Scenario practice questions

DNS cache poisoning

Why it fails: DNS cache poisoning involves injecting forged or malicious data into a DNS resolver's cache, causing it to return incorrect IP addresses for legitimate domains. While this redirects user traffic to attacker-controlled servers, it does not inherently generate a large volume of outgoing DNS responses from the poisoned server itself. The attack manipulates resolution, rather than creating a surge in response traffic.

DNS zone transfer

Why it fails: A DNS zone transfer is a legitimate process where a secondary DNS server requests and receives a full copy of a zone file from a primary DNS server. This mechanism ensures data consistency and redundancy across authoritative DNS servers. Although it involves data transfer, it is a controlled, authorized replication process, not an unsolicited attack that would cause an unexpected, massive surge in outgoing responses from a server.

DNS amplification DDoS attack

Why it fails: A DNS amplification DDoS attack leverages open recursive DNS resolvers to flood a target with an overwhelming volume of DNS response traffic. Attackers send small DNS queries with a spoofed source IP address (the target's IP) to numerous vulnerable resolvers, which then send much larger responses to the unsuspecting victim. This technique effectively uses the compromised or misconfigured DNS servers as amplifiers, generating a significant surge in outgoing data towards the target.

Baiting

Why it fails: Baiting relies on an attacker leaving a physical or digital 'bait' for the victim to discover and interact with, such as a malware-laden USB drive or a tempting 'free download' link. The victim is lured by the promise of something desirable, triggering their curiosity or greed. This scenario, involving a direct phone call without an initial enticing 'offer' to be found, does not align with the typical characteristics of a baiting attack.

Phishing

Why it fails: Phishing is a broad social engineering technique primarily executed through electronic communication, typically email or fraudulent websites, designed to trick recipients into revealing personal information or clicking malicious links. It often involves impersonating a legitimate organization to create a sense of trust or urgency. While 'vishing' is a form of phishing, the term 'phishing' alone generally refers to text-based or web-based attacks, not direct voice calls.

Vishing

Why it fails: Vishing, or voice phishing, is a social engineering attack conducted over the telephone, where attackers attempt to solicit sensitive information by impersonating trusted entities. Unlike pretexting, vishing often relies on generic, high-volume scripts that exploit fear or urgency, such as fake IRS calls or tech support scams, without necessarily developing a highly specific, tailored backstory for the individual target. The key distinction here is the lack of a deeply fabricated, individualized scenario that defines pretexting.

Vishing

Why it fails: Vishing, or voice phishing, is a social engineering attack conducted exclusively over voice communication channels, typically via telephone calls or Voice over IP (VoIP). Unlike email-based attacks, vishing relies on verbal manipulation and urgency to trick victims into divulging confidential information, such as account numbers or passwords. Since the scenario explicitly describes an attack received via 'email,' vishing is an incorrect classification for this specific method of delivery.

Phishing

Why it fails: Phishing refers to a broad, untargeted social engineering attack that casts a wide net, sending generic malicious emails to a large number of recipients indiscriminately. These attacks typically lack personalization and rely on sheer volume, hoping a small percentage of recipients will fall for common lures like fake login pages or urgent account notifications. In this scenario, the attack is specifically directed at a 'security analyst,' indicating a targeted approach rather than a general, mass-distributed campaign.

Whaling

Why it fails: Whaling is a highly specialized form of spear phishing that specifically targets high-profile individuals within an organization, such as C-level executives, board members, or other senior management. The objective is often to initiate large financial transfers or gain access to highly sensitive corporate data by impersonating a trusted authority. While the scenario mentions the CEO, they are the *impersonated sender* of the malicious email, not the *target* of the attack, which is the security analyst, making whaling an inappropriate classification.

Vishing

Why it fails: Vishing, a portmanteau of 'voice' and 'phishing,' is a social engineering attack conducted over the telephone, not via email as described in the question stem. Attackers use voice calls to trick victims into revealing personal information, transferring money, or installing malware, often by impersonating banks, government agencies, or technical support. Since the attack vector in the scenario is email, vishing is an incorrect classification for this specific threat.

