Scenario practice questions

A security analyst notices that an internal web server is receiving a large number of HTTP requests with unusually long and complex query strings, causing the server's CPU usage to spike. The requests appear to be targeting a search function. Which type of network incident is most likely occurring?

Trap 1: SQL injection

SQL injection involves inserting malicious SQL statements into input fields to manipulate a database. While it can cause server load, the scenario specifically mentions complex query strings targeting a search function and CPU spikes, which are more indicative of a denial-of-service attack. SQL injection typically aims to extract or modify data, not exhaust CPU.

Trap 2: Cross-site scripting (XSS)

XSS attacks inject malicious scripts into web pages viewed by other users. They do not typically cause a CPU spike on the server due to complex query strings. XSS targets the client's browser, not the server's processing resources. The scenario describes server-side resource exhaustion, which is not characteristic of XSS.

Trap 3: Directory traversal

Directory traversal aims to access files outside the web root by manipulating file paths. It does not typically cause a CPU spike through complex query strings. The attack is about unauthorized file access, not resource exhaustion. The scenario's symptoms point to a volumetric attack, not a file inclusion vulnerability.

A
SQL injection
Why it fails: SQL injection involves inserting malicious SQL statements into input fields to manipulate a database. While it can cause server load, the scenario specifically mentions complex query strings targeting a search function and CPU spikes, which are more indicative of a denial-of-service attack. SQL injection typically aims to extract or modify data, not exhaust CPU.
B
Cross-site scripting (XSS)
Why it fails: XSS attacks inject malicious scripts into web pages viewed by other users. They do not typically cause a CPU spike on the server due to complex query strings. XSS targets the client's browser, not the server's processing resources. The scenario describes server-side resource exhaustion, which is not characteristic of XSS.
C
Directory traversal
Why it fails: Directory traversal aims to access files outside the web root by manipulating file paths. It does not typically cause a CPU spike through complex query strings. The attack is about unauthorized file access, not resource exhaustion. The scenario's symptoms point to a volumetric attack, not a file inclusion vulnerability.
D
HTTP flood
An HTTP flood is a type of denial-of-service attack where the attacker sends many HTTP requests to overwhelm the server. The requests often target resource-intensive functions like search, with complex query strings to maximize CPU usage. The observed CPU spike and high volume of requests to a search function are classic signs of an HTTP flood.

Question 2mediummultiple choice

A first responder arrives at a workstation where an employee is suspected of exfiltrating data via a USB device. The machine is powered on with a screensaver active. The responder must capture the current physical memory contents for later analysis. Which action should the responder take first?

Trap 1: Perform a hard shutdown by holding the power button, then remove…

A hard shutdown immediately destroys physical memory contents, including running processes, network connections, and encryption keys. Once power is lost, volatile evidence is unrecoverable, making this option counterproductive for memory capture. It is only appropriate when the system poses an imminent physical danger or when live acquisition is impossible.

Trap 2: Document the screen contents with a photograph, then reboot into a…

Rebooting the system destroys all volatile memory, so any subsequent capture would be useless. Photographing the screen is a documentation step but does not preserve RAM. Booting into another OS also alters the system state and may overwrite evidence. This sequence fails to achieve the primary objective of capturing physical memory.

Trap 3: Press Ctrl+Alt+Delete to unlock the session, then run a memory…

Unlocking the session and introducing a USB tool changes the system state, potentially overwriting volatile memory and altering evidence. This approach risks contaminating the very memory contents you need to preserve, and the act of running external tools may trigger anti-forensic routines or destabilize the system.

