directly identifies the reused sample.

C.The cloud provider name, because the attacker uses disposable infrastructure.

D.The time of day the campaign was observed, because the attacker is consistent.

AnswerB

The file hash is the strongest immediate IOC here because the same malware sample is being reused across incidents. If the binary remains unchanged, the hash will match exactly and can be used for fast blocking or hunting. Volatile infrastructure such as domains and cloud hosting changes too frequently to serve as the primary detection point.

Why this answer

The malware file hash (e.g., SHA-256) provides a static, deterministic identifier for the exact binary sample. Since the adversary reuses the same malware binary across incidents, the hash remains unchanged and can be used to create a precise detection rule (e.g., a YARA rule or hash-based IOC blocklist) that will reliably match the malicious file regardless of network-level churn like domain or IP changes.

Exam trap

The trap here is that candidates often choose the 'easiest' or most visible indicator (domain names) without considering stability and false-positive risk, whereas the exam tests the principle that static, unique artifacts (like file hashes) are superior for detection rule creation.

How to eliminate wrong answers

Option A is wrong because daily domain names are highly volatile and ephemeral; they change every 24 hours, making them poor candidates for a stable detection rule and requiring constant updates. Option C is wrong because the cloud provider name (e.g., AWS, Azure, GCP) is a generic attribute shared by millions of legitimate services; using it as a detection indicator would cause massive false positives and does not uniquely identify the adversary's infrastructure. Option D is wrong because the time of day the campaign was observed is not a reliable or unique indicator; attackers can easily shift their activity window, and time-based rules lack specificity and are prone to false positives.

Practice this question →

153

MCQmedium

A help desk analyst receives a phone call from someone claiming to be the CFO, who says their phone was lost while traveling and requests an immediate MFA reset and temporary bypass for payroll access. The caller knows the CFO's last name and the company name, but cannot answer the callback verification question. What attack technique is most likely being used?

A.Phishing

B.Vishing

C.Baiting

D.Watering hole attack

AnswerB

Vishing (voice phishing) is the correct classification because the entire attack is executed over a direct phone call, a hallmark of voice-based social engineering. The attacker creates a false sense of urgency and asserts authority, likely impersonating an executive or IT administrator, to pressure the help desk analyst into bypassing standard verification and changing authentication controls. This call is a deliberate manipulation of a human process, not a technical exploit, and vishing is specifically designed to target help desk personnel who have the power to reset credentials or alter account access.

Why this answer

The caller is using voice communication to impersonate a high-level executive (CFO) and manipulate the help desk analyst into bypassing security controls, which is the defining characteristic of vishing (voice phishing). The request for an MFA reset and temporary bypass is a social engineering tactic to exploit the analyst's authority bias and urgency, and the inability to pass callback verification confirms the caller is not legitimate.

Exam trap

The trap here is that candidates may confuse vishing with phishing because both involve social engineering, but vishing is specifically voice-based, and the question's context of a phone call and callback verification failure directly points to vishing, not email-based phishing.

How to eliminate wrong answers

Option A (Phishing) is wrong because phishing typically involves deceptive emails, text messages, or websites to steal credentials or deliver malware, not a direct phone call requesting an MFA bypass. Option C (Baiting) is wrong because baiting relies on offering something enticing (e.g., a free USB drive or download) to trick a victim into performing an action, not impersonating an executive over the phone. Option D (Watering hole attack) is wrong because it compromises a website frequently visited by the target group to infect them with malware, not a direct social engineering call to a help desk.

Practice this question →

154

MCQmedium

A security analyst is reviewing the results of a dynamic application security test (DAST) on a new e-commerce application. The report indicates that the application's product search functionality is vulnerable to blind SQL injection. The analyst is tasked with recommending a remediation to the development team. The developers currently concatenate user input directly into SQL queries. Which of the following recommendations would most effectively and permanently mitigate this vulnerability?

A.Implement a web application firewall (WAF) rule to block suspicious SQL keywords in search parameters.

B.Sanitize user input by escaping single quotes and other special characters before concatenation.

C.Replace dynamic SQL queries with parameterized prepared statements.

D.Encode all user input using HTML entity encoding before database operations.

AnswerC

Parameterized prepared statements ensure that user input is always treated as data, not executable code. The database compiles the SQL statement with parameter placeholders, and the actual values are bound separately. This completely prevents SQL injection because the input cannot alter the query structure. This is the industry-standard permanent fix.

Why this answer

Parameterized prepared statements separate SQL logic from user input, ensuring that input is always treated as data, not executable code. This permanently prevents SQL injection by design, regardless of the input content, unlike input filtering or WAF rules which can be bypassed.

Exam trap

The trap here is that candidates often choose input sanitization (Option B) because they confuse escaping with proper parameterization, not realizing that escaping is a fragile, context-dependent workaround that fails against advanced injection techniques like time-based blind SQLi or multi-byte character attacks.

Why the other options are wrong

A WAF can block known SQL injection patterns but does not fix the root cause; attackers can bypass WAF rules using encoding or other techniques, and it does not prevent injection in all cases.

Escaping special characters is error-prone and can be bypassed by attackers using alternative encodings or complex payloads; it does not eliminate the SQL injection vulnerability because the query structure remains dynamic.

HTML entity encoding is designed to prevent XSS attacks by neutralizing HTML special characters, not SQL injection. It does not alter SQL syntax or prevent malicious SQL from being interpreted by the database.

Practice this question →

155

MCQmedium

A public-facing web service suddenly becomes very slow. NetFlow shows a high volume of small DNS queries leaving attacker-controlled systems and much larger DNS responses arriving at the victim's IP address from many different resolvers. Which attack is taking place?

A.DNS amplification DDoS

B.Replay attack

C.ARP poisoning

D.Session fixation

AnswerA

DNS amplification is a reflection-based volumetric DDoS attack: the attacker sends small UDP queries (often using the ANY or DNSSEC record types) to numerous open recursive resolvers, spoofing the victim's IP address as the source. The resolvers then send large responses (up to 50-100 times the request size) to the victim, saturating its bandwidth and connection table. Netflow would show a flood of inbound UDP traffic from many DNS servers to the victim, with little or no corresponding outbound traffic, which matches the observed slowdown.

Why this answer

This is a DNS amplification DDoS attack. The attacker sends small DNS queries with a spoofed source IP (the victim's IP) to open DNS resolvers, which then send large DNS responses to the victim. The high volume of small queries and much larger responses from many resolvers is the classic signature of an amplification attack, exploiting the UDP protocol's lack of source verification.

Exam trap

The trap here is that candidates may confuse the high volume of DNS traffic with a normal DNS flood or a reflection attack, but the key differentiator is the amplification ratio—small queries generating large responses—which is unique to amplification DDoS, not a simple reflection or volumetric flood.

How to eliminate wrong answers

Option B is wrong because a replay attack involves capturing and retransmitting valid network traffic (e.g., authentication packets) to impersonate a user or gain unauthorized access, not generating high-volume DNS traffic from multiple resolvers. Option C is wrong because ARP poisoning is a local network attack that manipulates ARP tables to intercept traffic on a LAN, not a distributed attack using DNS queries and responses across the internet.

Practice this question →

156

MCQeasy

A user's laptop starts renaming many documents, and a ransom note appears on the desktop. What is the best immediate action for the help desk to recommend?

A.Shut down the laptop immediately and leave it on the desk.

B.Disconnect the laptop from the network to contain the infection.

C.Delete the ransom note and continue working until the next reboot.

D.Install a new browser extension to block the attacker.

AnswerB

Disconnecting the laptop from the network deprives the ransomware of both lateral movement and command-and-control communication. Without network access, it cannot propagate via SMB/Windows Admin Shares, reach mapped drives, or download additional payloads/ransomware variants, while the live system stays intact for volatile memory collection. Physically unplugging the Ethernet cable or disabling Wi-Fi in the OS is a practical containment step that should be done before any reboot or cleanup.

Why this answer

Disconnecting the laptop from the network immediately stops the ransomware from communicating with its command-and-control (C2) server, preventing further encryption of network shares and lateral movement. This containment step is critical before any remediation, as it isolates the threat and preserves evidence for forensic analysis.

Exam trap

The trap here is that candidates confuse immediate containment with system shutdown, mistakenly believing that powering off stops the attack, when in fact network isolation is the correct first step to halt both encryption and lateral spread.

How to eliminate wrong answers

Option A is wrong because shutting down the laptop may allow the ransomware to complete its encryption process during shutdown and could destroy volatile evidence (e.g., memory-resident encryption keys). Option C is wrong because deleting the ransom note does not stop the encryption process; the ransomware continues to encrypt files in the background, and working normally risks further damage and potential spread to network resources. Option D is wrong because installing a browser extension does not address the active ransomware infection; it is an irrelevant and potentially harmful action that could introduce additional vulnerabilities.

Practice this question →

157

MCQmedium

A security analyst receives a phone call from an individual claiming to be a member of the IT help desk. The caller states that an emergency security update requires the analyst's password immediately, and the request sounds urgent. The analyst notices the caller's voice is unfamiliar and the background noise is inconsistent with an office environment. Which type of social engineering attack is being attempted?

A.Phishing

B.Vishing

C.Spear phishing

D.Pretexting

AnswerB

Vishing (voice phishing) is the correct answer because the attack uses a phone call to impersonate a legitimate entity and trick the victim into providing sensitive information, such as a password. The urgency and caller ID spoofing are common vishing tactics.

Why this answer

This is a vishing (voice phishing) attack because the threat actor uses a phone call to impersonate IT help desk personnel and pressures the analyst into disclosing sensitive credentials. Vishing specifically leverages voice communication to bypass email-based security controls and exploit human trust through urgency and authority.

Exam trap

The trap here is that candidates confuse pretexting with vishing, but CompTIA distinguishes vishing as a subtype of social engineering that specifically uses voice technology, whereas pretexting is the broader act of fabricating an identity or scenario regardless of the communication channel.

Why the other options are wrong

Phishing typically involves deceptive emails or websites, not phone calls. This scenario describes a voice-based attack, which is vishing.

Spear phishing involves targeted, personalized emails or messages, not phone calls. The attack described uses a phone call, which is characteristic of vishing, not spear phishing.

Pretexting involves creating a fabricated scenario to obtain information, but the question specifically describes a phone call requesting a password, which is vishing (voice phishing). The attack is not pretexting because the caller is not establishing a false identity beyond claiming to be IT help desk; the primary threat is the phone-based phishing attempt.

Practice this question →

158

MCQmedium

A security analyst is investigating a web application that allows users to input a filename to view its contents. The application passes the user input directly to a system command without sanitization. An attacker submits the input 'file.txt; cat /etc/passwd' and successfully retrieves the contents of the password file. Which type of attack occurred?

A.Cross-site scripting (XSS)

B.SQL injection

C.Command injection

D.Directory traversal

AnswerC

Command injection is a server-side vulnerability where an attacker inserts operating system commands into input fields that are passed to system functions like exec() or system() without sanitization. The semicolon is a classic delimiter that allows chaining a second command after the intended one, enabling arbitrary code execution with the web server's privileges. This directly explains why the scenario points to command injection rather than other injection classes.

Why this answer

The application passes user input directly to a system command without sanitization. The attacker's input 'file.txt; cat /etc/passwd' uses a semicolon to terminate the intended command and execute a second command, which retrieves the password file. This is a classic command injection attack, where arbitrary system commands are executed via the vulnerable interface.

Exam trap

The SY0-701 exam often tests the distinction between command injection and directory traversal by using a payload that includes both a path and a command separator, leading candidates to mistakenly choose directory traversal when the core exploit is command execution via shell metacharacters.

Why the other options are wrong

The attack involves injecting a system command via user input, not injecting client-side scripts into web pages viewed by other users.

The attack involves executing system commands via user input, not manipulating a database query. SQL injection targets database queries, not system commands.

Directory traversal involves accessing files outside the web root by manipulating path parameters (e.g., '../../etc/passwd'), not by injecting commands. The attacker here injected a command separator (';') to execute an arbitrary system command, which is command injection.

Practice this question →

159

MCQeasy

A security team can patch only one system today. Which asset should be remediated first?

A.An internal print server with a high-severity finding and no direct user access

B.A lab workstation with a critical finding and no sensitive data

C.An internet-facing application server with a critical vulnerability and a known exploit

D.A user laptop with a medium-severity issue that requires local access

AnswerC

An internet-facing system with a critical vulnerability and a known exploit has the highest immediate risk. Attackers can reach it easily, and public exploit code increases the chance of compromise, so it should be patched first.

Why this answer

An internet-facing application server with a critical vulnerability and a known exploit represents the highest risk: it is exposed to external threats, the vulnerability is critical, and a known exploit means attackers can reliably compromise it. Patching this system first reduces the likelihood of a remote breach that could lead to data exfiltration or service disruption, aligning with the principle of prioritizing assets with the greatest attack surface and exploitability.

Exam trap

CompTIA often tests the misconception that the highest CVSS score (critical vs. high/medium) alone dictates remediation priority, but the trap here is that asset exposure and exploitability—specifically an internet-facing server with a known exploit—override internal assets with higher severity but lower risk.

How to eliminate wrong answers

Option A is wrong because an internal print server with a high-severity finding and no direct user access has a lower attack surface (internal network only) and no direct user interaction, making it less urgent than an internet-facing system with a critical vulnerability and known exploit. Option B is wrong because a lab workstation with a critical finding and no sensitive data, while serious, is typically isolated or used for testing, so the impact of compromise is limited compared to an externally reachable server. Option D is wrong because a user laptop with a medium-severity issue that requires local access is less critical—medium severity and local access requirement reduce the likelihood of remote exploitation, and user laptops can often be mitigated temporarily with user awareness or endpoint controls.

Practice this question →

160

MCQeasy

An employee receives a text message that says, "Your MFA enrollment expired. Tap here now to re-activate access or your account will be locked." What should the employee do first?

A.Tap the link and complete the MFA reset immediately

B.Verify the request using a known company contact method and report the text

C.Forward the text to coworkers so they can watch for it too

D.Reply to the sender and ask for more details

AnswerB

This is the best first step because the employee should not trust a security-related request delivered through an unexpected text message. Using a known internal help desk number, portal, or security reporting process confirms whether the request is legitimate. It also helps the organization investigate the suspicious message quickly.

Why this answer

The message is a classic phishing attempt designed to harvest MFA credentials or session tokens. The employee must first verify the request through a trusted company channel (e.g., calling the IT help desk or checking the official security portal) and then report the text to the security team. This prevents falling for social engineering that could bypass MFA protections.

Exam trap

The trap here is that candidates assume MFA is unbreakable and rush to re-enroll, not realizing that phishing kits can intercept MFA tokens in real time via reverse proxy attacks.

How to eliminate wrong answers

Option A is wrong because tapping the link could lead to a fake MFA portal that captures the employee's credentials or session tokens, compromising their account. Option C is wrong because forwarding the text to coworkers risks spreading the phishing attempt and may cause others to fall for it before the threat is contained. Option D is wrong because replying to the sender confirms the phone number is active and may expose the employee to further targeted attacks or malware delivery.

Practice this question →

161

MCQmedium

A vulnerability scan reports that a Windows file share has SMB signing disabled and anonymous read access is permitted to one directory containing payroll exports. No exploitation has been observed yet. Which action best reduces exposure with minimal business impact?

A.Remove all backup jobs until the scan is cleared.

B.Disable the file server and rebuild it from scratch immediately.

C.Enable SMB signing and remove anonymous access to the share.

D.Increase the directory quota so the share cannot overflow.