Spear phishing

Why it fails: Spear phishing involves highly targeted email attacks directed at specific individuals within an organization, leveraging personalized information to increase credibility and bypass security measures. While it shares the targeted nature with whaling, spear phishing typically focuses on any specific employee to gain initial access or information, whereas whaling specifically targets C-level executives or other high-value individuals due to their elevated authority and access to critical assets. The distinction lies in the strategic importance and hierarchical position of the intended victim.

Phishing

Why it fails: Phishing is a broad, general term for social engineering attacks that attempt to trick victims into revealing sensitive information, often through deceptive emails or websites. These attacks are typically untargeted or broadly targeted, casting a wide net to ensnare as many victims as possible without significant personalization for each recipient. The scenario, however, describes a highly specific attack aimed at a CEO, which falls under a more specialized category than general phishing due to the target's unique position and the implied level of customization.

ARP poisoning

Why it fails: ARP poisoning corrupts the ARP cache to redirect traffic between hosts; it does not populate the CAM table with fabricated source MAC addresses. CAM table overflow requires flooding frames with many spoofed source MACs, exhausting the fixed-size forwarding table so the switch floods all ports. ARP poisoning is used for man-in-the-middle interception instead.

DHCP starvation

Why it fails: DHCP starvation exhausts a DHCP server's lease pool by requesting addresses with fabricated client MAC addresses, denying legitimate clients configuration; the switch's CAM table is not the target. CAM table overflow requires flooding frames with many spoofed source MACs to exhaust the forwarding table. DHCP starvation would fit a stem about clients failing to obtain leases.

DNS spoofing

Why it fails: DNS spoofing forges name-resolution responses to redirect clients to malicious IP addresses; it never writes entries into the switch's CAM table. CAM table overflow needs a flood of frames bearing spoofed source MAC addresses, exhausting the forwarding table. DNS spoofing would be correct if the stem described falsified DNS replies.

Phishing

Why it fails: Phishing refers to a broad, non-targeted social engineering attack distributed widely to a large number of recipients, often using generic lures and lacking specific personalization. These attacks typically aim to harvest credentials or spread malware without tailoring the content to individual victims. The described scenario involves an email specifically crafted for a particular employee, making it a targeted attack rather than general, untargeted phishing.

Vishing

Why it fails: Vishing, or voice phishing, is a social engineering attack conducted exclusively over telephone calls, often leveraging Voice over IP (VoIP) to spoof caller ID. Attackers attempt to trick victims into revealing sensitive information or performing actions by impersonating legitimate entities. Since the described scenario involves an email-based attack, it fundamentally does not align with the definition of vishing.

Whaling

Why it fails: Whaling is a highly targeted form of spear phishing specifically aimed at senior executives, such as CEOs, CFOs, or other high-value targets within an organization. The objective is to gain access to critical data or authorize significant financial transactions, often involving large sums of money. Although the email in this scenario appears to originate from the CEO, the recipient is a regular employee, not an executive, therefore it is not classified as whaling.

Pretexting

Why it fails: Pretexting relies on an elaborate, pre-planned scenario or "pretext" to manipulate the target into divulging information or performing an action. This often involves impersonating someone in authority or a trusted entity and engaging in a conversation to build rapport and trust over time. The scenario described, however, appears to be a more direct impersonation for a specific action rather than an unfolding, fabricated narrative designed to extract information through a detailed backstory.

Spear phishing

Why it fails: Spear phishing is a highly targeted form of phishing that focuses on specific individuals or organizations, often leveraging personalized information to increase credibility and trick the victim. While the attack described is indeed targeted, the critical distinguishing factor here is the elevated status of the intended victim, which is a senior executive or high-value target. Spear phishing can target anyone with personalized information, whereas whaling specifically targets the upper echelons of an organization.

Quid pro quo

Why it fails: Quid pro quo social engineering involves an attacker offering a perceived benefit or service in exchange for information or access from the target. This often manifests as a "help desk" call offering to fix a problem in exchange for login credentials, or a survey offering a prize for participation. The described attack, however, is a direct impersonation aimed at eliciting a specific action or information without offering any reciprocal service or benefit to the victim.