A
Perform a hard shutdown by holding the power button, then remove the drive for forensic imaging.
Why it fails: A hard shutdown immediately destroys physical memory contents, including running processes, network connections, and encryption keys. Once power is lost, volatile evidence is unrecoverable, making this option counterproductive for memory capture. It is only appropriate when the system poses an imminent physical danger or when live acquisition is impossible.
B
Document the screen contents with a photograph, then reboot into a forensic Linux distribution to capture memory.
Why it fails: Rebooting the system destroys all volatile memory, so any subsequent capture would be useless. Photographing the screen is a documentation step but does not preserve RAM. Booting into another OS also alters the system state and may overwrite evidence. This sequence fails to achieve the primary objective of capturing physical memory.
C
Press Ctrl+Alt+Delete to unlock the session, then run a memory acquisition tool from a USB drive.
Why it fails: Unlocking the session and introducing a USB tool changes the system state, potentially overwriting volatile memory and altering evidence. This approach risks contaminating the very memory contents you need to preserve, and the act of running external tools may trigger anti-forensic routines or destabilize the system.
D
Use a validated hardware-based memory acquisition device that captures RAM without altering the running system.
Hardware acquisition tools interface directly with the memory bus or use DMA to read RAM without executing code on the host, preserving the integrity of volatile data. This minimizes changes to the system state while capturing the exact contents needed for analysis. It is the preferred method when live memory capture is required and the system must remain powered on.

Question 3mediummulti select

A financial institution's incident response team is investigating a suspected network intrusion. They observe anomalous traffic from an internal database server to an unknown external IP address. Which TWO of the following actions are appropriate for network-based containment in this scenario? (Choose two.)

Trap 1: Run a full malware scan on the database server.

Running a malware scan is not a containment action; it is a remediation step. It does not immediately stop the active network connection and could take a long time, during which data may continue to exfiltrate. Containment should focus on stopping the adversary's access first.

Trap 2: Disconnect the database server from the network immediately.

Disconnecting the server immediately would stop the traffic but could disrupt critical business operations and destroy volatile evidence. In a financial institution, database servers are often business-critical, so a more surgical containment is preferred. Additionally, abrupt disconnection may alert the attacker and prevent further observation.

Trap 3: Shut down the database service to prevent further data leakage.

Shutting down the database service would halt the exfiltration but also cause a denial of service for legitimate users and applications. It may also destroy volatile evidence in memory. This action is too disruptive and does not align with the principle of least disruption during containment.

A
Block the external IP address at the perimeter firewall.
Blocking the external IP at the perimeter firewall severs the connection to the suspected malicious endpoint, preventing further data exfiltration or command-and-control. This is a targeted containment measure that can be implemented quickly without disrupting the internal network. It also allows the responder to continue monitoring the internal server for other outbound connections.
B
Run a full malware scan on the database server.
Why it fails: Running a malware scan is not a containment action; it is a remediation step. It does not immediately stop the active network connection and could take a long time, during which data may continue to exfiltrate. Containment should focus on stopping the adversary's access first.
C
Disconnect the database server from the network immediately.
Why it fails: Disconnecting the server immediately would stop the traffic but could disrupt critical business operations and destroy volatile evidence. In a financial institution, database servers are often business-critical, so a more surgical containment is preferred. Additionally, abrupt disconnection may alert the attacker and prevent further observation.
D
Shut down the database service to prevent further data leakage.
Why it fails: Shutting down the database service would halt the exfiltration but also cause a denial of service for legitimate users and applications. It may also destroy volatile evidence in memory. This action is too disruptive and does not align with the principle of least disruption during containment.
E
Apply an access control list (ACL) on the internal router to block traffic from the database server to the external IP.
Applying an ACL on the internal router blocks the specific traffic while allowing other legitimate communications. This targeted containment preserves the server's ability to function for other connections and maintains evidence collection. It is a network-based containment that can be quickly implemented and reversed if needed.

Question 4hardmultiple choice

During a first response to a compromised server, you need to capture the contents of RAM. The server is a critical production system that cannot be taken offline. Which factor is most important to consider when selecting a memory acquisition tool for this scenario?

Trap 1: The tool must be able to acquire memory without any writes to the…

Avoiding disk writes is important for preserving evidence, but it is not the most critical factor when the system cannot be taken offline. Some memory acquisition tools may write a small amount to disk (e.g., for drivers), but that is often acceptable if it means avoiding a crash. The priority is to capture memory while keeping the system running. Thus, this is not the most important consideration.

