Malware, Social Engineering and Network Attacks practice questions

Blackholing all traffic to the target IP

Why wrong: Blackholing drops all traffic, including legitimate, causing denial of service.

Anycast network distribution

Why wrong: Anycast distributes traffic across multiple servers, absorbing some attack but not filtering malicious traffic.

Rate limiting on the firewall

Why wrong: Rate limiting can help but may also drop legitimate traffic during an attack.

ARP poisoning

Why wrong: ARP poisoning poisons ARP caches, not CAM tables.

DHCP starvation

Why wrong: DHCP starvation exhausts IP address leases, not CAM tables.

DNS spoofing

Why wrong: DNS spoofing corrupts DNS responses.

UDP flood

Why wrong: UDP flood is a volumetric attack at the transport layer.

ICMP flood

Why wrong: ICMP flood is a volumetric attack at the network layer.

SYN flood

Why wrong: SYN flood is a protocol attack at the transport layer.

Disassemble the file using IDA Pro to understand its code

Why wrong: Disassembly is a form of static analysis.

Run 'strings' on the file and analyze the output

Why wrong: This is static analysis, not dynamic.

Submit the file again to VirusTotal for a second opinion

Why wrong: This is still static analysis and does not reveal runtime behavior.

MAC flooding

Why wrong: MAC flooding overwhelms the switch's CAM table.

Cookie theft

Why wrong: Cookie theft steals session tokens from the application layer.

ARP poisoning

Why wrong: ARP poisoning manipulates ARP caches, not TCP sequence prediction.

ICMP flood

Why wrong: An ICMP flood is a Layer 3 (Network Layer) volumetric denial-of-service attack that overwhelms a target's network infrastructure. Attackers send a massive number of ICMP echo request packets, commonly known as "ping flood," to the victim. The target's network devices and host systems expend significant resources processing these requests and generating replies, leading to bandwidth saturation and system unresponsiveness.

SYN flood

Why wrong: A SYN flood is a Layer 4 (Transport Layer) protocol-based denial-of-service attack that exploits the TCP three-way handshake mechanism. The attacker sends numerous TCP SYN requests to the target server but never completes the handshake by sending the final ACK. This leaves the server's connection state tables full of half-open connections, exhausting its capacity to establish new legitimate connections.

UDP flood

Why wrong: A UDP flood is a Layer 4 (Transport Layer) volumetric denial-of-service attack where the attacker sends a large volume of User Datagram Protocol packets to random ports on a target server. Since UDP is connectionless, the server attempts to identify the application listening on each port. When no application is found, the server generates an ICMP "Destination Unreachable" packet, consuming significant bandwidth and CPU cycles, leading to service degradation.

DNS cache poisoning

Why wrong: DNS cache poisoning involves injecting forged or malicious data into a DNS resolver's cache, causing it to return incorrect IP addresses for legitimate domains. While this redirects user traffic to attacker-controlled servers, it does not inherently generate a large volume of outgoing DNS responses from the poisoned server itself. The attack manipulates resolution, rather than creating a surge in response traffic.

DNS zone transfer

Why wrong: A DNS zone transfer is a legitimate process where a secondary DNS server requests and receives a full copy of a zone file from a primary DNS server. This mechanism ensures data consistency and redundancy across authoritative DNS servers. Although it involves data transfer, it is a controlled, authorized replication process, not an unsolicited attack that would cause an unexpected, massive surge in outgoing responses from a server.

DNS amplification DDoS attack

Why wrong: A DNS amplification DDoS attack leverages open recursive DNS resolvers to flood a target with an overwhelming volume of DNS response traffic. Attackers send small DNS queries with a spoofed source IP address (the target's IP) to numerous vulnerable resolvers, which then send much larger responses to the unsuspecting victim. This technique effectively uses the compromised or misconfigured DNS servers as amplifiers, generating a significant surge in outgoing data towards the target.

Disassemble the file with IDA Pro

Why wrong: Disassembly is time-consuming and not a first step.

Check for strings in the binary

Why wrong: String analysis is part of static analysis but VirusTotal is a better first step for known samples.