AnswerC

This is the best targeted remediation because it directly addresses both weaknesses identified by the scan. SMB signing helps protect integrity for SMB traffic, and removing anonymous read access prevents unauthorized users from viewing sensitive payroll data. Together, these changes reduce exposure without taking the entire server offline. In vulnerability management, the best choice is often a precise configuration fix that closes the finding while preserving business continuity and avoiding more disruptive action than necessary.

Why this answer

Enabling SMB signing prevents man-in-the-middle attacks that could tamper with file transfers, and removing anonymous read access eliminates unauthorized visibility into sensitive payroll data. These changes directly address the two vulnerabilities (SMB signing disabled and anonymous read access) without disrupting legitimate file-sharing operations, thus minimizing business impact.

Exam trap

The trap here is that candidates may overreact by choosing extreme remediation (like rebuilding the server) or irrelevant actions (like adjusting quotas), instead of recognizing that targeted configuration changes (enabling SMB signing and removing anonymous access) are the proportional, low-impact fix.

How to eliminate wrong answers

Option A is wrong because removing backup jobs does not address the SMB signing or anonymous access vulnerabilities; it would only increase data loss risk without reducing exposure. Option B is wrong because immediately disabling and rebuilding the file server is an extreme, unnecessary measure that causes significant business disruption; the vulnerabilities can be fixed with configuration changes. Option D is wrong because increasing the directory quota prevents overflow but does not mitigate the security issues of disabled SMB signing or anonymous read access.

Practice this question →

162

MCQmedium

A workstation starts failing security checks. The antivirus service no longer appears in the running process list, a known driver's hash does not match the vendor's value, and a task manager view shows fewer processes than expected. The user also reports that local admin tools behave inconsistently. What type of malware is most likely present?

A.Spyware

B.Rootkit

C.Trojan

D.Logic bomb

AnswerB

A rootkit is purpose-built to maintain privileged, stealthy access by manipulating the OS kernel, drivers, or core system files. It hooks system calls to hide malicious processes from the process list and may patch legitimate binaries, causing antivirus hash checks to fail. The workstation's failure of security checks due to missing processes and hash mismatches is the classic signature of a rootkit infection, as other malware types rarely exhibit this combination of systemic concealment and integrity violation.

Why this answer

The symptoms—antivirus service missing from the process list, a known driver's hash mismatch, fewer processes in Task Manager, and inconsistent admin tool behavior—are classic indicators of a rootkit. Rootkits operate at kernel or driver level, allowing them to hide processes, files, and registry keys from standard system tools, and they often tamper with driver hashes to evade integrity checks.

Exam trap

The trap here is that candidates often confuse a rootkit with a trojan because both can be stealthy, but the specific clues—driver hash mismatch and hidden processes—point to kernel-level manipulation unique to rootkits, not the user-level deception of a trojan.

How to eliminate wrong answers

Option A is wrong because spyware typically focuses on data theft and monitoring (e.g., keylogging, screen captures) and does not hide its processes or alter driver hashes at the kernel level. Option C is wrong because a trojan masquerades as legitimate software to gain initial access but does not inherently possess the capability to hide processes or modify driver hashes post-infection. Option D is wrong because a logic bomb is a dormant piece of code triggered by a specific condition (e.g., date or event) and does not actively hide processes or alter system drivers.

Practice this question →

163

MCQhard

Based on the exhibit, what is the BEST immediate containment action? The workstation is still powered on, and the user reports that files are being renamed and the system is running very slowly. The security analyst confirms malicious activity is in progress.

A.Immediately isolate the endpoint from the network using EDR containment or switch quarantine.

B.Power off the workstation immediately to prevent any further file changes.

C.Uninstall Microsoft Office so the malicious spreadsheet cannot launch again.

D.Block the destination IP address at the firewall and wait for the user to log off.

AnswerA

Isolating the endpoint via EDR containment or switch quarantine halts active malicious activity and lateral movement while preserving volatile memory and forensic evidence. Immediate network isolation is the fastest containment action for a live infection, unlike powering off, which destroys memory-resident evidence.

Why this answer

The immediate priority is to stop the active malicious activity (file renaming, system slowdown) by severing the workstation's network connectivity. EDR containment or switch quarantine isolates the endpoint at Layer 2, preventing the attacker from exfiltrating data, communicating with command-and-control servers, or spreading laterally, while preserving volatile memory for forensic analysis. This is faster and more controlled than powering off, which destroys evidence and may trigger destructive payloads.

Exam trap

CompTIA often tests the distinction between containment (stopping the spread) and eradication (removing the threat), tempting candidates to choose power-off or uninstall actions that destroy evidence or fail to stop active malicious processes.

How to eliminate wrong answers

Option B is wrong because powering off the workstation destroys volatile evidence (e.g., running processes, network connections, memory-resident malware) and may trigger destructive payloads designed to activate on shutdown. Option C is wrong because uninstalling Microsoft Office is a remediation step, not an immediate containment action; it does not stop the ongoing malicious activity and may take too long while the attacker continues to rename files. Option D is wrong because blocking the destination IP at the firewall does not stop the local malicious process already running on the workstation, and waiting for the user to log off allows further damage; containment must be applied directly to the endpoint.

Practice this question →

164

MCQmedium

A file server suddenly shows many encrypted files with a new extension, and endpoint tools report that Volume Shadow Copy Service was disabled minutes earlier. A note on the desktop demands payment in cryptocurrency. What should the security team do first?

A.Pay the ransom immediately to restore access quickly.

B.Isolate the affected systems from the network and preserve evidence.

C.Reimage the server immediately without documenting the event.

D.Disable antivirus alerts so staff can work without distractions.

AnswerB

Isolation is the first priority because it helps stop the spread of ransomware and prevents additional encryption or lateral movement. Preserving evidence at the same time supports later incident response, forensics, and potential legal or insurance needs. The organization can then assess the scope, validate backups, and begin containment and recovery in a controlled way. Immediate disconnection from the network is usually more valuable than attempting remediation on a live, actively infected host.

Why this answer

Isolating the affected systems from the network and preserving evidence is the correct first step because it prevents the ransomware from spreading to other systems via SMB or other network protocols, and it preserves the forensic artifacts (e.g., the ransom note, encrypted files, and Volume Shadow Copy Service logs) needed for incident response and potential decryption. Disabling VSS is a common ransomware tactic to prevent file recovery, so immediate containment is critical before any remediation.

Exam trap

The trap here is that candidates may confuse 'immediate remediation' (e.g., reimaging) with 'first response' (containment and evidence preservation), or they may incorrectly assume paying the ransom is a viable technical solution, when in fact it is never recommended in incident response frameworks like NIST SP 800-61.

How to eliminate wrong answers

Option A is wrong because paying the ransom does not guarantee decryption (attackers may not provide the key), it funds further criminal activity, and it violates most organizational security policies and legal guidelines. Option C is wrong because reimaging the server immediately destroys all forensic evidence (e.g., memory dumps, logs, encrypted file samples) that could be used for attribution, decryption research, or legal action, and it bypasses the necessary containment step to prevent lateral movement.

Practice this question →

165

MCQmedium

During triage, you see a legitimate browser process spawning powershell.exe with an encoded command, followed by an outbound connection to a newly registered domain. No new executable is written to disk. Which malware characteristic best fits this behavior?

A.Fileless malware that relies on scripting and memory-resident execution.

B.A macro virus that only runs when a document is opened.

C.A boot sector virus that persists by altering startup code.

D.A logic bomb that activates only when a specific date or event is reached.

AnswerA

This pattern matches malware that abuses trusted processes and scripts instead of dropping a traditional executable file. Browser-to-PowerShell chaining, encoded commands, and memory-resident activity are common indicators. The lack of a new file on disk does not mean the endpoint is clean; it often means the attacker is trying to evade traditional file-based detection.

Why this answer

The described behavior—a legitimate browser process spawning PowerShell with an encoded command, executing in memory without writing a new executable to disk, and making an outbound connection to a newly registered domain—is the classic hallmark of fileless malware. Fileless malware leverages built-in scripting engines (like PowerShell) and runs entirely in memory, avoiding traditional disk-based detection by antivirus and forensic tools.

Exam trap

The trap here is that candidates may assume any malware that doesn't write a file is a 'macro virus' or 'boot sector virus,' but the key differentiator is the use of a scripting engine (PowerShell) spawned by a legitimate process, combined with memory-only execution and an immediate C2 connection, which uniquely defines fileless malware.

How to eliminate wrong answers

Option B is wrong because a macro virus requires a document to be opened and typically writes a macro to the document or template, whereas the scenario involves a browser process spawning PowerShell with an encoded command and no document interaction. Option C is wrong because a boot sector virus alters the Master Boot Record (MBR) or Volume Boot Record (VBR) to persist on disk at system startup, but the scenario shows no disk write and execution is memory-resident via a scripting engine. Option D is wrong because a logic bomb triggers only when a specific condition (date, event, or user action) is met, but the scenario describes an immediate outbound connection following the PowerShell execution, with no mention of a delayed or conditional trigger.

Practice this question →

166

MCQeasy

A user reports that their laptop is showing frequent pop-up ads, the browser homepage keeps changing, and the system has become noticeably slower. What is the most likely immediate containment action?

A.Keep the laptop online so security tools can continue collecting data

B.Disconnect the laptop from the network and begin endpoint isolation

C.Immediately reimage the laptop before preserving any evidence

D.Ask the user to uninstall the browser and reinstall it manually

AnswerB

Disconnecting the laptop and isolating the endpoint halts any active malicious network activity, preventing lateral movement and cutting off command-and-control channels before the investigation proceeds. This containment step is the top priority in incident response because it preserves volatile data, such as running processes and network connections, while ensuring the threat cannot spread to other hosts. After isolation, analysts can safely perform triage, evidence preservation, and forensic data collection.

Why this answer

The best immediate action is to isolate the laptop from the network. The symptoms suggest malicious or unwanted software may be communicating with outside servers or affecting the browser. Isolation limits further damage, prevents possible spread, and gives responders time to inspect the system safely. This is a standard first containment step when a workstation appears compromised but is still active.

Why others are wrong: Keeping the laptop online risks continued malicious activity. Reimaging too early can destroy evidence needed for root-cause analysis. Simply reinstalling the browser may remove a symptom, but it does not address the possibility of a broader endpoint compromise.

Practice this question →

167

MCQmedium

A finance clerk reports a call from a person who claimed to be from the bank's fraud department. The caller knew the employee's name, referenced a recent invoice, and asked the employee to read back a one-time MFA code to stop a supposed payment block. Which attack is most likely?

A.Vishing, because the attacker is using a voice call to manipulate the target in real time.

B.Smishing, because the attacker requested a code and mentioned a financial problem.

C.Baiting, because the caller offered to fix the payment issue for the employee.

D.Tailgating, because the attacker used a trusted identity to gain access.

AnswerA

Vishing is voice-based phishing. The attacker used a phone call, gained trust with specific details, and pressured the employee to reveal an MFA code. That real-time conversation and the request for a secret value are classic indicators of a voice social engineering attempt.

Why this answer

The attack is vishing (voice phishing) because the attacker uses a telephone call to socially engineer the target into divulging a one-time MFA code. The real-time voice interaction and the specific request for an authentication code are hallmarks of vishing, which exploits human trust rather than technical vulnerabilities.

Exam trap

The trap here is confusing the delivery method (voice vs. text) and focusing on the content (request for a code) rather than the channel, leading candidates to incorrectly choose smishing when the attack is clearly voice-based.

How to eliminate wrong answers

Option B is wrong because smishing uses SMS text messages, not voice calls; the attacker here called the clerk, so the medium is voice, not text. Option C is wrong because baiting involves offering something enticing (e.g., a free USB drive) to lure the victim into an action, not a real-time request for a code over the phone. Option D is wrong because tailgating is a physical security attack where an unauthorized person follows an authorized individual into a restricted area; this scenario involves no physical access, only a phone call.

Practice this question →

168

MCQmedium

An EDR alert shows powershell.exe launching with an encoded command, no new executable written to disk, and a registry run key added for persistence. Outbound HTTPS traffic then begins to a rare external domain. Which type of malware behavior is most likely?

A.Worm behavior, because the malware is automatically spreading across the network.

B.Fileless attack, because the malicious activity is using legitimate tools and memory rather than a dropped payload.

C.Rootkit behavior, because the attacker is hiding from the operating system at a low level.

D.Spyware, because the malware is using HTTPS traffic to contact an external domain.

AnswerB

The alert shows encoded PowerShell, no new file on disk, and persistence through a registry run key. That pattern strongly suggests a fileless attack, where attackers abuse trusted system tools and memory-based execution to avoid traditional file detection.

Why this answer

The EDR alert describes a classic fileless attack: PowerShell.exe executes an encoded command in memory, no new executable is written to disk, and persistence is achieved via a registry run key. The outbound HTTPS traffic to a rare domain indicates command-and-control (C2) communication. Fileless malware leverages legitimate system tools (like PowerShell) and runs entirely in memory, bypassing traditional file-based detection.

Exam trap

The trap here is that candidates see 'HTTPS traffic to an external domain' and jump to spyware (Option D), but the question's emphasis on 'no new executable written to disk' and 'encoded command' points directly to fileless attack, not data exfiltration as the primary behavior.

How to eliminate wrong answers

Option A is wrong because worm behavior requires self-propagating across a network (e.g., exploiting vulnerabilities or copying itself), which is not indicated by a single PowerShell launch and registry persistence. Option C is wrong because rootkit behavior involves hiding from the OS at a low level (e.g., kernel-mode hooks or driver manipulation), not simply using PowerShell and registry keys. Option D is wrong because spyware typically exfiltrates data via HTTP/HTTPS, but the core behavior here—encoded command execution in memory with no file dropped—is the hallmark of a fileless attack, not spyware.

Practice this question →

169

MCQeasy

Users can reach the correct website name, but their browsers are redirected to a fake server after the local DNS cache is altered. What attack is most likely?

A.DNS poisoning

B.Denial of service

C.Replay attack

D.Port scanning

AnswerA

DNS poisoning corrupts the mapping between a domain name and its IP address, typically by injecting forged responses into a DNS resolver's cache. In this attack, users type a legitimate URL, but the resolver returns an attacker-controlled IP address, so the browser displays the correct domain while silently navigating to a fake server. This matches the scenario exactly because the address bar appears unchanged while traffic is misrouted to a malicious destination.

Why this answer

DNS poisoning (also known as DNS cache poisoning) occurs when an attacker inserts forged DNS resource records into the local DNS cache, causing subsequent queries for a legitimate domain to resolve to an attacker-controlled IP address. In this scenario, users type the correct website name, but because the local DNS cache has been altered, their browsers are redirected to a fake server. This directly matches the description of DNS poisoning.

Exam trap

The trap here is that candidates may confuse DNS poisoning with a man-in-the-middle attack or think that altering the local hosts file is the same mechanism, but the question specifically states the local DNS cache is altered, which is the hallmark of DNS cache poisoning.

How to eliminate wrong answers

Option B (Denial of service) is wrong because a denial-of-service attack aims to make a service unavailable by overwhelming it with traffic or exploiting vulnerabilities, not by redirecting users to a fake server after altering DNS cache. Option C (Replay attack) is wrong because a replay attack involves capturing and retransmitting valid network transmissions (e.g., authentication tokens) to impersonate a user or gain unauthorized access, not manipulating DNS resolution. Option D (Port scanning) is wrong because port scanning is a reconnaissance technique used to discover open ports and services on a target system, not an attack that alters DNS cache to redirect users.