Trap 2: The tool must be able to acquire memory from a remote location over…

Remote acquisition can be useful, but it introduces network overhead and potential instability. It is not a requirement for capturing memory on a local production server. The most important factor is that the tool does not cause a crash or require a reboot. Remote capability is a nice-to-have but not essential, especially if the responder has physical or console access.

Trap 3: The tool must be able to acquire memory at the fastest possible…

While speed is desirable, it is secondary to stability. A tool that acquires memory quickly but causes a system crash or performance degradation could disrupt critical services and lose evidence. In a production environment, the primary concern is not speed but ensuring the system remains operational. Therefore, this factor is less important than avoiding a crash.

A
The tool must be able to acquire memory without any writes to the target system's disk.
Why it fails: Avoiding disk writes is important for preserving evidence, but it is not the most critical factor when the system cannot be taken offline. Some memory acquisition tools may write a small amount to disk (e.g., for drivers), but that is often acceptable if it means avoiding a crash. The priority is to capture memory while keeping the system running. Thus, this is not the most important consideration.
B
The tool must be able to acquire memory from a remote location over the network.
Why it fails: Remote acquisition can be useful, but it introduces network overhead and potential instability. It is not a requirement for capturing memory on a local production server. The most important factor is that the tool does not cause a crash or require a reboot. Remote capability is a nice-to-have but not essential, especially if the responder has physical or console access.
C
The tool must be able to acquire memory at the fastest possible speed, regardless of system impact.
Why it fails: While speed is desirable, it is secondary to stability. A tool that acquires memory quickly but causes a system crash or performance degradation could disrupt critical services and lose evidence. In a production environment, the primary concern is not speed but ensuring the system remains operational. Therefore, this factor is less important than avoiding a crash.
D
The tool must be able to acquire memory without causing a system crash or requiring a reboot.
In a production environment where downtime is unacceptable, the memory acquisition tool must be stable and not cause a system crash. A crash would not only disrupt services but also destroy the volatile evidence. Tools that operate in kernel mode or use specialized drivers must be thoroughly tested to ensure they do not conflict with existing software. This factor is paramount to balance forensic needs with operational continuity.

Question 5hardmultiple choice

During a forensic investigation of a compromised Linux server, you need to collect volatile data from memory. The server is running critical services and cannot be taken offline. Which method is most appropriate for capturing memory while minimizing disruption?

Trap 1: Use the dd command to copy /dev/mem to an external drive.

Using dd on /dev/mem is unreliable on modern Linux systems because the kernel restricts access to physical memory for security reasons, and it may not capture all memory regions. It can also cause system instability or crashes. This method is outdated and not recommended for live memory acquisition on production servers.

Trap 2: Use the gcore command to dump the memory of all running processes,…

gcore dumps the memory of individual processes, not the entire system memory. It misses kernel memory, network buffers, and other critical volatile data. Combining process dumps does not produce a coherent memory image for forensic analysis. This method is insufficient for capturing the full state of the system.

Trap 3: Trigger a kernel panic to force a memory dump to the swap…

Triggering a kernel panic will crash the server, causing service downtime and potentially corrupting data. The resulting memory dump may not be complete or easily recoverable. This approach is highly disruptive and not suitable for a production server that must remain online. It also fails to follow proper evidence collection procedures.

A
Use the dd command to copy /dev/mem to an external drive.
Why it fails: Using dd on /dev/mem is unreliable on modern Linux systems because the kernel restricts access to physical memory for security reasons, and it may not capture all memory regions. It can also cause system instability or crashes. This method is outdated and not recommended for live memory acquisition on production servers.
B
Install and run a kernel module such as LiME (Linux Memory Extractor) to dump memory to a remote location or external storage.
LiME is a loadable kernel module designed for volatile memory acquisition on Linux. It allows capturing memory to a file or over the network without requiring a system reboot, minimizing disruption to running services. It is a widely accepted tool in incident response for live memory forensics, ensuring evidence integrity and minimal impact.
C
Use the gcore command to dump the memory of all running processes, then combine them into a single image.
Why it fails: gcore dumps the memory of individual processes, not the entire system memory. It misses kernel memory, network buffers, and other critical volatile data. Combining process dumps does not produce a coherent memory image for forensic analysis. This method is insufficient for capturing the full state of the system.
D
Trigger a kernel panic to force a memory dump to the swap partition, then recover it later.
Why it fails: Triggering a kernel panic will crash the server, causing service downtime and potentially corrupting data. The resulting memory dump may not be complete or easily recoverable. This approach is highly disruptive and not suitable for a production server that must remain online. It also fails to follow proper evidence collection procedures.