Run the file in a sandbox environment

Why wrong: Sandbox is dynamic analysis, riskier and slower; should be done after static analysis.

Rate limiting

Why wrong: Rate limiting restricts traffic volume per source, not geographic distribution.

Load balancer

Why wrong: Load balancers distribute traffic within a local network, not geographically.

Scrubbing center

Why wrong: Scrubbing centers filter malicious traffic but are centralized, not distributed.

Polymorphic virus

Why wrong: A polymorphic virus is characterized by its ability to constantly change its executable code and encryption key to evade signature-based detection. While its initial infection vector might involve user interaction, such as executing an infected file, the virus itself does not typically require further user action to activate its payload or propagate once resident within a system. Its primary design focus is stealth and persistence, not reliance on ongoing user engagement for its core malicious functions.

Worm

Why wrong: Worms are self-replicating malware designed to spread autonomously across networks by exploiting software vulnerabilities or misconfigurations, rather than relying on user deception. They do not require user interaction, such as opening a file or clicking a link, to activate their payload or propagate to new systems. Their inherent capability for independent network traversal and exploitation distinguishes them from malware types that necessitate direct human engagement for activation.

Running the malware in a sandbox

Why wrong: Running malware in a sandbox is a quintessential dynamic analysis technique because it involves executing the malicious code within an isolated, controlled environment. The primary goal is to observe its real-time behavior, such as file system modifications, registry changes, and process interactions, as they actively occur. This active execution and observation distinguish it from static methods, which analyze the code without running it.

Capturing network traffic during execution

Why wrong: Capturing network traffic during execution is a clear example of dynamic analysis, as it necessitates the malware being actively run to generate network communications. By observing the live data packets, connections, and protocols used by the malware in real-time, analysts can understand its command-and-control (C2) infrastructure or data exfiltration attempts. This method focuses on the operational network interactions rather than the static code structure.

Monitoring process behavior with Process Monitor

Why wrong: Monitoring process behavior with tools like Process Monitor is a dynamic analysis technique because it tracks the malware's interactions with the operating system in real-time during its execution. This involves observing live system calls, file operations, registry access, and thread activity as the malicious process unfolds. Such active observation of system-level changes provides insights into the malware's operational footprint, which is distinct from merely inspecting its static binary content.

Tailgating

Why wrong: Tailgating, also known as piggybacking, is a physical security breach where an unauthorized individual gains access to a restricted area by closely following an authorized person. This technique exploits human courtesy or inattention to bypass physical access controls like keycard readers or security checkpoints. It is entirely unrelated to remote, digital login attempts against a computer system or network service.

Baiting

Why wrong: Baiting is a social engineering tactic where an attacker offers something enticing, such as a malware-laden USB drive left in a public place or a tempting download link, to lure a victim into taking an action that compromises their system or data. This method relies on the victim's curiosity or greed to initiate the attack, requiring direct user interaction rather than automated, remote login attempts against a system's authentication mechanism.

Phishing

Why wrong: Phishing is a widespread social engineering attack involving the sending of fraudulent communications, typically via email, SMS (smishing), or voice (vishing), designed to trick individuals into revealing sensitive information or performing actions. Attackers impersonate trusted entities to coerce victims into divulging credentials, financial data, or installing malware. This differs significantly from automated, repeated login attempts directed at a system, which do not involve direct deceptive communication with a user.

DNS spoofing

Why wrong: DNS spoofing redirects traffic, but session hijacking requires intercepting an existing session.

MAC flooding

Why wrong: MAC flooding is for sniffing, not session hijacking.

ARP poisoning

Why wrong: ARP poisoning is a technique to enable MITM, not a direct session hijacking method.

Disabling TCP SYN cookies

Why wrong: SYN cookies help mitigate SYN floods; disabling them weakens defenses.

Using a single server with high bandwidth

Why wrong: Single server can still be overwhelmed.

Tailgating

Why wrong: Tailgating is a physical security breach where an unauthorized individual gains entry to a restricted area by closely following an authorized person without their explicit consent. This social engineering tactic relies on human courtesy or distraction, allowing bypass of access controls like card readers or turnstiles. It is fundamentally distinct from network-based login attempts, as it involves direct physical access rather than cyber exploitation.