Practice this question →

170

MCQmedium

A scanner reports a critical vulnerability on an internal Linux server. The administrator verifies the package is installed, but the vulnerable code path is only present in a plugin that has been disabled and removed from the service startup. The server cannot be patched until a vendor maintenance window next month. What is the best next step?

A.Ignore the finding because the scanner is clearly wrong

B.Create a time-limited exception and apply compensating controls until patching is possible

C.Reinstall the disabled plugin so the scanner output matches the running configuration

D.Expose the server to the internet for faster monitoring and patch testing

AnswerB

Creating a time-limited exception is a recognized risk treatment strategy that acknowledges the need to patch while balancing operational constraints. By formally accepting the risk for a defined period, the team must implement compensating controls such as strict network segmentation, host-based firewall rules, or enhanced logging to reduce the likelihood of exploitation. This approach also sets a clear deadline for a permanent fix, ensuring the vulnerability is not indefinitely deferred.

Why this answer

The vulnerability exists in a disabled plugin, meaning the attack surface is reduced but not eliminated; residual risk remains if the plugin is re-enabled or if other dependencies are affected. Creating a time-limited exception with compensating controls (e.g., firewall rules, file permissions, SELinux policies) allows the organization to formally accept the risk until the vendor patch is applied, which aligns with standard vulnerability management processes.

Exam trap

The trap here is that candidates assume a disabled plugin means zero risk, but the exam expects you to recognize that the package is still installed and could be exploited if re-enabled, so formal risk acceptance with compensating controls is required rather than ignoring or re-enabling the plugin.

How to eliminate wrong answers

Option A is wrong because the scanner is not 'clearly wrong' — it correctly identified that the vulnerable package is installed, even though the vulnerable code path is disabled; ignoring the finding would bypass proper risk acceptance and could lead to compliance issues. Option C is wrong because reinstalling the disabled plugin would reintroduce the vulnerable code path, increasing the attack surface and contradicting the goal of reducing risk; the scanner output already reflects the installed package, and the administrator should not alter the configuration to match a false sense of security.

Practice this question →

171

MCQmedium

NetFlow shows one workstation initiating SMB and WinRM sessions to 25 internal servers within 12 minutes, followed by a spike in Kerberos authentication requests and attempts to access admin shares. The user says they only opened an invoice spreadsheet. What is the most likely attacker objective?

A.Distributed denial-of-service activity against the internal network.

B.Lateral movement using compromised credentials to pivot across the environment.

C.Port scanning from an external attacker trying to enumerate exposed services.

D.DNS tunneling used to bypass content filtering and exfiltrate data.

AnswerB

The pattern of SMB, WinRM, Kerberos, and admin-share activity strongly suggests an attacker is using one compromised workstation to move laterally and reach additional systems. That behavior matches post-compromise pivoting, often with stolen credentials or remote execution tooling. The invoice spreadsheet is likely the initial infection vector.

Why this answer

The observed behavior—a single workstation initiating SMB and WinRM sessions to 25 internal servers in rapid succession, followed by a spike in Kerberos authentication requests and attempts to access admin shares—is a classic indicator of lateral movement using compromised credentials. The attacker likely obtained the user's credentials (e.g., via phishing in the invoice spreadsheet) and is using them to authenticate to multiple servers via WinRM for remote command execution and SMB for file access, with the Kerberos spike reflecting TGT/TGS requests as they pivot across the environment to escalate privileges or deploy ransomware.

Exam trap

The trap here is that candidates may mistake the Kerberos spike for a Kerberos-based attack (e.g., Kerberoasting) rather than recognizing it as a natural byproduct of lateral movement, where each new server connection triggers a TGS request, and the admin share access confirms the attacker is using compromised credentials to pivot, not just enumerate services.

How to eliminate wrong answers

Option A is wrong because DDoS activity would involve flooding the network with traffic from multiple sources, not a single workstation initiating authenticated sessions to internal servers; the pattern here is targeted and interactive, not volumetric. Option C is wrong because port scanning from an external attacker would show a broad range of IPs and ports being probed, not authenticated SMB/WinRM sessions followed by Kerberos requests; the use of valid credentials and admin share access indicates the attacker is already inside and moving laterally. Option D is wrong because DNS tunneling would manifest as unusual DNS query patterns (e.g., large or encoded queries) to exfiltrate data, not as SMB/WinRM sessions and Kerberos authentication spikes; the observed activity is about internal authentication and resource access, not data exfiltration via DNS.

Practice this question →

172

MCQmedium

An internal file server has an administrative web console exposed on the same network as all user laptops. A scan shows that any authenticated employee can reach the console, and several failed login attempts are coming from a workstation that should never manage servers. What is the best hardening action?

A.Move the console to a separate management network and restrict access to admin hosts only.

B.Increase the number of shared passwords so administrators can log in faster.

C.Leave the console exposed but shorten the password expiration period.

D.Disable logging so failed attempts do not generate noise.

AnswerA

Administrative interfaces should not be reachable from ordinary user endpoints. Moving the console to a dedicated management network and allowing access only from approved admin systems reduces the attack surface and limits who can even attempt to log in. That is a strong hardening control because it addresses both exposure and misuse. If a workstation should never manage servers, network-level segmentation is the right place to enforce that boundary before authentication is even attempted.

Why this answer

The administrative web console should be isolated on a separate management network (out-of-band management) with strict access control lists (ACLs) allowing only designated admin hosts. This prevents lateral movement from compromised user workstations and eliminates the attack surface exposed to all authenticated employees. Network segmentation is a fundamental defense-in-depth control for managing critical infrastructure, as it enforces the principle of least privilege at the network layer.

Exam trap

CompTIA often tests the misconception that password policies (rotation, complexity, or expiration) are sufficient hardening for exposed management interfaces, when in fact network segmentation and access control are the primary mitigations.

How to eliminate wrong answers

Option B is wrong because increasing the number of shared passwords does not address the root cause of unauthorized access; it actually weakens accountability and increases the risk of credential theft. Option C is wrong because shortening the password expiration period does not prevent an attacker from reaching the console; it only slightly reduces the window of opportunity for a compromised password, while the console remains exposed to all users. Option D is wrong because disabling logging removes visibility into security events, violating the fundamental security principle of auditability and making incident response impossible.

Practice this question →

173

MCQmedium

A help desk agent receives a phone call from someone claiming to be a regional sales manager who says they are locked out before a customer demo. The caller knows a few employee names and asks the agent to reset the account and temporarily bypass MFA. What attack is most likely?

A.Spear phishing, because the caller used specific employee details to appear credible.

B.Vishing, because the attacker is using a voice call to pressure support staff into changing access.

C.Pretexting, because the attacker is creating a false identity and believable story.

D.Baiting, because the attacker offered a tempting opportunity tied to a customer demo.

AnswerB

Vishing, or voice phishing, is a social engineering technique that exploits the telephone to trick victims into divulging sensitive information or performing actions that compromise security. The attacker here uses a voice call to impersonate an employee, creates urgency to pressure the help desk agent, and requests that access credentials be changed and MFA controls be weakened. Because the entire attack hinges on a live voice interaction, vishing is the most precise label for this scenario, distinguishing it from email-based phishing or in-person social engineering.

Why this answer

Vishing (voice phishing) specifically involves using a phone call to socially engineer a target into performing an action, such as resetting credentials and bypassing MFA. The attacker pressures the help desk agent by creating urgency around a customer demo, which is a classic vishing tactic to bypass security controls.

Exam trap

The trap here is that candidates confuse pretexting (the false identity) with the delivery method (vishing), but the exam expects you to identify the specific attack vector—voice call—as the defining characteristic of vishing.

How to eliminate wrong answers

Option A is wrong because spear phishing is an email-based attack that uses personalized content to trick the recipient into clicking a link or opening an attachment, not a voice call. Option C is wrong because while pretexting involves creating a false identity and story, the specific attack vector here is a voice call, making vishing the more precise classification under social engineering. Option D is wrong because baiting involves offering something enticing (e.g., a free USB drive or download) to lure the victim, not using a fabricated story over the phone.

Practice this question →

174

MCQmedium

Based on the exhibit, what is the most likely issue with the software component being built?

A.Supply-chain compromise, because the dependency may have been altered before it reached the build pipeline.

B.Cross-site scripting, because the package name suggests the application handles web content.

C.Credential stuffing, because automated systems frequently reuse credentials during updates.

D.Replay attack, because the nightly pipeline used an old copy of the package request.

AnswerA

A checksum or integrity mismatch during an automated dependency pull is a strong sign that the package may have been tampered with in transit or replaced in the software supply chain. Because the build pipeline trusted the registry source automatically, the control failure is around dependency integrity and third-party trust.

Why this answer

The exhibit shows a build pipeline that fetches a dependency from a public repository. If the dependency has been tampered with before it reaches the pipeline, this is a classic supply-chain compromise. Attackers often inject malicious code into popular open-source packages, which then gets incorporated into the build, compromising the final software component.

Exam trap

The trap here is that candidates may confuse a supply-chain compromise with a web-specific attack like XSS, but the question's context of a build pipeline and dependency fetching points directly to the integrity of the software supply chain.

How to eliminate wrong answers

Option B is wrong because cross-site scripting (XSS) is a web application vulnerability that allows injection of malicious scripts into web pages, not an issue with a build pipeline or dependency integrity. Option C is wrong because credential stuffing involves using stolen credentials to gain unauthorized access to accounts, not a problem with automated build systems reusing credentials during updates. Option D is wrong because a replay attack involves intercepting and retransmitting a valid data transmission, not using an old copy of a package request in a nightly pipeline.

Practice this question →

175

MCQmedium

Based on the exhibit, what type of malware is the most likely issue on the workstation?

A.Spyware, because the system appears to be collecting user data silently.

B.Ransomware, because the browser settings changed after installation.

C.Rootkit, because the endpoint security console detected an unknown process.

D.Worm, because the software was installed from an unofficial website.

AnswerA

Spyware is the best fit because the symptoms show covert data collection and tracking behavior. The unwanted browser extension, the repeated outbound traffic to a tracking domain, and the access to saved cookies all point to surveillance and data theft rather than encryption or destructive behavior.

Why this answer

The exhibit shows a browser extension installed from an unofficial website that is silently collecting browsing data, including keystrokes and visited URLs, which is characteristic of spyware. Spyware operates by gathering user information without consent, often through seemingly legitimate software, and the absence of encryption or user notification confirms this classification.

Exam trap

The trap here is that candidates confuse the symptom of changed browser settings with ransomware, but ransomware's primary action is file encryption or system lockout, not silent data collection, and the unofficial website installation is a red herring for worm propagation.

How to eliminate wrong answers

Option B is wrong because ransomware typically encrypts files or locks the system and demands payment, not merely changes browser settings after installation. Option C is wrong because a rootkit is designed to hide its presence and evade detection by security software, so an endpoint security console detecting an unknown process would indicate a different threat, not a rootkit. Option D is wrong because a worm self-replicates and spreads across networks without user interaction, whereas the issue here involves installation from an unofficial website, which is a common vector for spyware, not a worm.

Practice this question →

176

MCQmedium

A vulnerability scan of a branch-office print server finds that its administrative web console is reachable from the internet. The appliance is still using the vendor's default password, and no access control list limits management access to the office subnet or VPN. Which remediation would reduce risk the most with the least disruption?

A.Increase the password length policy and leave the console publicly reachable.

B.Disable the management interface entirely and replace the device immediately.

C.Restrict management access to the office network or VPN and change the default credentials.

D.Apply a patch after the next quarterly maintenance window and keep the current exposure unchanged.

AnswerC

This is the best balance of security and operational impact. Publicly exposed administration interfaces are high-risk, especially when default credentials are still enabled. Limiting access to a trusted management network or VPN immediately reduces attack surface, while changing the vendor defaults removes a common compromise path. Together, these steps address the exposure without requiring a full replacement or major service outage.

Why this answer

Reduces risk the most with the least disruption by immediately addressing the two primary vulnerabilities: the default password and unrestricted internet exposure. Changing the default credentials prevents trivial authentication bypass, while restricting management access to the office subnet or VPN eliminates the attack surface from the public internet. This approach requires no hardware replacement or downtime, and it directly mitigates the highest-severity issues identified in the scan.

Exam trap

The trap here is that candidates may choose Option B (disable and replace) because it seems most secure, but they overlook that configuration changes (ACL and password reset) achieve the same security goal with far less disruption and cost.

How to eliminate wrong answers

Option A is wrong because increasing the password length policy does not address the fact that the default password is still in use; an attacker can still authenticate with the known default credential, rendering the policy change irrelevant. Option B is wrong because disabling the management interface entirely and replacing the device immediately is unnecessarily disruptive and costly; the device can be secured with configuration changes without replacement, and disabling the interface may prevent necessary administrative tasks. Option D is wrong because applying a patch after the next quarterly maintenance window leaves the console publicly reachable with default credentials for an extended period, which is a critical risk that should be remediated immediately, not deferred.

Practice this question →

177

MCQeasy

A scan finds two issues: a critical vulnerability on an internet-facing VPN appliance with public exploit code, and a medium-severity issue on an internal test server. Which should be fixed first?

A.The internal test server issue, because test systems are always higher risk.

B.The VPN appliance issue, because it is critical and publicly exploitable.

C.Both issues at the same time without assigning a priority.

D.Neither issue, because scanners can produce false positives.

AnswerB

The VPN appliance issue should be addressed first because it combines a critical severity rating with direct internet exposure and publicly available exploit code, creating an immediate and realistic attack vector. This scenario represents a high likelihood of compromise with high impact, often allowing full network access. Prioritizing this issue aligns with common frameworks like the CVSS base score and EPSS, where exploitability and network reachability significantly elevate remediation urgency.

Why this answer

The VPN appliance issue should be fixed first because it is a critical vulnerability on an internet-facing system with publicly available exploit code. This combination means an attacker can directly compromise the appliance from the internet with minimal effort, leading to potential network breach and lateral movement. In contrast, the internal test server is less accessible and poses a lower immediate risk, even though it should still be addressed in due course.

Exam trap

The trap here is that candidates assume all vulnerabilities must be fixed in order of severity alone, ignoring the critical factor of asset exposure and exploitability, which CompTIA emphasizes in risk-based prioritization.

How to eliminate wrong answers

Option A is wrong because test systems are not inherently higher risk than internet-facing production systems; the risk is determined by exposure, exploitability, and impact, not by system role alone. Option C is wrong because security resources are finite and prioritization is essential; treating all issues equally ignores the urgency of a critical, publicly exploitable vulnerability on an internet-facing asset.

Practice this question →

178

MCQeasy

A user opens an attached document, and the endpoint security tool shows PowerShell running from memory with no new executable file written to disk. What type of attack is most likely?

A.Fileless attack

B.Ransomware

C.Rootkit

D.Logic bomb

AnswerA

This scenario is a classic fileless attack, where the malicious payload is delivered through a document macro or script and then executed in memory using built-in Windows utilities like PowerShell, WMI, or .NET. The attack never writes a separate executable to disk, which is why signature-based antivirus scanning files may miss it. The endpoint security tool likely detected anomalous behavioral indicators, such as an Office application spawning PowerShell or executing suspicious memory-only commands, alerting the user immediately upon opening the document.

Why this answer

The scenario describes PowerShell running from memory without a new executable file written to disk, which is the hallmark of a fileless attack. Fileless attacks leverage legitimate system tools like PowerShell, WMI, or .NET to execute malicious code directly in memory, bypassing traditional file-based detection mechanisms.

Exam trap

The trap here is that candidates may confuse 'fileless' with 'no malware at all' or think that any attack using PowerShell must be a script-based attack, but the key indicator is the lack of a new executable file on disk, which distinguishes fileless attacks from traditional malware that writes files.