Question 6easymultiple choice

What is the primary function of a Web Application Firewall (WAF) in an incident response scenario?

Trap 1: Storing database backups

A WAF inspects HTTP traffic to detect and block application-layer attacks; backup storage is a data protection function provided by backup systems or database replication. It tempts because WAFs log requests for forensic review, and would be correct if the requirement were recovering data after destructive incidents.

Trap 2: Encrypting all web traffic

A WAF inspects and filters HTTP requests to block attacks like SQL injection and cross-site scripting; TLS termination or encryption is performed by load balancers or reverse proxies. It tempts because WAFs sit inline with HTTPS traffic, and would be correct if the requirement were confidentiality of data in transit.

Trap 3: Providing user authentication services

A WAF filters malicious HTTP payloads; authentication is handled by identity providers such as Microsoft Entra ID or application login modules. It tempts because WAFs process session cookies and login requests, and would be correct if the requirement were verifying user identity rather than blocking application-layer attacks.

A
Storing database backups
Why it fails: A WAF inspects HTTP traffic to detect and block application-layer attacks; backup storage is a data protection function provided by backup systems or database replication. It tempts because WAFs log requests for forensic review, and would be correct if the requirement were recovering data after destructive incidents.
B
Blocking known malicious patterns at the application layer
A WAF inspects HTTP traffic and blocks requests matching known attack signatures, such as SQL injection or cross-site scripting payloads, at the application layer. This containment capability limits exploitation during an incident, complementing network-layer controls.
C
Encrypting all web traffic
Why it fails: A WAF inspects and filters HTTP requests to block attacks like SQL injection and cross-site scripting; TLS termination or encryption is performed by load balancers or reverse proxies. It tempts because WAFs sit inline with HTTPS traffic, and would be correct if the requirement were confidentiality of data in transit.
D
Providing user authentication services
Why it fails: A WAF filters malicious HTTP payloads; authentication is handled by identity providers such as Microsoft Entra ID or application login modules. It tempts because WAFs process session cookies and login requests, and would be correct if the requirement were verifying user identity rather than blocking application-layer attacks.

Question 7mediummultiple choice

A security analyst is reviewing network traffic and observes a high volume of TCP SYN packets from various spoofed source IP addresses to a single destination server, with no corresponding SYN-ACK replies. The server's connection table is nearly full. Which type of network incident is most likely occurring?

Trap 1: UDP amplification attack

UDP amplification attacks rely on UDP protocols like DNS or NTP to send large responses to a spoofed victim. This scenario involves TCP SYN packets and a stateful connection table, not UDP. The absence of SYN-ACK replies and the exhaustion of the connection table point to a TCP-based SYN flood, making UDP amplification incorrect.

Trap 2: DNS tunneling

DNS tunneling involves encoding data within DNS queries and responses to exfiltrate information or communicate with a command-and-control server. It does not cause a high volume of TCP SYN packets or fill a server's connection table. The observed traffic pattern is characteristic of a denial-of-service attack, not DNS tunneling.

Trap 3: Smurf attack

A Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed source IP, causing many hosts to reply to the victim. This scenario involves TCP SYN packets, not ICMP, and does not involve broadcast amplification. The connection table exhaustion is specific to TCP state, so Smurf is not the correct answer.