SYN scan

Why it fails: A SYN scan, also known as a half-open scan, sends TCP SYN packets to target ports and waits for a SYN/ACK response to identify open ports without completing the three-way handshake. Crucially, this technique uses the attacker's actual source IP address, meaning an IDS would accurately log the attacker's machine as the origin of the scan, not a spoofed or decoy IP. Therefore, it does not involve hiding the true source among multiple IPs.

Idle scan

Why it fails: An Idle scan leverages a 'zombie' host's IP ID sequence to infer open ports on a target without sending packets directly from the attacker's machine. The attacker spoofs the zombie's IP address as the source for probe packets sent to the target. While it hides the attacker's true IP, the IDS would primarily register the zombie's IP as the source of the scan, not multiple arbitrary legitimate servers or decoys.

Fragmentation scan

Why it fails: A Fragmentation scan attempts to evade network security devices, such as firewalls and IDSs, by splitting the TCP header across multiple IP fragments. This technique aims to bypass rules that only inspect the initial fragment for specific flags or port numbers. However, a fragmentation scan does not involve IP spoofing; the source IP address in all fragments remains the attacker's actual IP, making the origin traceable despite the packet manipulation.

UDP flood

Why it fails: A UDP flood involves an attacker sending a large volume of User Datagram Protocol (UDP) packets, often with spoofed source IP addresses, to random or specific ports on a target system. This attack aims to consume network bandwidth and system resources as the target attempts to process these stateless connections and potentially generate ICMP "Destination Unreachable" responses. However, the observed high volume of ICMP echo replies directly contradicts a UDP flood, which primarily involves UDP traffic and not ICMP echo replies.

Ping of Death

Why it fails: The Ping of Death attack exploits a vulnerability in older operating systems by sending an ICMP Echo Request packet that is larger than the maximum allowed IP packet size (65,535 bytes) after reassembly. This oversized, malformed packet would cause a buffer overflow or system crash upon processing, rather than generating a high volume of ICMP echo replies. The core mechanism is a single, specially crafted packet designed to crash a system, not a distributed flood of legitimate-sized responses.

ICMP flood

Why it fails: An ICMP flood, often referred to as a "ping flood," involves an attacker directly sending a continuous stream of ICMP Echo Request packets to a target system. The objective is to consume the target's bandwidth and processing resources by forcing it to respond to each request, ultimately leading to a denial of service. However, the observed traffic is a high volume of ICMP echo replies, not requests, and typically an ICMP flood originates from a single or limited number of attacker machines, not a distributed response from many sources.

Rate limiting

Why it fails: Rate limiting can reduce the overall volume of traffic reaching a server or network, potentially mitigating some aspects of a flood. However, it does not specifically address the resource exhaustion caused by incomplete TCP handshakes, which is the core problem in a SYN flood. While it might drop excessive SYN packets, it doesn't prevent the server from allocating resources for the SYN-ACKs it does send, nor does it validate the legitimacy of the connection attempts.

Anycast distribution

Why it fails: Anycast distribution is a network routing technique that directs traffic for a single IP address to the topologically nearest server among a group of servers. While beneficial for load balancing and improving availability across multiple data centers, it does not inherently prevent or mitigate SYN flood attacks. Each individual server within the Anycast group remains susceptible to SYN exhaustion if it receives a high volume of incomplete TCP connection attempts, as Anycast simply distributes traffic, not filters or validates it.

Ingress filtering

Why it fails: Ingress filtering is a network security practice implemented at the network's edge, typically by ISPs or organizational border routers, to block incoming traffic with spoofed source IP addresses. While crucial for preventing source IP spoofing and making SYN floods harder to trace, it is a preventative measure applied upstream. In the scenario described, the high number of incomplete TCP connections indicates the attack packets have already reached the target server, rendering ingress filtering an ineffective direct solution for an ongoing SYN flood at the server level.

Quid pro quo

Why it fails: Quid pro quo social engineering relies on offering a service or benefit in exchange for information, creating a reciprocal transaction. An attacker might pose as IT support offering to fix a problem if the user provides their password or offers a free gift for personal details. The scenario describes creating a false identity to extract information, not an explicit exchange of services for data.