How to eliminate wrong answers

Option B (Ransomware) is wrong because ransomware typically encrypts files and demands payment, often writing executable files to disk or dropping a ransom note; the absence of a new executable file on disk makes this unlikely. Option C (Rootkit) is wrong because rootkits are designed to hide their presence and maintain persistent access, often by modifying the operating system kernel or boot process, not by executing solely from memory without any file artifacts. Option D (Logic bomb) is wrong because a logic bomb is a piece of malicious code that executes under specific conditions (e.g., a date or user action) and is usually embedded within a legitimate file or application, not executed purely from memory without a file.

Practice this question →

179

MCQmedium

A security analyst is reviewing the source code of a custom authentication service. The service uses a function that compares a user-supplied password to the stored password hash by iterating through each byte and returning false immediately upon the first mismatch. The analyst measures the function's execution time and discovers it varies measurably depending on how many initial bytes match. Which type of attack is this vulnerability most likely to facilitate?

A.Brute-force attack

B.Dictionary attack

C.Replay attack

D.Timing attack

AnswerD

A timing attack exploits measurable variations in the time it takes to execute a cryptographic operation. In this case, the early-exit comparison enables an attacker to deduce the correct secret byte by byte, making it the correct classification.

Why this answer

The vulnerability is a timing attack because the comparison function returns false immediately upon the first mismatched byte, causing execution time to vary based on how many initial bytes match. An attacker can measure these timing differences to iteratively guess each byte of the password hash, effectively reducing the search space from exponential to linear. This is a classic side-channel attack that exploits observable timing variations in cryptographic or authentication operations.

Exam trap

The trap here is that candidates may confuse a timing attack with a brute-force or dictionary attack, not realizing that the key clue is the measurable variation in execution time due to early exit on mismatch, which is a classic side-channel indicator.

Why the other options are wrong

A brute-force attack systematically tries all possible passwords, but the vulnerability here is about exploiting timing variations in password comparison, not about trying many passwords.

A dictionary attack uses a precomputed list of likely passwords, not the timing variation of password comparison. The vulnerability described is about measuring execution time to deduce password bytes, which is a timing attack, not a dictionary attack.

A replay attack involves capturing and retransmitting valid data (e.g., authentication tokens) to impersonate a user, but the vulnerability here is about timing variations in password comparison, not about intercepting and reusing network traffic.

Practice this question →

180

MCQmedium

Several employees report receiving SMS messages that appear to come from the corporate service desk. The text says, 'Your password expires today. Review the notice here,' followed by a shortened link that opens a fake sign-in page on a phone browser. Which type of attack is this?

A.Smishing

B.Pretexting

C.Tailgating

D.Spoofing

AnswerA

Smishing is the correct answer because the attack is phishing delivered over SMS/text messaging. The message creates urgency and instructs the recipient to click a link that leads to a fake login page, harvesting credentials. This fits SMiShing exactly: social engineering plus a malicious URL delivered via Short Message Service.

Why this answer

This is smishing because the attack uses SMS messages to deliver a phishing link that directs recipients to a fake sign-in page, attempting to steal their credentials. Smishing is a form of social engineering that exploits the trust in text messaging and the urgency of a password expiration notice to bypass email security filters.

Exam trap

CompTIA often tests the distinction between smishing and spoofing, where candidates mistakenly choose spoofing because the SMS appears to come from the service desk, but the core attack vector is the social engineering via SMS, not just the falsified sender information.

How to eliminate wrong answers

Option B is wrong because pretexting involves fabricating a scenario (pretext) to obtain information or access, often through voice calls or impersonation, not through SMS with a malicious link. Option C is wrong because tailgating is a physical security attack where an unauthorized person follows an authorized individual into a restricted area, not a digital or messaging-based attack. Option D is wrong because spoofing refers to falsifying data (e.g., IP address, email header, caller ID) to impersonate a trusted source, but the attack described is specifically a social engineering technique using SMS, which is classified as smishing, not just spoofing.

Practice this question →

181

MCQmedium

A security analyst discovers that an attacker maintained persistent access to a corporate network for six months, moving laterally between systems and exfiltrating sensitive data. The attacker used custom malware that evaded antivirus and established multiple backdoors. Which of the following best describes this type of threat actor and their campaign?

A.Insider threat

B.Advanced persistent threat (APT)

C.Zero‑day exploit

D.Denial of service (DoS) attack

AnswerB

APT correctly describes a threat actor that establishes a long‑term presence, uses custom malware, and conducts lateral movement and data exfiltration—all of which are present in the scenario. APTs are designed to remain undetected while achieving strategic goals over months or years.

Why this answer

The scenario describes a threat actor that maintained stealthy, long-term access to a network, moved laterally, and exfiltrated data over six months using custom malware that evaded antivirus. This aligns with the definition of an Advanced Persistent Threat (APT), which is a sophisticated, well-resourced adversary that conducts prolonged, targeted campaigns to achieve specific objectives, often espionage or data theft.

Exam trap

The trap here is that candidates may confuse 'advanced persistent threat' with a specific exploit technique like a zero-day, or assume any long-term access is an insider threat, but the key differentiator is the external, resource-intensive, and stealthy nature of the campaign described.

Why the other options are wrong

The scenario describes an external attacker using custom malware to evade detection and maintain long-term access, which is characteristic of an APT, not an insider threat. An insider threat would involve a person with authorized access, such as an employee or contractor, misusing their privileges.

A zero-day exploit refers to a vulnerability that is unknown to the vendor and has no patch, but the question describes custom malware that evaded antivirus and maintained persistence over six months, which is characteristic of an APT campaign, not a single exploit.

A denial of service (DoS) attack aims to disrupt service availability, not to maintain persistent access, move laterally, or exfiltrate data over six months.

Practice this question →

182

MCQhard

Based on the exhibit, which vulnerability is being exploited?

A.Cross-site scripting (XSS)

B.Cross-site request forgery (CSRF)

C.Authentication bypass

D.Command injection

AnswerC

The backend is trusting client-influenced headers and a forwarded path value to reach an administrative endpoint. The logs show a normal analyst account reaching /admin/export after supplying X-Original-URL, which indicates the application or proxy is failing to enforce access controls consistently. That is an authentication or authorization bypass caused by trusting data the client can manipulate.

Why this answer

The exhibit shows a URL parameter `?admin=false` being changed to `?admin=true`, which directly toggles an administrative access control flag. This is a classic authentication bypass vulnerability because the application trusts client-supplied input to determine authorization status, allowing an attacker to escalate privileges without valid credentials.

Exam trap

The trap here is that candidates confuse parameter manipulation for privilege escalation with CSRF, but CSRF requires an authenticated victim to unknowingly submit a request, whereas this attack directly alters the authorization flag without needing another user's session.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) requires injecting malicious scripts into web pages, not manipulating URL parameters to gain admin access. Option B is wrong because cross-site request forgery (CSRF) tricks a user into performing unintended actions using their existing session, but does not involve directly modifying a parameter to bypass authentication. Option D is wrong because command injection involves injecting OS commands into input fields that are executed by the server, not altering a boolean parameter in a URL to change authorization state.

Practice this question →

183

MCQeasy

Threat intelligence shows an attacker changes domains every day, but the malware file itself stays the same across incidents. Which indicator would be the best to block immediately if you find it in your environment?

A.The current weather in the city where the attack was observed

B.The malware file hash from the shared sample

C.The logo used on the phishing email

D.The time zone used by the help desk

AnswerB

A cryptographic file hash, such as SHA-256, acts as a unique fingerprint of the malware binary itself. Even if the attacker dynamically rotates C2 domains or hosting infrastructure daily, the executable code typically remains identical for a given sample, so its hash stays constant. This makes the hash a reliable and persistent indicator of compromise that can be used to block execution, scan endpoints, and share intelligence across security tools.

Why this answer

The malware file hash (e.g., MD5, SHA-1, or SHA-256) is a unique fingerprint of the file's binary content. Since the malware file itself remains unchanged across incidents, its hash is a static, reliable indicator of compromise (IoC) that can be immediately blocked via file reputation or hash-based detection rules, regardless of domain changes.

Exam trap

The trap here is that candidates may focus on the attacker's changing domains (a dynamic indicator) and overlook the static file hash, which is the most reliable and immediately actionable indicator when the malware binary is unchanged.

How to eliminate wrong answers

Option A is wrong because the current weather is an environmental variable unrelated to the malware's identity or behavior; it has no forensic value as a static indicator. Option C is wrong because a phishing email logo is a visual element that can be easily altered or reused by different threat actors, and it does not uniquely identify the malware file itself. Option D is wrong because the help desk time zone is an operational parameter of the organization, not an indicator of compromise; it provides no information about the attacker's tools or tactics.

Practice this question →

184

MCQeasy

Employees in a lobby say their phones automatically connected to a wireless network named CorpWiFi, even though the legitimate access point was offline. They were then shown a fake sign-in page. What threat is this?

A.An evil twin access point impersonating the real corporate wireless network

B.A Bluetooth replay attack that reuses captured pairing data

C.A cloud misconfiguration exposing a storage bucket to the internet

D.A dependency compromise in a software library used by the company portal

AnswerA

An evil twin is a rogue access point that advertises the exact service set identifier (SSID) of the legitimate corporate wireless network, often on a stronger signal than the real AP. Because many devices are configured to auto-reconnect to previously joined SSIDs, they will associate with the evil twin without any user intervention. Once connected, the attacker sits in the middle, presenting a phishing login page or harvesting credentials. In a lobby, an attacker can easily deploy this using a small battery-powered Wi-Fi device, making it the correct explanation.

Why this answer

This is an evil twin attack. The attacker sets up a rogue access point broadcasting the same SSID (CorpWiFi) as the legitimate network. When the real access point goes offline, client devices automatically connect to the stronger signal of the rogue AP, allowing the attacker to present a fake captive portal to harvest credentials.

Exam trap

The trap here is that candidates may confuse an evil twin with a rogue access point, but the key distinction is that an evil twin specifically impersonates a legitimate SSID to trick clients into connecting, whereas a rogue AP is simply an unauthorized device on the network.

How to eliminate wrong answers

Option B is wrong because a Bluetooth replay attack involves capturing and retransmitting Bluetooth pairing packets to gain unauthorized access, not connecting to a Wi-Fi network or presenting a fake sign-in page. Option C is wrong because a cloud misconfiguration exposing a storage bucket would allow unauthorized data access via the internet, not cause phones to auto-connect to a rogue Wi-Fi network. Option D is wrong because a dependency compromise in a software library would affect the company portal's code execution or data integrity, not involve wireless network impersonation or captive portal phishing.

Practice this question →

185

MCQmedium

A file-conversion API accepts a URL to generate a preview image. An attacker submits a URL for the cloud metadata service at 169.254.169.254 and receives instance credentials in the preview output. What attack is this?

A.SQL injection

B.Server-side request forgery

C.Cross-site request forgery

D.Command injection

AnswerB

Server-side request forgery occurs because the API fetches an attacker-supplied URL server-side, reaching the link-local metadata endpoint at 169.254.169.254 that the attacker cannot access directly. This satisfies the stem's constraint: the preview service returns instance credentials, confirming the server, not the client, made the request.

Why this answer

The attack is Server-Side Request Forgery (SSRF) because the attacker manipulates the file-conversion API into making an outbound HTTP request to an internal IP address (169.254.169.254, the cloud metadata service). The API then returns the metadata (including instance credentials) in the generated preview image, exploiting the server's trust to access internal resources that are not directly accessible from the internet.

Exam trap

The trap here is that candidates confuse SSRF with CSRF because both involve 'request forgery,' but SSRF targets server-side requests to internal resources, while CSRF targets user-side requests to perform unauthorized actions.

How to eliminate wrong answers

Option A is wrong because SQL injection involves injecting malicious SQL queries into input fields to manipulate a database, not making the server request internal URLs. Option C is wrong because Cross-Site Request Forgery (CSRF) tricks an authenticated user's browser into performing unwanted actions on a trusted site, not exploiting server-side URL fetching. Option D is wrong because command injection involves injecting operating system commands into input that is executed by the server, not manipulating URL requests to internal services.

Practice this question →

186

MCQmedium

A vulnerability scan finds that an administrative SSH service on a Linux server is listening on 0.0.0.0 and is reachable from the internet. The server is meant to be managed only from the internal admin subnet. What is the best remediation?

A.Patch the SSH client on administrator laptops so the server cannot be reached externally.

B.Restrict SSH to the management network and block public access with firewall or host-based rules.

C.Enable a captive portal on the public interface so only authenticated users see the service.

D.Replace SSH with FTP because FTP can be configured to allow administrative access more easily.

AnswerB

Restricting SSH to the management network and blocking public access at the firewall or with host-based rules is the appropriate least-exposure control. This ensures only trusted administrative workstations can reach the SSH service, reducing the attack surface and preventing external brute-force or exploitation attempts. This approach aligns with secure administrative practices by providing network-level access control.

Why this answer

The vulnerability is that SSH is exposed to the internet on 0.0.0.0, which violates the principle of least privilege and exposes the administrative interface to unauthorized access. The best remediation is to restrict SSH to the internal management subnet using firewall rules (e.g., iptables, security group ACLs) or host-based rules (e.g., tcpwrappers, /etc/hosts.allow), ensuring only trusted internal IPs can reach the service. This directly addresses the exposure without changing the protocol or client configuration.

Exam trap

The trap here is that candidates may think patching the client (Option A) or adding authentication (Option C) solves the exposure, but the core issue is network-level access control—no amount of client-side patching or portal authentication can prevent an attacker from reaching the open SSH port from the internet.

How to eliminate wrong answers

Option A is wrong because patching the SSH client on administrator laptops does nothing to prevent external attackers from reaching the server; the server is still listening on 0.0.0.0 and accessible from the internet. Option C is wrong because a captive portal is a web-based authentication mechanism typically used for guest networks, not for securing an SSH service; SSH does not support captive portal redirection, and this would not prevent direct TCP access to port 22. Option D is wrong because FTP transmits credentials and data in cleartext by default, which is far less secure than SSH; replacing SSH with FTP would increase the attack surface and violate security best practices for administrative access.

Practice this question →

187

MCQmedium

A security analyst discovers that an organization's web application is vulnerable to SQL injection. The application uses a legacy database driver that does not support parameterized queries. Which of the following is the BEST mitigation to prevent this vulnerability?

A.Implement a web application firewall (WAF) to filter malicious input.

B.Update the database driver to a version that supports parameterized queries.

C.Encode all user input using HTML encoding.

D.Disable error messages that reveal database schema.

AnswerB

Parameterized queries, also known as prepared statements, separate the SQL statement structure from user-supplied data by sending the query template to the database first and then binding input values as parameters. This ensures that even if an attacker submits malicious SQL fragments, they are treated strictly as data values, never as executable command text. Updating the database driver to a version that fully supports these APIs is the definitive root-cause fix, because it eliminates the injection vulnerability instead of merely detecting or filtering attack payloads.

Why this answer

The root cause of the SQL injection vulnerability is the legacy database driver that does not support parameterized queries. Updating the driver to a modern version that supports parameterized queries (also known as prepared statements) allows the application to separate SQL logic from user-supplied data, effectively preventing SQL injection at the database layer. This addresses the fundamental flaw rather than relying on external filtering or encoding.

Exam trap

The trap here is that candidates often choose a WAF (Option A) as a quick fix, overlooking that it only mitigates symptoms rather than eliminating the root cause, which is the lack of parameterized query support in the database driver.

Why the other options are wrong

A WAF can filter known SQL injection patterns but does not fix the root cause; it can be bypassed with obfuscated payloads. The best mitigation is to use parameterized queries, which the legacy driver does not support.