A
UDP amplification attack
Why it fails: UDP amplification attacks rely on UDP protocols like DNS or NTP to send large responses to a spoofed victim. This scenario involves TCP SYN packets and a stateful connection table, not UDP. The absence of SYN-ACK replies and the exhaustion of the connection table point to a TCP-based SYN flood, making UDP amplification incorrect.
B
DNS tunneling
Why it fails: DNS tunneling involves encoding data within DNS queries and responses to exfiltrate information or communicate with a command-and-control server. It does not cause a high volume of TCP SYN packets or fill a server's connection table. The observed traffic pattern is characteristic of a denial-of-service attack, not DNS tunneling.
C
TCP SYN flood
A TCP SYN flood sends numerous SYN packets with spoofed source addresses to a target, causing the server to allocate resources for half-open connections. The server's connection table fills up, preventing legitimate connections. The observed high volume of SYNs without SYN-ACK replies and the full connection table are classic indicators of a SYN flood.
D
Smurf attack
Why it fails: A Smurf attack uses ICMP echo requests sent to a broadcast address with a spoofed source IP, causing many hosts to reply to the victim. This scenario involves TCP SYN packets, not ICMP, and does not involve broadcast amplification. The connection table exhaustion is specific to TCP state, so Smurf is not the correct answer.

Question 8mediummultiple choice

During a network incident, you observe a compromised host repeatedly connecting to an external IP on TCP port 443. The traffic is encrypted, but the connection duration is unusually short and the bytes transferred are small and consistent. Which of the following is the MOST likely explanation for this traffic pattern?

Trap 1: The host is downloading a large file over HTTPS.

Downloading a large file over HTTPS would typically result in a longer connection duration and a larger volume of bytes transferred. The scenario describes short, consistent connections with small data transfers, which is inconsistent with bulk download activity. This pattern is more indicative of beaconing or command-and-control communication rather than legitimate file transfer.

Trap 2: The host is performing a vulnerability scan against the external IP.

A vulnerability scan would typically involve multiple connection attempts to various ports and services, often with varying packet sizes and responses. The described pattern of consistent, short connections to a single port is not typical of scanning activity. Scanning usually generates a larger volume of traffic and may trigger intrusion detection systems.

Trap 3: The host is using a peer-to-peer file sharing application.

Peer-to-peer file sharing often involves connections to multiple peers, variable data transfer rates, and longer session durations. The consistent, short connections to a single external IP on port 443 do not match the typical behavior of P2P applications, which tend to have more diverse traffic patterns and larger data volumes.

A
The host is downloading a large file over HTTPS.
Why it fails: Downloading a large file over HTTPS would typically result in a longer connection duration and a larger volume of bytes transferred. The scenario describes short, consistent connections with small data transfers, which is inconsistent with bulk download activity. This pattern is more indicative of beaconing or command-and-control communication rather than legitimate file transfer.
B
The host is performing a vulnerability scan against the external IP.
Why it fails: A vulnerability scan would typically involve multiple connection attempts to various ports and services, often with varying packet sizes and responses. The described pattern of consistent, short connections to a single port is not typical of scanning activity. Scanning usually generates a larger volume of traffic and may trigger intrusion detection systems.
C
The host is using a peer-to-peer file sharing application.
Why it fails: Peer-to-peer file sharing often involves connections to multiple peers, variable data transfer rates, and longer session durations. The consistent, short connections to a single external IP on port 443 do not match the typical behavior of P2P applications, which tend to have more diverse traffic patterns and larger data volumes.
D
The host is communicating with a command-and-control server using HTTPS beaconing.
Short, periodic connections to an external IP on TCP port 443 with small, consistent data transfers are characteristic of beaconing behavior. Malware often uses HTTPS to blend in with normal traffic, and the regular intervals and small payloads are designed to check for commands without attracting attention. This pattern strongly suggests command-and-control communication.

Question 9mediummultiple choice

During a live incident, an analyst needs to capture volatile data from a compromised Windows server before containment. The server has 32 GB of RAM and is still running. Which action should the analyst perform FIRST to preserve the most volatile evidence?

Trap 1: Document the system's serial number and asset tag for…

Documenting asset identifiers is important for chain of custody and evidence management, but it is not a data acquisition step and does not preserve volatile artifacts. Performing this first delays memory capture, during which running processes and network connections may change or disappear, reducing the evidentiary value of the live system.