Phishing attack

Why wrong: Phishing is a social engineering technique where attackers send fraudulent communications, typically emails or text messages, designed to trick recipients into revealing sensitive information or performing malicious actions. Unlike direct login attempts against a system, phishing relies on user interaction, such as clicking a deceptive link or entering credentials into a fake website. This method aims to harvest credentials indirectly from the victim, rather than systematically guessing them on a login portal.

Shoulder surfing

Why wrong: Shoulder surfing is a low-tech social engineering method where an attacker directly observes a victim entering sensitive information, such as passwords or PINs, by looking over their shoulder. This technique requires physical proximity to the target and is an opportunistic form of information gathering, relying on visual theft rather than automated network probes. It is entirely distinct from the automated, remote login attempts described in the question, which occur over a network without direct physical observation.

Whaling

Why wrong: Whaling targets high-profile executives like the CFO, often with CEO impersonation.

Baiting

Why wrong: Baiting involves offering something enticing, like a free USB drive.

Phishing

Why wrong: Phishing is generic mass email, not targeted.

Port knocking

Why wrong: Port knocking is a network access control mechanism where a user attempts to connect to a series of closed ports in a specific, predefined sequence to open a single, otherwise closed, port on the firewall. This technique is primarily used for stealthy remote access and authentication, not for filtering or absorbing the high volumes of malicious traffic characteristic of a Distributed Denial of Service (DDoS) attack. It does not prevent the initial flood of packets from reaching the network perimeter.

ARP poisoning

Why wrong: ARP poisoning, also known as ARP spoofing, is a malicious technique where an attacker sends falsified Address Resolution Protocol (ARP) messages over a local area network. This links an attacker's MAC address with the IP address of a legitimate network device, such as a router or another host, to intercept or modify traffic. As an offensive technique used to disrupt or eavesdrop on network communications, it is fundamentally an attack vector, not a defensive mitigation strategy against DDoS attacks.

MAC filtering

Why wrong: MAC filtering is a Layer 2 access control method that permits or denies network access based on a device's unique Media Access Control (MAC) address. While it can be used for basic access control on small, static networks, it is easily bypassed by MAC spoofing and is entirely ineffective against Distributed Denial of Service (DDoS) attacks. DDoS attacks typically involve a vast number of spoofed or legitimate, but compromised, IP addresses and operate at higher network layers, rendering MAC-based filtering irrelevant for large-scale volumetric attacks.

Persistent high CPU usage by a single process

Why wrong: Could be legitimate or other malware, not specific to backdoors.

Increased number of DNS queries to known legitimate sites

Why wrong: Increased queries to legitimate sites is not typical; backdoors may use DNS tunneling but that's to malicious domains.

Session hijacking

Why wrong: Session hijacking typically exploits session tokens, not ARP.

MAC flooding

Why wrong: MAC flooding aims to overflow the switch's CAM table, not to associate an IP with multiple MACs via ARP replies.

DNS spoofing

Why wrong: DNS spoofing corrupts DNS resolution, not ARP tables.

Duplicate IP addresses in the ARP table

Why wrong: When an ARP spoofing attack is underway, the victim's ARP table may contain multiple entries for the same IP address, each mapped to a different MAC address. This occurs because the attacker sends unsolicited ARP replies claiming to be the legitimate gateway or host, causing the victim's system to update its cache with the attacker's MAC address for the target IP, while the original, legitimate entry might still exist or be intermittently re-added. This inconsistency directly reveals the manipulation of ARP mappings.

A sudden spike in DNS traffic

Why wrong: A sudden spike in DNS traffic is not a direct indicator of ARP spoofing. While an attacker might combine ARP spoofing with DNS manipulation, the spike itself points to issues within the DNS protocol, such as a DNS amplification attack, a misconfigured DNS server, or an attempt at DNS cache poisoning where a malicious server floods clients with incorrect records. ARP spoofing primarily manipulates local network layer 2 mappings, not the volume or nature of DNS queries.