HTML encoding prevents XSS but does not stop SQL injection, as SQL injection exploits database query structure, not HTML rendering.

Disabling error messages does not prevent SQL injection; it only hides error details from users. The vulnerability remains exploitable via blind SQL injection techniques.

Practice this question →

188

MCQeasy

Analysts see a malware campaign that changes its command-and-control domain every day, but the executable hash and a unique registry value remain the same across incidents. Which indicator is the best candidate for hunting?

A.The daily domain name used for command and control.

B.The executable hash from the malware sample.

C.The employee's home city where the alert was observed.

D.The brand of the user's keyboard and mouse.

AnswerB

The executable hash, such as a SHA-256 digest, is a deterministic value derived from the malware binary's exact byte sequence, so any system running an identical sample will produce the same hash. This makes it a precise and stable indicator of compromise, assuming the sample has not been repacked or modified, and it enables reliable hash-based hunting across all endpoints and forensic artifacts.

Why this answer

The executable hash (e.g., SHA-256) and the unique registry value are static, immutable artifacts that persist across every incident, regardless of the daily domain rotation. These indicators are far more reliable for hunting since they directly identify the malware binary itself, whereas the domain changes frequently and may be blocked or sinkholed after detection.

Exam trap

The trap here is that candidates focus on the changing domain (a dynamic indicator) because it is directly observable in network traffic, but the exam tests the understanding that static indicators (like the hash) are more persistent and effective for hunting across multiple incidents.

How to eliminate wrong answers

Option A is wrong because the daily domain name is a volatile indicator that changes every day, making it unreliable for long-term hunting; it would require constant updates and may already be taken down by the time it is used. Option C is wrong because the employee's home city is a geographic attribute unrelated to the malware's technical characteristics and cannot be used to identify or track the specific malware campaign. Option D is wrong because the brand of the user's keyboard and mouse is a hardware peripheral detail that has no bearing on the malware's behavior or persistence, and it is not a valid indicator of compromise.

Practice this question →

189

MCQmedium

An administrator notices that a finance file share remained normal for weeks after a former contractor left the company. This morning, multiple PDFs and spreadsheets were deleted, and a scheduled task created months ago is now executing a script that wipes files in the shared folder. Which malware type is most consistent with this behavior?

A.Logic bomb triggered by a time or condition after being planted earlier

B.Worm that is automatically propagating to other endpoints

C.Spyware that is secretly collecting keystrokes and screenshots

D.Rootkit that is hiding itself in the kernel to maintain stealth

AnswerA

A logic bomb is the best fit because malicious code was planted earlier and remained dormant until a trigger condition caused it to execute. The scheduled task and delayed destructive action are classic signs of a hidden payload designed to activate later, sometimes after a user departure, date, or system event. The time gap strongly supports this interpretation.

Why this answer

The behavior matches a logic bomb: malicious code planted in advance (the scheduled task created months ago) that remains dormant until triggered by a specific condition (the passage of time or a date). The file share was normal for weeks because the logic bomb had not yet met its trigger condition; once triggered, it executed the script to delete files. This contrasts with other malware types that require active propagation, continuous monitoring, or kernel-level hiding.

Exam trap

The trap here is that candidates may confuse a logic bomb with a worm because both can cause widespread damage, but the key distinction is the pre-planted, dormant nature of the logic bomb versus the active self-propagation of a worm.

How to eliminate wrong answers

Option B is wrong because a worm self-propagates across networks without user intervention, but here the malware was planted as a scheduled task months ago and only activated recently, with no evidence of lateral movement or replication. Option C is wrong because spyware focuses on covert data collection (keystrokes, screenshots) and does not typically delete files or execute destructive scripts via scheduled tasks. Option D is wrong because a rootkit hides its presence by modifying the OS kernel or system calls, whereas the described behavior involves a visible scheduled task and file deletion without any stealth mechanisms.

Practice this question →

190

MCQmedium

An API log shows repeated requests such as `GET /api/orders?orderId=105%20OR%201=1--` followed by responses containing many customers' order records instead of one record. Which attack is most likely?

A.SQL injection, because the attacker is altering the database query through crafted input.

B.Cross-site scripting, because malicious code is being reflected in the browser.

C.Cross-site request forgery, because the request appears to be an unauthorized action.

D.Broken access control, because the API is not validating the user role correctly.

AnswerA

The injected condition `OR 1=1--` is a classic indicator that user input is being interpreted as part of a database query. The application returns too much data because the attacker has manipulated the SQL logic.

Why this answer

The request includes `%20OR%201=1--`, which URL-decodes to ` OR 1=1--`. This is a classic SQL injection payload that appends a tautology (`OR 1=1`) and comments out the rest of the query (`--`). The API log shows that instead of returning a single order record, the response contains many customers' order records, confirming that the injected condition bypassed the intended WHERE clause and returned all rows from the orders table.

Exam trap

The trap here is that candidates may see the word 'API' and assume the attack is related to access control or CSRF, but the presence of SQL comment syntax (`--`) and the tautology (`OR 1=1`) in the request parameter is the definitive indicator of SQL injection.

How to eliminate wrong answers

Option B is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into a web page viewed by other users, not altering database queries to retrieve unauthorized data. Option C is wrong because cross-site request forgery (CSRF) tricks an authenticated user into performing an unintended action, but the log shows direct crafted input in the API request, not a forged request from another site. Option D is wrong because broken access control would involve missing or flawed authorization checks on the API endpoint, but the attack here exploits a database-level injection vulnerability, not a failure to validate user roles or permissions.

Practice this question →

191

MCQhard

A SaaS dashboard invalidates passwords after a forced reset, but a stolen bearer token from a browser cookie still works from a VPN exit node for several hours. SIEM logs show the same token value used from two countries within five minutes, and no MFA prompt appears because the token is already accepted. What attack is most likely?

A.Session hijacking, because a valid session token is being replayed from a different location.

B.Credential stuffing, because the attacker used many passwords against the portal.

C.Cross-site request forgery, because the attacker is making requests on behalf of the user.

D.Phishing, because the attacker likely stole the user's password first.

AnswerA

Session hijacking is the best answer because the attacker is reusing a valid authenticated token rather than logging in normally. The token continues to work after a password reset, and the same token appears from different geographies in a short window. That strongly suggests the session itself was stolen and replayed, which bypasses authentication controls that only protect the login step.

Why this answer

The scenario describes a stolen bearer token (session token) being reused from a different geographic location (VPN exit node) without re-authentication. This is classic session hijacking, where an attacker captures a valid session token (e.g., from a browser cookie) and replays it to impersonate the authenticated user. The fact that the token works even after a password reset and bypasses MFA confirms the attack is session hijacking, not credential theft or request forgery.

Exam trap

The trap here is that candidates confuse session hijacking with CSRF, but CSRF requires the victim's browser to send the request, whereas session hijacking involves the attacker directly using the stolen token from their own machine.

How to eliminate wrong answers

Option B is wrong because credential stuffing involves using many stolen username/password pairs against a login portal, but here the attacker already has a valid bearer token and does not need to guess passwords. Option C is wrong because cross-site request forgery (CSRF) tricks a user's browser into making unintended requests using their existing session, but the attacker here is directly using a stolen token from a different location, not exploiting the user's active session.

Practice this question →

192

MCQeasy

A person wearing a contractor badge asks reception to let them into the office because they forgot their access card and say they are expected for a server maintenance visit. What social engineering technique is most likely?

A.Pretexting

B.Baiting

C.Smishing

D.Ransomware

AnswerA

Pretexting is a social engineering technique where the attacker constructs a fabricated scenario or false identity to establish trust and gain unauthorized access. In this scenario, the contractor badge is the 'pretext' for an invented maintenance visit, and the claim of having forgotten their ID is a second layer designed to bypass reception's verification procedures. Unlike baiting, no material lure is involved; the entire attack relies on the plausibility of the story and the victim's willingness to help. This exploits the human tendency to comply with perceived authority or urgent requests, making it a direct physical access threat.

Why this answer

Pretexting is correct because the attacker creates a fabricated scenario (the 'pretext') of being a contractor on a server maintenance visit to gain unauthorized physical access. The use of a contractor badge and the claim of a forgotten access card are designed to exploit the receptionist's trust and willingness to help, bypassing security controls without technical hacking.

Exam trap

The SY0-701 exam often tests the distinction between pretexting (fabricated scenario) and baiting (offering a lure), where candidates mistakenly choose baiting because they associate the 'forgotten card' with a 'bait' like a free item, but the core technique is the false identity and story.

How to eliminate wrong answers

Option B (Baiting) is wrong because baiting involves offering something enticing (e.g., a free USB drive or download) to trick a victim into performing an action, not fabricating a story for access. Option C (Smishing) is wrong because smishing is a form of phishing conducted via SMS text messages, not an in-person social engineering technique involving a badge and verbal request.

Practice this question →

193

Multi-Selectmedium

A help desk technician receives a phone call from someone claiming to be the VP of Finance. The caller says they are in an airport, forgot their phone, and need a password reset immediately. They also ask the technician to skip callback verification because a meeting starts in five minutes. Which two details are the strongest indicators of a pretexting or vishing attempt? Select two.

Select 2 answers

A.the caller claims an executive title and uses authority to pressure the technician

B.the call is routed through the company ticketing system with an approved change record

C.the caller asks the technician to bypass identity verification and callback procedures

D.the caller answers all security questions correctly after being prompted for them

E.the call occurs after normal business hours on a holiday weekend

AnswersA, C

Impersonating a senior executive is a common social engineering tactic because it creates authority pressure and makes the target more likely to comply quickly. In a help desk context, attackers often borrow a title that sounds urgent and important. That pressure is a strong sign the call may be a pretext rather than a legitimate request.

Why this answer

The caller's use of an executive title (VP of Finance) and urgent authority pressure is a classic social engineering tactic known as pretexting. In a vishing (voice phishing) attack, the attacker fabricates a scenario to manipulate the technician into bypassing standard security procedures. This aligns with the SY0-701 domain on threats, vulnerabilities, and mitigations, specifically social engineering techniques.

Exam trap

The trap here is that candidates may confuse a successful security question response (Option D) as a sign of legitimacy, but in vishing attacks, attackers often gather personal data from OSINT or data breaches to answer such questions, making it a weak indicator compared to the direct authority pressure and request to bypass verification.

Practice this question →

194

MCQeasy

A help desk technician receives a phone call from someone claiming to be a contractor. The caller says their MFA app was lost, asks the technician to enroll a new device immediately, and pressures them to ignore policy. What type of attack is this?

A.Phishing

B.Vishing

C.Smishing

D.Baiting

AnswerB

Vishing, or voice phishing, leverages live or automated phone calls, often using VoIP and caller ID spoofing to appear as a legitimate bank, IT support, or government agency. Vishing uses voice calls to pressure a target into revealing information or changing security settings, such as resetting a password or approving a multi-factor authentication prompt. The direct phone-to-phone interaction makes this the correct classification for the described call.

Why this answer

This is a vishing (voice phishing) attack because the attacker uses a phone call to impersonate a contractor and socially engineer the technician into bypassing MFA enrollment policies. Vishing specifically exploits voice communication to manipulate victims, unlike phishing which uses email or malicious links.

Exam trap

The trap here is confusing vishing with phishing because both involve social engineering, but the key differentiator is the communication medium—voice (phone call) vs. electronic message (email/SMS).

How to eliminate wrong answers

Option A is wrong because phishing involves deceptive emails or messages with malicious links/attachments, not a direct phone call. Option C is wrong because smishing uses SMS text messages to trick victims, not voice calls. Option D is wrong because baiting relies on offering something enticing (e.g., a free USB drive) to lure victims into a trap, not a phone-based social engineering request.

Practice this question →

195

MCQhard

Based on the exhibit, which finding should be remediated first?

A.Finding A

B.Finding B

C.Finding C

D.Finding D

AnswerA

Finding A combines internet exposure, remote code execution, and active exploitation in the wild, making it the most urgent risk even if another item has a slightly higher CVSS score. Exposure and exploitability matter more than score alone. A patch is available, so remediation can reduce the window of opportunity quickly. In Security+ style prioritization, reachable, actively exploited weaknesses on public-facing systems rise to the top.

Why this answer

Finding A is prioritized first because it represents the highest overall risk when considering exploitability, potential impact, and asset criticality. While CVSS scores are a factor, remediation decisions should weigh the likelihood of exploitation and the severity of consequences; Finding A poses an immediate and severe threat that could lead to significant compromise, thereby requiring urgent action.

Exam trap

The trap here is that candidates might choose a finding solely based on the highest CVSS score, without considering other risk factors such as exploitability, asset criticality, or active exploitation. CompTIA expects you to prioritize based on overall risk, not just severity.

How to eliminate wrong answers

Option B is wrong because its CVSS score of 7.5 is lower than Finding A's 9.8, and while it represents a high-severity issue, it does not pose the same immediate risk of unauthenticated remote compromise. Option C is wrong because it has a CVSS score of 6.2, which is medium severity, and typically involves a local attack vector or requires user interaction, making it less urgent than a critical remote exploit. Option D is wrong because its CVSS score of 4.3 is low severity, often related to information disclosure or minor misconfigurations, and should be addressed after critical and high-severity findings.

Practice this question →

196

MCQmedium

A security analyst observes repeated outbound traffic from a single workstation to a known malicious IP address. The workstation's anti-malware software has reported no alerts, and the user claims to have only downloaded software from the company's approved application store. Which type of malware most likely explains this behavior?

A.Ransomware

B.Rootkit

C.Trojan horse

D.Polymorphic malware

AnswerC

Correct. A Trojan horse masquerades as benign software, often from a seemingly trusted source. It can evade signature-based anti-malware and silently establish outbound connections to a malicious IP for command-and-control, data exfiltration, or further payload delivery.

Why this answer

The Trojan horse is correct because it is a type of malware that disguises itself as legitimate software, often downloaded from trusted sources like an approved application store, to bypass security controls. Once installed, it can silently establish outbound connections to a command-and-control (C2) server, such as the known malicious IP address observed, without triggering anti-malware alerts if the Trojan is not yet in the signature database. This matches the scenario where the user downloaded from an approved store, the anti-malware reported no alerts, and the workstation is communicating with a malicious IP.

Exam trap

The trap here is that candidates may confuse a rootkit's stealth capabilities with the Trojan's social engineering vector, overlooking that the approved store download is a classic Trojan delivery method, not a rootkit's typical infection path.

Why the other options are wrong

Ransomware typically encrypts files and demands payment, often with visible alerts or ransom notes, not silent outbound traffic to a known malicious IP without alerts.

A rootkit is designed to hide its presence and maintain privileged access, but it does not typically generate repeated outbound traffic to a known malicious IP. The observed behavior suggests a trojan horse, which masquerades as legitimate software to establish command-and-control communication.

Polymorphic malware changes its code to evade signature-based detection, but the question states the workstation's anti-malware software reported no alerts, which could also be due to a trojan. However, the key clue is that the user downloaded software from an approved store, suggesting a trojan disguised as legitimate software, not polymorphic behavior.

Practice this question →

197

MCQmedium

Several users on the same subnet report intermittent inability to reach the default gateway. A packet capture shows ARP replies mapping the gateway IP to a different MAC address, and the same host keeps sending those replies every few seconds. What attack is most likely?