Trap 2: Disconnect the server from the network to prevent further spread.

Network isolation is a containment action, not an evidence preservation step. Pulling the network cable can terminate active connections and destroy volatile network state before it is captured. Containment decisions should follow, not precede, the collection of the most perishable evidence from the still-running system.

Trap 3: Create a forensic image of the system drive using FTK Imager.

Imaging the system drive is a disk-level acquisition that captures non-volatile data, but it does not preserve volatile artifacts such as running processes, network connections, or RAM contents. Because the server remains powered on, volatile evidence will be lost over time or upon shutdown, so this action should follow, not precede, volatile data collection.

A
Capture the contents of RAM using a memory acquisition tool such as WinPmem.
RAM is the most volatile evidence and is lost when the system is powered off or rebooted. Capturing memory first preserves running processes, network connections, encryption keys, and injected code that may never be written to disk. This aligns with the order of volatility and ensures critical incident artifacts are not destroyed before other collection steps.
B
Document the system's serial number and asset tag for chain-of-custody records.
Why it fails: Documenting asset identifiers is important for chain of custody and evidence management, but it is not a data acquisition step and does not preserve volatile artifacts. Performing this first delays memory capture, during which running processes and network connections may change or disappear, reducing the evidentiary value of the live system.
C
Disconnect the server from the network to prevent further spread.
Why it fails: Network isolation is a containment action, not an evidence preservation step. Pulling the network cable can terminate active connections and destroy volatile network state before it is captured. Containment decisions should follow, not precede, the collection of the most perishable evidence from the still-running system.
D
Create a forensic image of the system drive using FTK Imager.
Why it fails: Imaging the system drive is a disk-level acquisition that captures non-volatile data, but it does not preserve volatile artifacts such as running processes, network connections, or RAM contents. Because the server remains powered on, volatile evidence will be lost over time or upon shutdown, so this action should follow, not precede, volatile data collection.

Question 10easymultiple choice

A network administrator notices a sudden spike in ICMP echo requests from an internal host to an external IP address. The payload size of these ICMP packets is consistently larger than normal ping requests. Which of the following is the MOST likely cause of this activity?

Trap 1: The host is experiencing a denial-of-service attack from the…

A denial-of-service attack would typically involve a high volume of incoming traffic to the host, not outbound ICMP requests from the host. The scenario describes outbound traffic from an internal host to an external IP, which is not consistent with a DoS attack targeting the internal host. DoS attacks aim to overwhelm a target, often with incoming packets.

Trap 2: The host is using a legitimate application that relies on ICMP for…

Legitimate applications rarely use ICMP for keep-alive messages; they typically use TCP or UDP. While some tools like ping may be used for connectivity checks, they do not send consistently large payloads to a single external IP. The described pattern of oversized ICMP packets is more characteristic of tunneling than normal application behavior.

Trap 3: The host is performing a network performance test using ping.

Network performance tests using ping typically send standard-sized ICMP packets and may vary in size, but they do not consistently send oversized packets to a single external IP. The scenario describes a sudden spike and consistently large payloads, which is more indicative of malicious activity rather than routine testing. Performance tests are usually short-lived and not characterized by large, consistent payloads.

A
The host is experiencing a denial-of-service attack from the external IP.
Why it fails: A denial-of-service attack would typically involve a high volume of incoming traffic to the host, not outbound ICMP requests from the host. The scenario describes outbound traffic from an internal host to an external IP, which is not consistent with a DoS attack targeting the internal host. DoS attacks aim to overwhelm a target, often with incoming packets.
B
The host is using a legitimate application that relies on ICMP for keep-alive messages.
Why it fails: Legitimate applications rarely use ICMP for keep-alive messages; they typically use TCP or UDP. While some tools like ping may be used for connectivity checks, they do not send consistently large payloads to a single external IP. The described pattern of oversized ICMP packets is more characteristic of tunneling than normal application behavior.
C
The host is infected with malware using ICMP tunneling for data exfiltration.
ICMP tunneling involves encapsulating data within ICMP echo requests and replies, often using oversized payloads to carry stolen data. A sudden spike in ICMP traffic with consistently large payloads to an external IP is a strong indicator of this technique. Attackers use ICMP tunneling to bypass firewalls that allow ping, making it a stealthy exfiltration method.
D
The host is performing a network performance test using ping.
Why it fails: Network performance tests using ping typically send standard-sized ICMP packets and may vary in size, but they do not consistently send oversized packets to a single external IP. The scenario describes a sudden spike and consistently large payloads, which is more indicative of malicious activity rather than routine testing. Performance tests are usually short-lived and not characterized by large, consistent payloads.