Baiting

Why it fails: Baiting involves luring a victim with a tempting physical or digital object, such as a malware-laden USB drive left in a public place or a 'free download' link that promises exclusive content. The victim is enticed to interact with the lure, which then compromises their system or prompts them for credentials. This differs from the scenario, which describes a direct phone call using a fabricated story rather than a physical or digital enticement.

Phishing

Why it fails: Phishing primarily involves sending fraudulent electronic communications, typically via email or SMS (smishing), to a large number of recipients, impersonating a trustworthy entity. The goal is to trick victims into revealing sensitive data like login credentials or financial information, often by directing them to malicious websites. While voice phishing (vishing) exists, the core concept of phishing generally refers to broad, often untargeted, electronic attacks, distinct from a targeted phone call with a specific false identity and fabricated scenario.

Whaling

Why it fails: Whaling is a highly specific form of spear phishing that exclusively targets high-profile individuals within an organization, such as C-level executives (CEO, CFO, CTO) or senior government officials. These attacks are meticulously crafted, often leveraging extensive reconnaissance to impersonate authoritative figures or critical business communications, aiming for significant financial fraud or access to highly sensitive corporate data. The question describes an attack on "an employee," which is too general to classify as whaling without specifying a C-suite or equivalent high-value target.

Phishing

Why it fails: Phishing refers to a broad, non-targeted social engineering attack typically distributed en masse via email or other electronic communication channels. These campaigns rely on generic lures, such as fake bank alerts or lottery winnings, sent to a wide, indiscriminate audience, hoping a small percentage will fall victim. The attack described, where an email "appears to be from the CEO" to a specific employee, indicates a level of targeting and personalization that distinguishes it from the indiscriminate nature of traditional, generic phishing.

Pretexting

Why it fails: Pretexting is a social engineering technique where an attacker creates a fabricated scenario or "pretext" to manipulate a victim into divulging sensitive information or performing an action. This often involves impersonating someone in authority or a trusted entity and constructing a believable backstory to build rapport and trust. While the email might involve impersonation, the core of pretexting is the elaborate narrative used to trick the victim, which is not explicitly detailed in the question's description of a direct request from the CEO.

Install a mantrap at the main entrance and require two-factor authentication for the data center door.

Why it fails: Installing a mantrap at the main entrance effectively prevents physical tailgating and unauthorized entry into the facility. Requiring two-factor authentication for the data center door further strengthens physical access control to critical infrastructure. However, these measures solely address physical security and do not mitigate the risk of social engineering attacks targeting logical access, such as an attacker manipulating help desk personnel to reset a user's password.

Deploy security guards at the entrance 24/7 and implement a policy that all visitors must be escorted.

Why it fails: Deploying 24/7 security guards and enforcing a visitor escort policy significantly enhances physical security by deterring unauthorized entry and monitoring individuals within the facility, thereby reducing tailgating risks. Nevertheless, these measures are primarily focused on physical access control. They offer no direct protection against remote social engineering attacks, where an attacker might impersonate a legitimate user over the phone or email to trick IT support into performing a password reset.

Implement a callback verification process for all password reset requests and require a manager approval.

Why it fails: Implementing a callback verification process combined with manager approval for password reset requests is an excellent control against social engineering, as it introduces an out-of-band verification and an authorization layer. This significantly reduces the likelihood of an attacker successfully gaining logical access through manipulation. However, this solution exclusively addresses logical security vulnerabilities and provides no defense against physical security threats, such as an unauthorized individual physically tailgating into the building during a busy period.

Phishing

Why it fails: Phishing is a broad social engineering technique primarily characterized by attempting to acquire sensitive information (like usernames, passwords, and credit card details) by masquerading as a trustworthy entity in an electronic communication. While it can encompass various digital channels, its most common and defining vector is email, often involving malicious links or attachments. The scenario describes a phone call, which is not the primary or typical medium for phishing.

Vishing

Why it fails: Vishing, or voice phishing, specifically leverages telephone calls to trick individuals into divulging personal information or performing actions that compromise security. While it uses a phone call, similar to the scenario, the key distinction here is the method of deception. Vishing often relies on urgency or fear (e.g., "your bank account is compromised") to elicit immediate information, whereas the scenario implies a more elaborate, pre-planned fabricated story and identity, which is characteristic of pretexting.