A.Replay attack

B.ARP spoofing

C.DNS amplification

D.Man-in-the-middle via TLS downgrade

AnswerB

ARP spoofing, or ARP poisoning, occurs when an attacker sends unsolicited ARP replies or gratuitous ARP packets to associate the gateway's IP address with the attacker's MAC address. This causes hosts on the subnet to update their ARP caches, redirecting traffic meant for the gateway to the attacker, who can then sniff, intercept, or drop packets. The resulting false ARP entries explain the users' intermittent inability to communicate, as traffic is misdirected at the data-link layer.

Why this answer

ARP spoofing. The symptoms—intermittent gateway unreachability, ARP replies mapping the gateway IP to a different MAC address, and repeated unsolicited ARP replies—are classic indicators of an ARP spoofing (also called ARP poisoning) attack. The attacker sends forged ARP replies to associate their own MAC address with the gateway IP, causing traffic destined for the gateway to be sent to the attacker instead, disrupting connectivity.

Exam trap

The trap here is that candidates may confuse ARP spoofing with a man-in-the-middle attack in general, but the question specifically describes ARP-level manipulation (forged ARP replies mapping the gateway IP to a different MAC), which is the defining characteristic of ARP spoofing, not a TLS downgrade or replay attack.

How to eliminate wrong answers

Option A is wrong because a replay attack involves capturing and retransmitting valid data packets (e.g., authentication tokens) to trick a system, not sending forged ARP replies to redirect traffic. Option C is wrong because a DNS amplification attack is a type of DDoS that uses open DNS resolvers to flood a target with large DNS responses, and it does not involve manipulating ARP tables or causing intermittent gateway reachability. Option D is wrong because a man-in-the-middle via TLS downgrade attack forces a connection to use a weaker TLS version or cipher, but it does not involve ARP spoofing or sending forged ARP replies; it operates at the transport/application layer, not the data link layer.

Practice this question →

198

MCQeasy

A worker receives a text message from someone claiming to be the company's HR partner. The message says a benefits portal issue will be fixed only if the worker clicks a link and logs in right away. What type of attack is this most likely?

A.Smishing, because the attack is delivered by text message.

B.Watering hole, because the attacker compromised the HR partner's website.

C.Spoofing only, because the attacker copied the HR logo in the message.

D.Port scanning, because the attacker wants to find open services on the phone.

AnswerA

Smishing is a form of social engineering delivered via SMS or text-messaging platforms, relying on urgency and a trusted sender identity to prompt action. In this scenario, the attacker impersonates HR and asks the worker to log in, which is a classic credential-phishing pattern. The defining characteristic is the text message delivery vector, making smishing the precise attack classification.

Why this answer

This is smishing because the attack vector is a text message (SMS) that attempts to trick the recipient into clicking a malicious link and providing credentials. Smishing is a form of social engineering that exploits the trust in SMS communications, often impersonating a legitimate entity like HR to create urgency. The goal is credential theft, not technical exploitation of the phone's services.

Exam trap

CompTIA often tests the distinction between the delivery method (SMS = smishing) and the underlying technique (spoofing), so candidates mistakenly choose 'spoofing only' because they see a faked logo or sender ID, ignoring that the attack is defined by its vector.

How to eliminate wrong answers

Option B is wrong because a watering hole attack compromises a website frequently visited by the target group, not by sending a direct text message; the attacker does not compromise the HR partner's website here. Option C is wrong because spoofing alone is a technique (e.g., faking the sender ID or logo), but the full attack is smishing, which includes the social engineering delivery via SMS; the question asks for the attack type, not just one component. Option D is wrong because port scanning is a network reconnaissance technique to find open ports and services, not a method to trick a user into clicking a link via text message.

Practice this question →

199

MCQmedium

A security analyst is investigating a phishing campaign that specifically targets senior executives in a company. The emails appear to come from the CEO and request urgent wire transfers to a fraudulent account. Which of the following best describes this type of attack?

A.Whaling

B.Spear phishing

C.Vishing

D.Pharming

AnswerA

Whaling is a highly targeted form of spear phishing that focuses specifically on senior executives, such as CEOs, CFOs, or other high-value individuals with privileged access to financial systems or sensitive corporate data. Attackers craft meticulously researched emails that impersonate trusted internal or external authorities, often invoking legal, compliance, or urgent transactional pretexts to pressure the victim into actions like wire transfers or credential disclosure. Unlike generic spear phishing, which may target any individual with specific attributes, whaling is defined by the executive-level target and the disproportionate potential impact, making it a distinct and more dangerous subtype.

Why this answer

This attack is whaling because it specifically targets senior executives (the 'big fish') with a fraudulent email impersonating the CEO to request urgent wire transfers. Whaling is a form of phishing that focuses on high-profile individuals within an organization, leveraging their authority and access to sensitive financial operations. The attack exploits the trust and urgency associated with executive communications to bypass standard security controls.

Exam trap

CompTIA often tests the distinction between whaling and spear phishing, where candidates mistakenly choose spear phishing because they overlook that whaling is a specific subtype targeting executives, not just any individual.

Why the other options are wrong

Vishing is a voice-based phishing attack conducted over phone calls, not email. The scenario describes emails requesting wire transfers, which is a text-based attack, not voice.

Practice this question →

200

MCQmedium

A procurement clerk receives a text message from someone claiming to be a supplier account manager. The message says a recent payment failed and asks the clerk to update bank details through a link to a secure portal. What should the clerk do first?

A.Open the link and compare it with the supplier's branding

B.Reply to the text and ask the sender to confirm the request

C.Verify the request using a known supplier contact method before taking action

D.Forward the message to finance so they can decide whether it is legitimate

AnswerC

The defining characteristic of social engineering / business email compromise (BEC) is that the attacker controls the communication channel, so the only robust countermeasure is to confirm the request via a channel that the attacker cannot influence — a phone number on file, a corporate address book entry, or a previously verified supplier portal. This breaks the attacker's control loop and ensures that the request is not acted upon solely on the basis of an unverified SMS. It also aligns with the principle of 'trust, but verify' and prevents invoice redirection or fraudulent payment before any harm occurs.

Why this answer

The clerk should independently verify the request using a known supplier contact method (e.g., a phone number on file) before taking any action. This prevents falling victim to a social engineering attack, such as a phishing or business email compromise (BEC) attempt, where the attacker spoofs the sender's identity to redirect payments. Verifying through an out-of-band channel ensures the request is legitimate, as the link in the message could lead to a credential-harvesting site or malware download.

Exam trap

The trap here is that candidates may choose Option D, thinking that forwarding to finance is a safe escalation, but the SY0-701 exam emphasizes that the first step is always independent verification using a trusted method, not delegating or relying on the suspicious communication channel.

How to eliminate wrong answers

Option A is wrong because opening the link and comparing branding is unsafe; the link could lead to a lookalike domain that mimics the supplier's portal, and merely comparing branding does not verify the sender's identity or the link's authenticity, as attackers can easily replicate logos and styles. Option B is wrong because replying to the text allows the attacker to continue the social engineering; the reply goes to the same compromised channel, and the attacker can simply confirm the request, providing no real verification. Option D is wrong because forwarding the message to finance shifts responsibility without verifying the request first; finance may also be deceived by the same spoofed message, and the clerk should independently verify before escalating.

Practice this question →

201

MCQhard

Based on the exhibit, which issue should be remediated FIRST? The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.

A.Internet-facing VPN appliance

B.Internal HR file server

C.Lab workstation

D.DMZ reporting server

AnswerA

This asset should be remediated first because it is directly reachable from the internet, has a publicly known exploit that can be weaponized without authentication, and currently lacks compensating controls such as a WAF, access-control list, or host IPS. That combination yields the highest probability of successful remote compromise in the shortest time, so even if other assets have higher raw CVSS scores, the VPN appliance presents the greatest immediate risk to the organization.

Why this answer

The Internet-facing VPN appliance is the highest priority because it is directly exposed to untrusted networks (the Internet), making it the most likely entry point for attackers. A compromise here could lead to full network access, bypassing all other security controls, which represents the greatest real-world risk regardless of its severity score.

Exam trap

The trap here is that candidates often fixate on the highest CVSS severity score (e.g., a critical vulnerability on the internal server) rather than considering the attack surface and likelihood of exploitation, which is the core of risk-based prioritization.

How to eliminate wrong answers

Option B (Internal HR file server) is wrong because it resides on the internal network and is not directly reachable from the Internet, so its exposure is limited to already-authenticated users; remediating it first would not reduce external attack surface. Option C (Lab workstation) is wrong because it is isolated in a lab environment, typically with restricted network access and no sensitive production data, making its compromise low-impact. Option D (DMZ reporting server) is wrong because while it is in a DMZ, it is not Internet-facing (it is behind the firewall and only accessible from internal or specific external sources), so its risk is lower than a directly exposed VPN gateway.

Practice this question →

202

MCQhard

Based on the exhibit, what is the most likely explanation for the suspicious workstation activity?

A.Ransomware campaign

B.Fileless attack

C.Worm propagation

D.Rootkit persistence

AnswerB

The exhibit shows legitimate Windows tools launching hidden, encoded PowerShell from a scheduled task, with no dropped executable on disk. That pattern strongly suggests a fileless attack, where the payload runs primarily in memory and uses trusted utilities to reduce visibility. The periodic connections after execution also fit a lightweight backdoor or loader rather than a traditional malware binary.

Why this answer

The exhibit shows a PowerShell command that downloads and executes a payload directly in memory without writing to disk. This is a classic indicator of a fileless attack, where malicious code runs in volatile memory (e.g., via PowerShell, WMI, or macros) to evade traditional file-based antivirus detection. The use of `Invoke-Expression` (IEX) with a remote URL confirms the attack vector is fileless.

Exam trap

The trap here is that candidates see a PowerShell command and assume it is a worm or ransomware, but the key detail is the in-memory execution (no file written) which is the hallmark of a fileless attack, not the payload's ultimate goal.

How to eliminate wrong answers

Option A is wrong because ransomware typically encrypts files and leaves ransom notes, but the exhibit shows no evidence of file encryption or ransom demands—only a suspicious PowerShell download cradle. Option C is wrong because worm propagation requires self-replicating code that spreads across networks without user interaction, whereas the exhibit shows a single command executed on one workstation with no lateral movement indicators. Option D is wrong because rootkit persistence involves hiding processes or files at the kernel level (e.g., via driver hooks or MBR modification), but the exhibit shows a one-time in-memory execution with no persistence mechanism like scheduled tasks or registry run keys.

Practice this question →

203

MCQhard

A facilities manager receives an SMS from "FedEx Delivery" saying a shipment for the research lab cannot clear security until the recipient verifies the package by signing in. The message includes the manager's initials and the warehouse code, and the link opens a cloned sign-in page. Which attack is most likely?

A.Smishing, because the attacker is using a text message to deliver a targeted credential lure.

B.Vishing, because the attacker is pretending to be a delivery service representative.

C.Spear phishing, because the message is targeted using the recipient's role and location.

D.Baiting, because the message offers a shipment verification reward to encourage action.

AnswerA

Smishing is the best answer because the attack arrives by SMS and is designed to push the victim to a fake login page. The personalized details make it more convincing, but the defining factor is the text-message delivery channel combined with credential harvesting. This is a common real-world approach for bypassing inbox filtering and exploiting mobile trust.

Why this answer

Smishing is a social engineering attack that uses SMS (Short Message Service) to deliver a fraudulent message designed to trick the recipient into revealing sensitive information. In this scenario, the attacker sends a text message impersonating FedEx, includes the manager's initials and warehouse code for personalization, and provides a link to a cloned sign-in page, which is the classic credential-harvesting mechanism of a smishing attack.

Exam trap

The trap here is that candidates confuse the targeted nature of the message (which suggests spear phishing) with the delivery vector (SMS), but the exam specifically tests the distinction between phishing subtypes based on the communication channel used.

How to eliminate wrong answers

Option B is wrong because vishing (voice phishing) involves a phone call, not an SMS text message; the attack described uses a text message with a link, not a voice call. Option C is wrong because spear phishing is a form of email-based phishing that targets a specific individual or organization; while the message is targeted, the delivery method is SMS, not email, making smishing the more precise classification.

Practice this question →

204

MCQmedium

A resolver log shows multiple clients querying the correct internal host name, but the DNS server starts returning an unexpected public IP address after a burst of unsolicited DNS responses from outside the network. Users are sent to a lookalike login page. What type of attack is most likely occurring?

A.DNS poisoning

B.Brute-force authentication

C.Port scanning

D.Packet sniffing

AnswerA

DNS poisoning directly corrupts the name resolution process: an attacker either forges a DNS response that arrives before the legitimate answer or tampers with a resolver's cache, causing it to return a fraudulent IP address for a valid domain. This matches the scenario exactly because multiple clients querying the correct record will all receive the malicious answer and be redirected to the counterfeit website, while the resolver log simply shows normal queries.

Why this answer

The scenario describes a DNS poisoning (also known as DNS cache poisoning) attack. The burst of unsolicited DNS responses from outside the network is the attacker injecting forged DNS records into the resolver's cache, causing it to map the correct internal host name to an unexpected public IP address. This redirects users to a lookalike login page, which is the classic outcome of DNS poisoning.

Exam trap

The trap here is that candidates may confuse DNS poisoning with packet sniffing because both involve network traffic, but only DNS poisoning actively modifies cached resolution data to redirect users.

How to eliminate wrong answers

Option B is wrong because brute-force authentication involves repeatedly trying passwords against a login interface, not manipulating DNS responses to redirect traffic. Option C is wrong because port scanning is used to discover open ports on a target system, not to alter DNS resolution or redirect users to a fake site. Option D is wrong because packet sniffing passively captures network traffic for analysis, but it does not inject forged DNS responses or modify the resolver's cache.

Practice this question →

205

MCQmedium

A company portal lets employees save a short profile bio. One employee enters a string containing script code, and later other users who view that profile are redirected to a fake sign-in page. What vulnerability best explains this behavior?

A.Reflected cross-site scripting, because the payload only appears in the current request response.

B.Stored cross-site scripting, because the malicious script is saved and served to other users later.

C.Command injection, because the script runs inside the web server process.

D.Session fixation, because the attacker wants the victim to use an old session ID.

AnswerB

Stored XSS occurs when malicious script is persisted by the application, such as in a profile field, comment, or message. Every user who later loads the page receives the harmful content. The redirection to a fake sign-in page shows that the script is executing in other users’ browsers, which makes this a stored, not reflected, attack. Proper output encoding and input handling are needed to prevent it.

Why this answer

The employee's profile bio is saved to the server and later served to other users who view the profile. This is the defining characteristic of stored (persistent) cross-site scripting (XSS): the malicious script is permanently stored on the target server and executed in the browsers of other users when they retrieve the stored data.

Exam trap

The trap here is confusing stored XSS with reflected XSS by focusing on the 'current request' aspect rather than recognizing that the payload is saved and served to other users later, which is the key differentiator.

How to eliminate wrong answers

Option A is wrong because reflected XSS requires the payload to be part of the current request (e.g., in a URL parameter or form input) and is not permanently stored; it only affects the user who submits the request. Option C is wrong because command injection targets the server-side operating system by injecting system commands (e.g., via shell metacharacters like ';' or '|'), not client-side script execution in a browser.

Practice this question →

206

MCQmedium

A cloud-hosted API lets users supply a URL for the service to fetch an image. Shortly after release, logs show requests to 169.254.169.254 and internal admin addresses. What control best reduces this risk?

A.Allow the API to follow any redirect so it works with more image sources.

B.Restrict outbound requests to an allowlist and block internal address ranges.

C.Store the fetched image in encrypted form before sending it to users.

D.Increase the session timeout to reduce repeated logins by legitimate users.