Question 11mediummultiple choice

An incident handler is reviewing a suspicious email reported by a finance employee. The message appears to come from a known vendor, requests an urgent wire transfer, and contains a PDF attachment. The handler wants to determine whether the sender's domain was authorized to send on behalf of the vendor. Which email authentication result should the handler check FIRST to make this determination?

Trap 1: The DKIM signature result for the vendor's domain

DKIM verifies that the message content was not altered in transit and that the signing domain authorized the signature, but it does not directly state whether the visible From domain authorized the sending server to send on its behalf. A valid DKIM signature from a third-party mailer can still pass while the From domain is spoofed, so checking DKIM first does not answer the authorization question posed in this scenario.

Trap 2: The Received-SPF header added by the recipient gateway

The Received-SPF header records the SPF evaluation performed by the receiving gateway, but it only reflects the envelope-from domain and the connecting IP. It does not evaluate alignment with the visible From domain, so it cannot confirm that the vendor's displayed domain authorized the sender. Relying on this header alone could mislead the handler about the true sender authorization.

Trap 3: The SPF authentication result for the vendor's domain

SPF checks whether the sending server's IP is listed in the SPF record of the domain in the envelope-from, not necessarily the visible From domain. Because the envelope-from can differ from the header From, an SPF pass or fail alone does not confirm that the vendor's visible domain authorized the message. This makes SPF less direct than DMARC for the specific question asked.

A
The DKIM signature result for the vendor's domain
Why it fails: DKIM verifies that the message content was not altered in transit and that the signing domain authorized the signature, but it does not directly state whether the visible From domain authorized the sending server to send on its behalf. A valid DKIM signature from a third-party mailer can still pass while the From domain is spoofed, so checking DKIM first does not answer the authorization question posed in this scenario.
B
The DMARC alignment result for the vendor's domain
DMARC combines SPF and DKIM results and applies alignment against the visible From domain. A DMARC pass means either SPF or DKIM aligned with the domain in the From header, which directly answers whether the vendor's domain authorized the message. Checking the DMARC result first therefore gives the handler the most reliable indication of sender authorization in this wire-transfer scenario.
C
The Received-SPF header added by the recipient gateway
Why it fails: The Received-SPF header records the SPF evaluation performed by the receiving gateway, but it only reflects the envelope-from domain and the connecting IP. It does not evaluate alignment with the visible From domain, so it cannot confirm that the vendor's displayed domain authorized the sender. Relying on this header alone could mislead the handler about the true sender authorization.
D
The SPF authentication result for the vendor's domain
Why it fails: SPF checks whether the sending server's IP is listed in the SPF record of the domain in the envelope-from, not necessarily the visible From domain. Because the envelope-from can differ from the header From, an SPF pass or fail alone does not confirm that the vendor's visible domain authorized the message. This makes SPF less direct than DMARC for the specific question asked.

Question 12easymultiple choice

A web application is experiencing a denial-of-service attack characterized by a flood of HTTP requests from a large number of distributed IP addresses. Which type of attack is this most likely to be?

Trap 1: SQL Injection

SQL injection involves injecting malicious SQL queries to manipulate a database, not flooding with HTTP requests. The scenario describes a volumetric attack from many IPs, which is unrelated to SQL injection. SQL injection typically targets data integrity, not availability.