Quid pro quo

Why it fails: Quid pro quo, meaning "something for something," is a social engineering tactic where an attacker offers a perceived benefit or service in exchange for information or access. This could involve offering IT support to "fix" a non-existent problem in exchange for login credentials, or providing a small gift for sensitive data. The scenario describes an attacker using impersonation and a fabricated story to trick the target, not offering a reciprocal exchange of value for information.

Pretexting

Why it fails: Pretexting is a social engineering technique where an attacker creates a fabricated scenario, or 'pretext,' to manipulate a target into divulging information or performing an action. This deception relies on building a believable false narrative, often involving impersonation or a sense of urgency, to gain trust. While it can be delivered via email, its defining characteristic is the elaborate story rather than the specific communication channel. The question's focus on an email *from* an organization points to the delivery of a specific type of attack, not the underlying fabrication method itself.

Vishing

Why it fails: Vishing, a portmanteau of 'voice' and 'phishing,' is a social engineering attack conducted over telephone calls or Voice over IP (VoIP) systems. Attackers use deceptive voice messages or live conversations to trick individuals into revealing personal information, financial details, or performing actions like installing malware. Since the question explicitly states the attack vector is an 'email,' vishing is immediately ruled out as its defining characteristic is the use of voice communication.

Spear phishing

Why it fails: Spear phishing is a sophisticated phishing attack that targets specific individuals or groups within an organization with personalized and relevant emails. Unlike general phishing, these emails are not mass-distributed but are tailored to the recipient, often containing specific details to increase their legitimacy and bypass standard security filters. While whaling is a *type* of spear phishing, the term 'whaling' specifically denotes attacks against high-value targets like senior executives, making it a more precise classification when the target's executive status is implied by the email's apparent origin or intent. The question's context suggests a high-level target, making whaling a more accurate fit.

Static analysis

Why it fails: Static analysis examines the malware's characteristics without actually executing its code. This process involves disassembling binaries, extracting strings, analyzing file headers, and reviewing embedded resources to infer potential functionality and identify indicators of compromise. While it provides valuable insights into the malware's structure and potential capabilities, it cannot reveal runtime-specific behaviors or evasion techniques that only manifest during execution.

Network analysis

Why it fails: Network analysis specifically focuses on monitoring and dissecting the network traffic generated by or directed towards the infected system. While essential for identifying command-and-control communications, data exfiltration attempts, or propagation activities, it primarily observes external network interactions. This method does not directly reveal internal system modifications, process injections, or local file system changes that occur within the host itself.

Code analysis

Why it fails: Code analysis is a specialized technique that involves meticulously examining the malware's source code or reverse-engineering its compiled binary to understand its underlying logic and algorithms. This process often includes disassembly, decompilation, and debugging to trace execution paths and identify malicious functions. Although fundamental for understanding *how* the malware operates, it is a component of static analysis and does not involve the live execution necessary to observe dynamic system interactions or runtime effects.

-sI

Why it fails: The -sI flag in Nmap initiates an Idle Scan, also known as a zombie scan. This advanced technique uses a "zombie" host's IP ID sequence to infer open ports on a target without sending packets directly from the scanner's IP address. It is a stealthy scanning method designed for anonymity and evading direct detection, not for manipulating packet sizes or fragmenting IP packets to bypass firewalls or IDPS.

-D

Why it fails: The -D flag enables decoy scanning, which involves sending scan packets from multiple spoofed IP addresses alongside the real scanner's IP. This technique aims to obscure the true source of the scan by making it difficult for intrusion detection systems (IDS) or firewalls to identify the actual attacker among a multitude of apparent sources. While it enhances stealth by distributing the apparent source, it does not involve breaking down packets into smaller fragments to bypass inspection.

--mtu

Why it fails: The --mtu option allows the user to specify a custom Maximum Transmission Unit (MTU) size for sent packets, which dictates the largest packet size that can be transmitted without fragmentation. While setting a smaller MTU can indirectly lead to fragmentation if the packet's total size exceeds this value, it primarily controls the maximum segment size. It doesn't explicitly instruct the scanning tool to fragment packets into multiple pieces for evasion purposes in the same deliberate manner as the dedicated fragmentation flag.