AnswerB

This is a classic server-side request forgery pattern: the server is making attacker-influenced requests to internal or metadata addresses. An allowlist of approved destinations, combined with blocking private and link-local ranges, prevents the service from being used as a proxy into internal systems. That control directly targets the unsafe outbound request behavior and is more effective than trying to clean malicious URLs after the fact. It also reduces exposure to cloud metadata theft and internal service probing.

Why this answer

Restricting outbound requests to an allowlist and blocking internal address ranges directly mitigates the Server-Side Request Forgery (SSRF) vulnerability. The requests to 169.254.169.254 (the AWS/GCP/Azure metadata endpoint) and internal admin addresses indicate an attacker is using the API to probe internal services. An allowlist ensures the API only connects to trusted external hosts, while blocking private and link-local ranges prevents access to internal infrastructure.

Exam trap

The trap here is that candidates may confuse data-at-rest protection (encryption) with access control, or mistakenly think allowing redirects improves functionality without realizing it exacerbates SSRF; The SY0-701 exam often tests the specific cloud metadata endpoint (169.254.169.254) as a classic SSRF indicator.

How to eliminate wrong answers

Option A is wrong because allowing the API to follow any redirect would actually increase the SSRF risk, as an attacker could craft a redirect from an allowed external URL to an internal or metadata endpoint, bypassing initial URL checks. Option C is wrong because storing the fetched image in encrypted form does not prevent the API from making unauthorized requests to internal or metadata endpoints; encryption protects data at rest, not the request origin or destination.

Practice this question →

207

Drag & Dropmedium

Drag and drop the steps for the SSH key exchange process in the correct order.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

SSH key exchange establishes a secure channel; the server's host key is used to verify identity, and Diffie-Hellman generates a shared secret.

Practice this question →

208

MCQmedium

A finance analyst receives an email that appears to come from the CFO. It references a real project, asks for an urgent wire transfer to a "new vendor account," and says to avoid the normal approval workflow because the deal is time-sensitive. What is the best immediate response?

A.Reply to the email asking for additional payment details and wait for a response.

B.Process the transfer quickly because the message appears to come from an executive.

C.Verify the request using a known-good contact method and report the message as suspicious.

D.Forward the email to another finance employee so someone else can confirm the request.

AnswerC

The safest response is to independently verify the request through a trusted channel already on file, such as a known phone number or internal messaging system. That breaks the attacker’s control of the conversation and prevents a rushed financial error. Reporting the message also helps security staff search for related phishing attempts and protect other employees from a similar business email compromise attempt.

Why this answer

The best immediate response is to verify the request using a known-good contact method (e.g., a phone number from the corporate directory) and report the message as suspicious. This defeats the impersonation attempt because the attacker cannot control the out-of-band channel. It also follows the principle of verifying unusual or urgent financial requests through a separate trusted path.

Exam trap

SY0-701 often tests the misconception that replying to or forwarding a suspicious email is a safe way to verify it, when the correct action is out-of-band verification via a known-good channel.

How to eliminate wrong answers

Option A is wrong because replying to the email continues the conversation with the attacker and does not verify the sender's identity; the reply goes to the attacker's address. Option B is wrong because processing the transfer based on appearance of executive authority is exactly the social-engineering trap; urgency and authority are classic pretexts. Option D is wrong because forwarding to another employee does not verify the request and may spread the phishing email, potentially compromising additional accounts.

Practice this question →

209

MCQeasy

A SIEM alert shows one workstation connecting to many internal systems over SMB in a short period of time, followed by attempts to access administrative shares. What is the best response?

A.Ignore the alert because SMB is a normal file-sharing protocol

B.Isolate the workstation to stop possible lateral movement

C.Increase the workstation's monitor brightness to help the user notice alerts

D.Disable all SMB traffic across the entire company immediately

AnswerB

Isolating the workstation is the correct immediate response because the rapid SMB connections to multiple hosts indicate the attacker may be pivoting or spreading laterally. Removing the host from the network, either by disconnecting the cable or disabling the switch port, contains the blast radius while preserving volatile memory and network logs for forensic investigation. This aligns with NIST SP 800-61's containment phase, which prioritizes stopping propagation before eradication or recovery. Later steps can include blocking the account, patching the SMB service, and analyzing the observed behavior to identify the root cause.

Why this answer

The SIEM alert describes classic indicators of lateral movement using SMB, often associated with ransomware or worm-like malware. Isolating the workstation immediately stops the attacker from spreading to other systems via administrative shares (e.g., ADMIN$, C$), which are commonly abused for remote execution. This containment step is the highest priority before any forensic analysis.

Exam trap

The trap here is that candidates may dismiss the alert as normal SMB traffic (Option A) because SMB is common, failing to recognize that the combination of rapid connections and administrative share access is a textbook lateral movement indicator.

How to eliminate wrong answers

Option A is wrong because while SMB is a normal file-sharing protocol, the specific pattern of rapid connections to many internal systems followed by administrative share access is highly anomalous and indicative of malicious lateral movement, not legitimate use. Option C is wrong because increasing monitor brightness has no security function and does not address the alert; it is a nonsensical response that confuses physical display settings with security operations. Option D is wrong because disabling all SMB traffic company-wide is an overly drastic and disruptive response that would break critical business operations, and it should only be considered after proper investigation and with targeted controls like firewall rules or GPO changes.

Practice this question →

210

MCQeasy

A user forwards an email that says their payroll account will be disabled today unless they click a link and verify their password. The message uses the company logo, but the sender address is from a free webmail domain and the link goes to a look-alike login page. What type of attack is this?

A.Baiting, because the attacker is offering something attractive to lure the user.

B.Phishing, because the attacker is using a fraudulent message to steal credentials.

C.Vishing, because the attacker is trying to trick the user into revealing information.

D.Impersonation, because the attacker is pretending to be someone from the company.

AnswerB

Phishing is the best match because the attacker is sending a deceptive message that impersonates a trusted source and directs the user to a fake login page. The goal is credential theft, and the urgency plus look-alike site are common signs. The sender address and request to verify a password are strong indicators of a phishing attempt.

Why this answer

This is a classic phishing attack because the attacker uses a fraudulent email that mimics a legitimate company to trick the user into clicking a link to a look-alike login page, with the goal of stealing their payroll credentials. The key indicators are the spoofed company logo, the free webmail sender address, and the fake login page, all of which are hallmarks of credential harvesting via phishing.

Exam trap

The trap here is that candidates may confuse phishing with vishing or baiting because all involve social engineering, but the specific use of email with a fraudulent link to a fake login page is the defining characteristic of phishing, not voice calls (vishing) or physical lures (baiting).

How to eliminate wrong answers

Option A is wrong because baiting involves offering something attractive (e.g., a free USB drive or download) to lure the victim into a trap, not sending a deceptive email requesting credential verification. Option C is wrong because vishing (voice phishing) uses phone calls or voice messages to trick victims, not email with a link to a fake login page. Option D is wrong because impersonation is a broader social engineering tactic that can be part of phishing, but the specific attack described—using a fraudulent email with a malicious link—is precisely defined as phishing, not impersonation alone.

Practice this question →

211

MCQmedium

A support portal searches customers by last name using a parameter called q. After one user enters a single quote, the app returns a SQL syntax error. A tester then submits `test' OR '1'='1` and sees every customer record. Which control most directly prevents this issue?

A.Parameterize the database queries with prepared statements

B.Encode all output returned to the browser

C.Add CSRF tokens to the login form

D.Move the application to a separate VLAN

AnswerA

Prepared statements parameterize user input so the database engine compiles the SQL query structure once, before any data is bound. The search term is passed as a pure string parameter, never concatenated into the SQL text, so malicious input like ' OR 1=1 -- cannot alter the query's WHERE clause semantics. This eliminates the injection payload's ability to change the query's logical structure.

Why this answer

The vulnerability is SQL injection, which occurs when user input is directly concatenated into a SQL query. Parameterized queries (prepared statements) separate SQL logic from data by using placeholders, ensuring user input is treated as data only and never executed as code. This directly prevents the attacker from injecting malicious SQL fragments like `' OR '1'='1`.

Exam trap

The trap here is that candidates often confuse output encoding (XSS prevention) with input handling (SQL injection prevention), or they think network controls like VLANs can fix application-layer code flaws.

How to eliminate wrong answers

Option B is wrong because encoding output prevents cross-site scripting (XSS), not SQL injection; the attack occurs on the database backend, not in the browser. Option C is wrong because CSRF tokens prevent cross-site request forgery, which tricks a user into submitting unintended requests, but does not stop an attacker from directly crafting malicious input in the search parameter. Option D is wrong because moving the application to a separate VLAN is a network segmentation control that limits lateral movement but does not fix the insecure database query code; the SQL injection would still succeed from the application server.

Practice this question →

212

MCQhard

A security engineer is reviewing a web application that uses a database. The application constructs SQL queries by concatenating user input directly into the query string. During a penetration test, an attacker enters `' OR '1'='1` in the username field and successfully logs in without valid credentials. Which of the following BEST describes the vulnerability and the most effective mitigation?

A.SQL injection; mitigate by using parameterized queries (prepared statements).

B.Cross-site scripting (XSS); mitigate by encoding output.

C.Cross-site request forgery (CSRF); mitigate by using anti-CSRF tokens.

D.Command injection; mitigate by validating input against a whitelist.

AnswerA

The payload `' OR '1'='1` manipulates the SQL query to always evaluate true, bypassing authentication. This is a SQL injection vulnerability caused by concatenating user input into queries. Parameterized queries separate SQL code from data, preventing user input from being interpreted as SQL commands, making them the most effective mitigation for this scenario.

Why this answer

The payload `' OR '1'='1` is a textbook SQL injection that alters the query's WHERE clause to return true, allowing authentication bypass. The root cause is dynamic SQL construction via string concatenation. Parameterized queries ensure that user input is treated as data, not executable code, effectively neutralizing SQL injection.

This is the most robust and recommended mitigation.

Exam trap

The trap here is confusing SQL injection with other injection types like command injection or XSS, and selecting input validation as the primary fix instead of parameterized queries.

Practice this question →

213

MCQhard

Based on the exhibit, which attack is most likely occurring on the local network?

A.DNS cache poisoning

B.ARP spoofing

C.Replay attack

D.Amplification denial-of-service

AnswerB

The host receives repeated ARP replies claiming the gateway IP belongs to a different MAC address, and the same MAC appears on multiple switch ports. That combination indicates ARP spoofing or poisoning, which can redirect traffic through an attacker for interception or disruption. The brief forwarding to another IP is consistent with a man-in-the-middle attempt built on forged ARP replies.

Why this answer

ARP spoofing is the most likely attack because the exhibit shows an attacker sending forged ARP replies to associate the attacker's MAC address with the IP address of the default gateway. This poisons the ARP cache of the victim, causing all traffic destined for the gateway to be sent to the attacker instead, enabling man-in-the-middle interception.

Exam trap

The trap here is that candidates confuse ARP spoofing with DNS cache poisoning because both involve 'poisoning' a cache, but ARP operates at Layer 2 (MAC addresses) while DNS operates at Layer 7 (domain name resolution).

How to eliminate wrong answers

Option A is wrong because DNS cache poisoning involves corrupting a DNS resolver's cache with false DNS records, not manipulating ARP tables at Layer 2. Option C is wrong because a replay attack captures and retransmits valid data packets to trick the receiver, but the exhibit shows direct manipulation of MAC-to-IP mappings, not packet replay. Option D is wrong because an amplification denial-of-service attack uses small queries to generate large responses (e.g., DNS amplification), overwhelming a target with traffic, whereas the exhibit depicts local network ARP manipulation.

Practice this question →

214

Multi-Selecthard

A security analyst is investigating a recent security incident where an attacker gained unauthorized access to a server. The analyst suspects the attacker used a known vulnerability in an outdated web application. Which of the following are the MOST appropriate steps to mitigate this vulnerability in the future? (Choose two.)

Select 2 answers

A.Deploy a web application firewall (WAF) in blocking mode.

B.Implement a patch management process to regularly update the web application.

C.Implement network segmentation to isolate the web server.

D.Enable full disk encryption on the server.

E.Perform a vulnerability scan and remediate findings on a regular schedule.

AnswersB, E

Regular patching ensures that known vulnerabilities are remediated promptly. In this scenario, the outdated web application likely had a publicly known exploit that could have been fixed by applying vendor patches. A formal patch management process includes inventory, testing, and deployment, reducing the window of exposure and preventing similar incidents.

Why this answer

The most effective ways to mitigate a known vulnerability in an outdated web application are to patch it regularly and to proactively identify vulnerabilities through scanning and remediation. These steps directly address the root cause by eliminating the vulnerable code. Other options like WAF, segmentation, or encryption are compensating controls or defense-in-depth measures, but they do not fix the underlying flaw.

Exam trap

The trap here is selecting compensating controls like WAF or segmentation as primary mitigations, when the question asks for steps to mitigate the vulnerability itself.

Practice this question →

215

MCQmedium

A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?

A.SQL injection, because the attacker likely altered a database query.

B.Cross-site scripting, because the attacker could have injected script into the portal.

C.Insecure deserialization, because a crafted object triggered unexpected server-side actions.

D.CSRF, because the attacker may have forced an administrator to submit a form.

AnswerC

Insecure deserialization occurs when an application accepts untrusted serialized data and rebuilds it unsafely. That can allow an attacker to trigger code paths, remote lookups, or even command execution, which matches the LDAP activity and account creation.

Why this answer

The scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.

Exam trap

The trap here is that candidates may confuse insecure deserialization with other injection attacks (SQLi or XSS) because all involve untrusted input, but only deserialization directly allows server-side object reconstruction and arbitrary method invocation without proper validation.

How to eliminate wrong answers

Option A is wrong because SQL injection involves manipulating database queries through input fields, not through serialized objects; the described behavior (LDAP calls and account creation) is not typical of SQL injection, which primarily targets data extraction or modification. Option B is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, not server-side object deserialization; XSS cannot directly cause the server to make outbound LDAP calls or create local accounts.

Practice this question →

216

MCQmedium

Based on the exhibit, which attack is most likely being attempted against the application?

A.Cross-site scripting, because the attacker is trying to inject script into the victim's browser session.

B.Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.

C.Cross-site request forgery, because the attacker is forcing an authenticated user to submit an unwanted request.

D.SQL injection, because the attacker is manipulating a query parameter to expose backend data.

AnswerB

The application accepts a URL parameter and then makes outbound requests to internal resources, including the cloud metadata endpoint. That is the hallmark of SSRF. The attacker is causing the server to reach addresses that should not normally be accessible through a public request path.

Why this answer

The exhibit shows an attacker manipulating a URL parameter (e.g., `?url=http://169.254.169.254/latest/meta-data/`) to make the application fetch an internal resource. This is a classic Server-Side Request Forgery (SSRF) attack, where the application is tricked into making requests to internal services (like cloud metadata endpoints) on the attacker's behalf, bypassing network segmentation.

Exam trap

CompTIA often tests SSRF by showing a URL parameter like `?url=` or `?file=` pointing to an internal IP (e.g., 127.0.0.1 or 169.254.169.254), and candidates confuse it with CSRF because both involve 'forged requests,' but SSRF is server-side while CSRF is client-side.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts (e.g., JavaScript) into a victim's browser, not manipulating server-side requests to internal resources. Option C is wrong because cross-site request forgery (CSRF) forces an authenticated user to submit an unwanted request (e.g., via a forged HTTP POST), but the exhibit shows the attacker directly controlling the request URL, not relying on a victim's session. Option D is wrong because SQL injection targets database queries via input fields (e.g., `' OR 1=1--`), not URL parameters that trigger server-side HTTP requests to internal IPs.