Trap 2: Cross-Site Scripting (XSS)

XSS attacks inject malicious scripts into web pages viewed by other users. They do not cause a flood of requests from distributed IPs. The scenario is about overwhelming the server with traffic, which is not the goal of XSS. XSS targets users, not server availability.

Trap 3: Cross-Site Request Forgery (CSRF)

CSRF tricks authenticated users into performing unintended actions. It does not involve a flood of requests from many IPs. The scenario describes a volumetric attack, which is characteristic of DDoS, not CSRF. CSRF exploits trust, not bandwidth.

A
SQL Injection
Why it fails: SQL injection involves injecting malicious SQL queries to manipulate a database, not flooding with HTTP requests. The scenario describes a volumetric attack from many IPs, which is unrelated to SQL injection. SQL injection typically targets data integrity, not availability.
B
Cross-Site Scripting (XSS)
Why it fails: XSS attacks inject malicious scripts into web pages viewed by other users. They do not cause a flood of requests from distributed IPs. The scenario is about overwhelming the server with traffic, which is not the goal of XSS. XSS targets users, not server availability.
C
Cross-Site Request Forgery (CSRF)
Why it fails: CSRF tricks authenticated users into performing unintended actions. It does not involve a flood of requests from many IPs. The scenario describes a volumetric attack, which is characteristic of DDoS, not CSRF. CSRF exploits trust, not bandwidth.
D
Distributed Denial-of-Service (DDoS)
A DDoS attack uses multiple compromised systems to flood a target with traffic, overwhelming its resources. The scenario describes requests from many distributed IP addresses, which is the hallmark of a DDoS attack. This makes it difficult to mitigate by blocking a single source.

Question 13easymultiple choice

A helpdesk technician receives a call from an employee who says they opened an email attachment that appeared to be an invoice, and now their computer is showing a message demanding payment to unlock files. The employee's documents are encrypted and have a new file extension. The technician escalates to the incident response team. Which classification BEST describes this incident?

Trap 1: Phishing incident

Phishing describes the initial delivery mechanism, not the resulting impact. While the attachment arrived via email and may have been a phishing lure, the active incident now involves file encryption and extortion. Treating it only as phishing would understate the severity and could cause the team to miss containment steps needed for ransomware, such as isolating the endpoint and checking for lateral movement.

Trap 2: Insider threat incident

Insider threat involves authorized users misusing access, not external malware encrypting files after an email attachment is opened. There is no indication that an employee intentionally caused the encryption. Misclassifying the event as insider threat would waste resources on user investigations and delay the technical response needed to contain ransomware and recover data.

Trap 3: Business email compromise

Business email compromise involves impersonation to trick users into transferring funds or data, typically without malware encrypting files. In this scenario, the user's documents are encrypted and a payment demand is displayed, which indicates ransomware rather than a social-engineering fraud scheme. Classifying it as business email compromise would misdirect the response away from containment and recovery of encrypted data.

A
Phishing incident
Why it fails: Phishing describes the initial delivery mechanism, not the resulting impact. While the attachment arrived via email and may have been a phishing lure, the active incident now involves file encryption and extortion. Treating it only as phishing would understate the severity and could cause the team to miss containment steps needed for ransomware, such as isolating the endpoint and checking for lateral movement.
B
Insider threat incident
Why it fails: Insider threat involves authorized users misusing access, not external malware encrypting files after an email attachment is opened. There is no indication that an employee intentionally caused the encryption. Misclassifying the event as insider threat would waste resources on user investigations and delay the technical response needed to contain ransomware and recover data.
C
Ransomware incident
The encryption of files, the new file extension, and the payment demand are hallmark indicators of ransomware. The initial vector was an email attachment, but the resulting incident type is ransomware because the impact is data encryption and extortion. This classification drives the appropriate response actions, including isolation, containment, and recovery from backups.
D
Business email compromise
Why it fails: Business email compromise involves impersonation to trick users into transferring funds or data, typically without malware encrypting files. In this scenario, the user's documents are encrypted and a payment demand is displayed, which indicates ransomware rather than a social-engineering fraud scheme. Classifying it as business email compromise would misdirect the response away from containment and recovery of encrypted data.