Choose Channel, Research, Craft Pretext, Execute, Document

Why it fails: Starting with "Choose Channel" is a critical misstep because the selection of the communication medium (e.g., email, phone, in-person) is a tactical decision that must be informed by prior intelligence gathering and the specific narrative developed. Without first researching the target to understand their habits and crafting a believable pretext, an attacker cannot effectively determine the most appropriate and convincing channel to deliver the social engineering attempt, significantly reducing its chances of success.

Execute, Research, Craft Pretext, Choose Channel, Document

Why it fails: Beginning a social engineering operation with "Execute" is fundamentally flawed and highly improbable to succeed. Effective social engineering relies on meticulous preparation, including thorough research to identify vulnerabilities and a carefully constructed pretext to manipulate the target. Attempting to execute an attack without this foundational intelligence and a credible story would be a haphazard and easily detectable endeavor, lacking the necessary psychological groundwork to bypass human defenses.

Research, Choose Channel, Craft Pretext, Execute, Document

Why it fails: While "Research" is the correct initial step, placing "Choose Channel" before "Craft Pretext" is an incorrect sequence. The pretext, which is the deceptive scenario designed to elicit a specific action, should logically precede channel selection. The nature of the pretext (e.g., urgency, formality, required interaction type) dictates the most effective communication channel. Selecting a channel prematurely risks choosing a medium that does not adequately support or enhance the credibility of the crafted narrative, thereby undermining the attack's psychological impact.

SQL Injection

Why it fails: SQL Injection exploits vulnerabilities in an application's database queries, allowing an attacker to insert or manipulate SQL commands. This typically affects the backend database server, enabling data exfiltration, modification, or even complete database compromise, rather than directly manipulating content displayed in the user's browser. The attack targets the data layer, not the client-side rendering.

Cross-Site Request Forgery (CSRF)

Why it fails: Cross-Site Request Forgery (CSRF) tricks a victim's browser into sending an authenticated request to a vulnerable web application, leveraging the victim's existing session. The attack does not involve injecting malicious scripts into the application's output; instead, it exploits trust in the user's browser to perform unauthorized actions on their behalf, such as changing passwords or transferring funds, without the user's explicit consent.

Command Injection

Why it fails: Command Injection vulnerabilities arise when an application executes user-supplied input as part of an operating system command without sufficient sanitization. This allows an attacker to inject arbitrary shell commands, which are then executed on the server hosting the web application. The impact is server-side command execution, not client-side manipulation of browser output or user interface elements.

John the Ripper

Why it fails: John the Ripper is a powerful, open-source password cracking tool renowned for its versatility across numerous hash types, including various Unix crypt formats, Kerberos AFS, and even Windows LM and NTLM hashes. While it possesses the capability to crack LM hashes through dictionary or brute-force attacks, it is a general-purpose cracker rather than one specifically engineered with pre-optimized tables or a primary focus solely on the unique weaknesses of the Windows LAN Manager protocol. Its strength lies in its broad applicability and configurable attack modes for a wide range of cryptographic challenges.

RainbowCrack

Why it fails: RainbowCrack is a tool that generates and uses rainbow tables, which are precomputed hash tables designed to significantly speed up the process of cracking password hashes by trading storage space for computation time. While rainbow tables can be highly effective for cracking LM hashes due to their inherent weaknesses, RainbowCrack itself is a generic rainbow table utility, not exclusively tailored to the Windows LAN Manager protocol. It can be applied to various hash types, making it a versatile tool for precomputation-based attacks rather than a specialized LM cracker.

Hashcat

Why it fails: Hashcat is an incredibly fast and widely used password recovery tool, often leveraging GPU acceleration to achieve high performance across a vast array of hash algorithms and attack types, including brute-force, dictionary, and mask attacks. Although Hashcat is fully capable of cracking Windows LM hashes efficiently, it is a comprehensive, multi-purpose cracking utility supporting hundreds of different hash modes. It is not 'specifically designed' for the Windows LAN Manager protocol in the sense of being pre-packaged with LM-specific tables or having its core architecture singularly focused on LM's unique structure, unlike Ophcrack.