Practice this question →

217

MCQeasy

A login form sends user input directly into a database query. When a tester enters a single quote character, the application returns a database error. What attack is most likely?

A.Cross-site scripting

B.SQL injection

C.Session hijacking

D.Insecure deserialization

AnswerB

This is SQL injection because the application appears to concatenate unsanitized input into a database query. A single quote often breaks query syntax and reveals that user input is being interpreted as part of the SQL command. That is a common sign the application is vulnerable to injection attacks.

Why this answer

The application directly concatenates user input into a database query without sanitization. Entering a single quote breaks the SQL syntax, causing a database error, which is a classic indicator of SQL injection (SQLi). This vulnerability allows an attacker to manipulate the query structure and potentially extract or modify database contents.

Exam trap

The trap here is that candidates may confuse the immediate error response with cross-site scripting (XSS), but the database error clearly indicates the injection is targeting the SQL layer, not the browser's DOM.

How to eliminate wrong answers

Option A is wrong because cross-site scripting (XSS) involves injecting client-side scripts into web pages viewed by other users, not directly into database queries, and a single quote would not typically trigger a database error in an XSS context. Option C is wrong because session hijacking targets an authenticated user's session token (e.g., via theft or fixation) and does not involve injecting characters into a login form to cause a database error. Option D is wrong because insecure deserialization exploits the processing of serialized objects (e.g., PHP or Java serialization) to execute arbitrary code or manipulate application logic, not by sending a single quote into a database query.

Practice this question →

218

Multi-Selecthard

An accounts payable clerk receives an email that appears to come from a long-time vendor. The message asks for an urgent change to bank routing information, says the CFO is traveling, and requests that no one call back because the matter is confidential. The display name looks legitimate, but the reply-to address is different from the sender identity. Which three findings most strongly indicate a pretexting or business email compromise attempt? Select three.

Select 3 answers

A.The message requests a payment change outside the normal approval workflow.

B.The reply-to address does not match the claimed sender identity.

C.The recipient is told to keep the request confidential and avoid calling back.

D.The email contains a professional logo and a consistent signature block.

E.The email uses correct spelling and grammar throughout.

AnswersA, B, C

Unauthorized changes to payment instructions are a classic business email compromise tactic. This bypasses established controls and tries to exploit urgency. It is one of the strongest indicators because legitimate vendors normally accept verification through established channels, not a one-off email request.

Why this answer

The request for a payment change outside the normal approval workflow is a classic indicator of business email compromise (BEC). Attackers exploit the absence of standard verification steps, such as dual authorization or manager sign-off, to redirect funds fraudulently. This bypass of established procedures directly aligns with the social engineering technique of pretexting, where the attacker fabricates a scenario (urgent, confidential, CFO traveling) to pressure the victim into violating policy.

Exam trap

CompTIA often tests the misconception that surface-level professionalism (logos, grammar) indicates legitimacy, when in fact these are easily replicated and the true red flags are procedural violations and header mismatches.

Practice this question →

219

MCQmedium

Based on the exhibit, what type of attack is most likely being used against the accounts payable team?

A.Phishing, because the message asks recipients to open a file and respond quickly.

B.Spear phishing, because the email is tailored to a specific team, project, and recipient.

C.Pretexting, because the sender claims to have spoken with the recipient before.

D.Baiting, because the attacker offers a useful file related to the project.

AnswerB

This is spear phishing because the attacker uses personalized details such as the recipient's name, the internal project name, and a plausible business deadline. Those details are meant to increase trust and pressure the victim into taking action. The goal is to trick a specific target or group, not to send an indiscriminate message to everyone.

Why this answer

B is correct because spear phishing is a targeted attack where the email is customized for a specific individual or group, using personal details like the recipient's name, team, and project to increase credibility. The exhibit shows the email addresses the recipient by name, references the 'Acme Corp Q3 audit' project, and is sent to the accounts payable team, which matches the tailored nature of spear phishing. This makes it more convincing than generic phishing, as the attacker has researched the target to craft a relevant lure.

Exam trap

The trap here is that candidates confuse spear phishing with generic phishing because both involve email, but the key differentiator is the level of personalization—spear phishing uses specific details like the recipient's name and project, while phishing uses generic greetings like 'Dear Customer'.

How to eliminate wrong answers

Option A is wrong because phishing is a broad, untargeted attack sent to many recipients, while the email in the exhibit is specifically addressed to a named individual on the accounts payable team and references a specific project, indicating it is tailored. Option C is wrong because pretexting involves creating a fabricated scenario (e.g., impersonating a colleague or authority figure) to gain trust, but the email does not establish a false identity or backstory beyond claiming a prior conversation, which is a common spear phishing tactic, not a full pretext. Option D is wrong because baiting typically offers a physical item (e.g., a USB drive) or a digital download (e.g., a free file) to lure victims, but the email asks the recipient to open an attached file related to the project, which is a delivery mechanism for malware, not the core attack type—spear phishing better describes the targeted social engineering.

Practice this question →

220

MCQmedium

A finance application works normally for weeks after a contractor leaves the company. On the first business day of the quarter, a hidden task runs, deletes archived reports, and then removes itself from the scheduled task list. What type of malware behavior is this?

A.Worm

B.Logic bomb

C.Rootkit

D.Spyware

AnswerB

A logic bomb is malicious code embedded within a legitimate application that remains inactive until a predefined condition is met, such as a specific date, an event, or an account status change. In this scenario, the finance application functioning normally for weeks and then suddenly deleting files aligns precisely with a time- or event-based trigger, making a logic bomb the most likely cause.

Why this answer

The malware behavior described is a logic bomb because it lies dormant for a specific period (weeks) and triggers on a predefined condition (the first business day of the quarter) to execute a malicious payload (deleting archived reports) and then self-destructs by removing itself from the scheduled task list. This matches the definition of a logic bomb: malicious code that executes when a logical condition is met, often used for sabotage or delayed attacks.

Exam trap

The trap here is that candidates confuse a logic bomb with a worm because both can execute code automatically, but they fail to recognize that a worm's defining characteristic is self-propagation across networks, not a delayed, condition-based trigger.

How to eliminate wrong answers

Option A is wrong because a worm is self-replicating malware that spreads automatically across networks without user intervention, whereas this scenario involves a hidden task that does not replicate or spread. Option C is wrong because a rootkit is designed to hide the presence of malware or unauthorized processes by modifying the operating system kernel or using hooking techniques, not to trigger a delayed destructive action based on a date. Option D is wrong because spyware is focused on covertly collecting and exfiltrating user data (e.g., keystrokes, browsing habits) without the user's knowledge, not on deleting files or self-removal after a time-based trigger.

Practice this question →

221

MCQmedium

A security analyst is examining a Windows workstation that has been exhibiting unusual outbound traffic to an IP address in a foreign country. The analyst runs `netstat -anob` and sees a process named `svchost.exe` listening on TCP port 4444 and maintaining an established connection to that foreign IP. The analyst knows that `svchost.exe` normally hosts legitimate Windows services. Which of the following is the MOST likely explanation for this finding?

A.The `svchost.exe` process is hosting the Windows Time service and synchronizing with an external NTP server.

B.The `svchost.exe` process has been trojanized and is being used as a backdoor listener.

C.A remote administration tool such as Remote Desktop is running on a non-standard port.

D.The workstation is participating in a legitimate peer-to-peer Windows Update delivery.

AnswerB

Legitimate svchost.exe listens on local RPC ports but never on an arbitrary high port with an external established connection. Malware often injects into or replaces svchost.exe to blend in, creating a backdoor listener on a port like 4444. The established session to a foreign IP confirms command-and-control or remote access activity, making this the best explanation.

Why this answer

A legitimate svchost.exe process hosts Windows services and does not listen on arbitrary high ports or maintain external established connections. The presence of a listener on TCP 4444 with an active session to a foreign IP indicates a backdoor, often achieved by injecting malicious code into svchost.exe or replacing it. This behavior is a classic sign of a remote access trojan or command-and-control channel.

Exam trap

The trap here is assuming that any svchost.exe process is benign because it is a legitimate Windows process, when malware frequently masquerades as or injects into svchost.exe.

Practice this question →

222

MCQhard

Based on the exhibit, what is the MOST likely explanation for the network traffic? The affected host is not showing a large amount of internet-bound traffic, but its DNS behavior is highly unusual.

A.DNS tunneling used for command-and-control or data transfer

B.ARP poisoning causing the host to redirect traffic to a rogue gateway

C.A browser cache synchronization feature repeatedly polling a cloud service

D.A misconfigured static route sending all web traffic to the wrong subnet

AnswerA

The repeated queries to long, randomly generated subdomains, combined with the prevalence of NXDOMAIN responses and the absence of ordinary browsing traffic, are classic indicators of DNS tunneling. In this technique, malware encapsulates command-and-control messages or exfiltrated data into the domain namespace, encoding payloads in subdomain labels and receiving instructions or data in DNS replies such as TXT records. The NXDOMAIN responses may represent either intentional 'no data' signals from the malicious authoritative server or failed resolution attempts that are still part of the tunnel's call-and-response pattern.

Why this answer

The exhibit shows a host with minimal internet-bound traffic but highly unusual DNS behavior, such as frequent queries to a single domain or large DNS query sizes. This pattern is characteristic of DNS tunneling, where data is encoded in DNS queries and responses to bypass network controls, often used for command-and-control (C2) communication or covert data exfiltration. The lack of other traffic indicates the host is not performing normal web browsing or data transfers, making DNS tunneling the most likely explanation.

Exam trap

The trap here is that candidates may overlook the significance of 'unusual DNS behavior' and minimal internet traffic, instead focusing on common attacks like ARP poisoning or benign browser features, which would produce different traffic patterns (e.g., high traffic or periodic HTTP requests).

How to eliminate wrong answers

Option B is wrong because ARP poisoning would cause the host to redirect traffic to a rogue gateway, resulting in a large amount of internet-bound traffic as the host communicates through the attacker's system, not minimal traffic with unusual DNS behavior. Option C is wrong because a browser cache synchronization feature repeatedly polling a cloud service would generate consistent, periodic HTTP/HTTPS traffic to a known cloud provider, not the highly unusual DNS queries (e.g., high query rates, large TXT records) seen in the exhibit, and would not explain the lack of other internet-bound traffic.

Practice this question →

223

MCQmedium

A security analyst is reviewing logs after a successful phishing attack. The attacker used a fake login page that mimicked the company's single sign-on portal to harvest usernames and passwords. The attacker then used the stolen credentials to access the corporate email system. Which type of attack best describes the initial compromise?

A.On-path attack

B.Credential harvesting via phishing

C.Brute-force attack

D.Password spraying

AnswerB

Correct. The attacker used a deceptive email or website to trick users into voluntarily entering their credentials. This is the defining characteristic of phishing-based credential harvesting. The stolen credentials were then reused to access the corporate email system.

Why this answer

The initial compromise was achieved by luring the victim to a fake login page that mimicked the company's single sign-on portal, which is a classic phishing technique. The attacker harvested the credentials directly from the user's submission, making this a credential harvesting attack via phishing. This aligns with the definition of phishing as a social engineering attack that uses deception to obtain sensitive information, distinct from brute-force or password spraying which rely on guessing or trying multiple passwords.

Exam trap

The trap here is that candidates may confuse credential harvesting via phishing with an on-path attack, because both involve intercepting credentials, but phishing relies on user deception to voluntarily submit credentials, whereas an on-path attack captures them transparently during an existing session.

Why the other options are wrong

The initial compromise was achieved through a fake login page that harvested credentials, which is credential harvesting via phishing, not an on-path attack. An on-path attack involves intercepting or modifying communications between two parties, not tricking users into entering credentials on a fake site.

The initial compromise was achieved through a fake login page that harvested credentials, not by systematically guessing passwords. Brute-force attacks involve automated guessing of many password combinations, which is not described here.

Password spraying involves trying a few common passwords against many accounts, not using a fake login page to harvest credentials from a single phishing attack.

Practice this question →

224

MCQmedium

A scan finds two issues: a critical flaw on a lab server reachable only through VPN, and a high-severity flaw on an internet-facing file transfer appliance with active exploitation in the wild. Which should be remediated first?

A.The lab server, because critical severity is always higher than high severity.

B.The internet-facing file transfer appliance, because exploitability and exposure increase risk.

C.Both issues at the same time, because prioritization is unnecessary when two findings are present.

D.The lab server, because systems behind VPN are always more trusted than public systems.

AnswerB

The internet-facing appliance should be fixed first because it is exposed to untrusted users and already being exploited in the wild. Risk-based prioritization considers not only severity but also exposure, exploit availability, and business impact. A high-severity flaw with active exploitation on a public-facing system is usually more urgent than a critical flaw on a restricted lab server.

Why this answer

The internet-facing file transfer appliance with active exploitation in the wild presents a higher risk because it is directly exposed to untrusted networks and has a known exploit that attackers are actively using. Even though the lab server has a critical severity rating, its reachability only through VPN significantly reduces its attack surface and likelihood of exploitation. Risk is a function of both severity and exploitability/exposure, so the actively exploited, internet-facing asset should be remediated first.

Exam trap

The trap here is that candidates assume CVSS severity alone dictates remediation order, ignoring that exploitability and exposure (e.g., internet-facing vs. VPN-restricted) are critical factors in risk-based prioritization.

How to eliminate wrong answers

Option A is wrong because severity alone does not determine remediation priority; a critical flaw on a VPN-restricted lab server is less exploitable than a high-severity flaw on an internet-facing system with active exploitation. Option C is wrong because prioritization is essential when resources are limited; remediating both simultaneously is often impractical and ignores the higher immediate risk posed by the actively exploited internet-facing appliance.

Practice this question →

225

MCQmedium

A security analyst is reviewing web server logs from an e-commerce application. The logs show repeated requests containing URLs with appended strings such as: `' OR '1'='1' --` and `'; DROP TABLE Users; --`. The application returned HTTP 200 responses with unexpected data in several instances. Which type of attack is most likely being attempted?

A.SQL injection

B.LDAP injection

C.Command injection

D.Cross-site scripting (XSS)

AnswerA

Correct. The log entries show SQL syntax such as `OR '1'='1'` and `DROP TABLE`, which are classic indicators of SQL injection attempts. This attack exploits improper input sanitization to manipulate database queries. These payloads are appended to SQL statements executed by the web application's backend database, allowing an attacker to bypass authentication or alter data.

Why this answer

The repeated requests contain classic SQL injection payloads, such as `' OR '1'='1' --` (used to bypass authentication or extract data) and `'; DROP TABLE Users; --` (used to delete database tables). The HTTP 200 responses with unexpected data confirm that the application is vulnerable to SQL injection, as the injected SQL code is being executed against the backend database. This attack targets the SQL database layer, not LDAP directories or operating system commands.

Exam trap

The trap here is that candidates may confuse SQL injection with command injection because both use special characters like `'` and `;`, but command injection requires OS command separators and system commands, whereas SQL injection uses database-specific syntax and keywords.

Why the other options are wrong

The logs show SQL syntax like `' OR '1'='1' --` and `DROP TABLE Users`, which are classic SQL injection payloads, not LDAP injection. LDAP injection uses LDAP query syntax, not SQL.

The logs show SQL syntax patterns like ' OR '1'='1' and DROP TABLE, which are classic SQL injection attempts. Command injection typically involves system commands (e.g., ; ls -la) and would not produce SQL-like strings.

The logs show SQL syntax (' OR '1'='1' --, DROP TABLE) and HTTP 200 responses with unexpected data, indicating database manipulation, not client-side script execution. XSS involves injecting scripts into web pages viewed by other users, not direct database queries.

Practice this question →