Q1. A security analyst is tasked with reviewing network traffic logs for a critical web application. They notice a significant increase in traffic originating from a single IP address to the application's login page, with failed login attempts occurring at a rate of 50 per second. The application's logs indicate that these attempts are using common username and password combinations. What is the MOST likely attack vector being employed?
-
A brute-force attack against the login portal. ✓ Correct
-
A SQL injection attack targeting the authentication database.
-
A denial-of-service (DoS) attack flooding the web server.
-
An man-in-the-middle (MitM) attack intercepting credentials.
Why: The scenario describes an overwhelming number of login attempts from a single source using common credentials, which is the hallmark of a brute-force attack. A SQL injection attack would typically involve malformed SQL queries to manipulate the database, not repeated login attempts with valid-looking (but incorrect) credentials. A DoS attack aims to make the service unavailable by overwhelming it with traffic, which might happen as a byproduct, but the specific pattern points to credential guessing. A MitM attack involves intercepting communication to steal credentials, but the logs here show active attempts to *guess* credentials, not necessarily to intercept them passively.
Q2. A company's security team is investigating a series of suspicious outbound connections from several workstations that are not authorized to communicate with external services. Forensic analysis reveals that these workstations were recently infected with a new variant of malware. Which of the following security concepts is MOST directly demonstrated by this scenario?
-
Command and control (C2) communication. ✓ Correct
-
Data exfiltration.
-
Lateral movement.
-
Credential stuffing.
Why: The suspicious outbound connections from infected workstations are characteristic of malware attempting to contact a command and control server to receive instructions or send back information. Data exfiltration is the *purpose* of some C2 communication, but the observed network activity itself is the C2 communication. Lateral movement involves an attacker moving between systems *within* a network, not necessarily making outbound connections. Credential stuffing is an attack that uses stolen credentials from one breach to attempt logins on other sites, which doesn't fit the description of outbound malware connections.
Q3. An organization has implemented a strict access control policy for its sensitive financial data. Users are assigned roles with specific permissions, and access is granted only on a need-to-know basis. During a recent audit, it was discovered that several users who no longer require access to this data still retain it. Which security principle is being violated?
-
Least privilege. ✓ Correct
-
Defense in depth.
-
Separation of duties.
-
Auditing and accountability.
Why: The principle of least privilege dictates that users should only have the minimum permissions necessary to perform their job functions. Allowing users to retain access after they no longer need it directly violates this principle. Defense in depth is a layered security approach, which isn't the primary violation here. Separation of duties aims to prevent a single person from having too much control, which is related to access but not the core issue of excessive permissions. Auditing and accountability is about tracking who did what, which is a separate control that *would have caught* this but is not the principle being violated by the excess access itself.
Q4. A penetration tester is attempting to gain unauthorized access to a corporate network. They discover an unpatched server running an older version of a web application that is known to have a critical vulnerability. The tester exploits this vulnerability to gain initial access to the server. Which of the following security concepts does this scenario BEST represent?
-
Vulnerability management. ✓ Correct
-
Risk assessment.
-
Threat intelligence.
-
Incident response.
Why: The scenario highlights the exploitation of a known, unpatched vulnerability. Effective vulnerability management involves identifying, assessing, and remediating such weaknesses before they can be exploited. While risk assessment is involved in understanding the impact of vulnerabilities, and threat intelligence informs about potential exploits, the core failure demonstrated is the lack of active vulnerability management leading to the compromise. Incident response deals with the aftermath of a successful attack, not the proactive identification and remediation of the weakness itself.
Q5. A company's IT department is upgrading its network infrastructure. They are implementing a new security policy that requires all internal servers to communicate with each other only through designated firewall ports and protocols. Any traffic attempting to use non-standard ports or protocols will be blocked. Which security objective does this policy MOST directly aim to achieve?
-
Maintain the confidentiality of data.
-
Ensure the integrity of data.
-
Enhance network segmentation. ✓ Correct
-
Improve system availability.
Why: By restricting communication to specific ports and protocols, the organization is effectively segmenting its network. This limits the 'blast radius' of any potential compromise, preventing malware or attackers from easily moving between systems using unauthorized channels. While segmentation can indirectly support confidentiality, integrity, and availability by containing threats, the direct objective of controlling inter-server communication by port and protocol is network segmentation.
Q6. A developer is building a new web application that will handle user registration and login. To protect against common attacks that exploit weaknesses in how user input is processed, the developer decides to implement input validation on the server-side for all data submitted by users. Which of the following security benefits is MOST directly achieved by this action?
-
Prevention of cross-site scripting (XSS) attacks. ✓ Correct
-
Enforcement of multi-factor authentication (MFA).
-
Protection against denial-of-service (DoS) floods.
-
Implementation of strong password policies.
Why: Server-side input validation is a critical control for preventing attacks like XSS, where malicious scripts are injected into web pages viewed by other users. By sanitizing or rejecting input that contains script tags or other potentially harmful characters, the application can mitigate these threats. MFA and strong password policies are separate security controls related to authentication, and DoS flood protection typically involves network-level defenses or rate limiting, not solely server-side input validation.
Q7. A security administrator is reviewing firewall logs and notices repeated attempts from an external IP address to access internal systems on a non-standard port that is not used by any legitimate services. The firewall is configured to block all unsolicited inbound traffic. Which of the following is the MOST likely reason for these attempts?
-
A port scanning or reconnaissance activity. ✓ Correct
-
An attempt to exploit a zero-day vulnerability.
-
A distributed denial-of-service (DDoS) attack.
-
A sophisticated SQL injection attempt.
Why: The repeated attempts to access unusual ports from an external IP address, especially when the firewall is blocking unsolicited traffic, strongly indicate that the attacker is performing reconnaissance to discover open ports and potential vulnerabilities. While a zero-day exploit or SQL injection might follow such reconnaissance, the activity described itself is the scanning phase. A DDoS attack usually aims to overwhelm the system with traffic, not probe specific, non-standard ports in this manner.
Q8. A financial services firm is deploying new internal APIs. The security architect wants every request between microservices to be authenticated and authorized regardless of network location, with no implicit trust granted based on being 'inside' the corporate perimeter. Which security concept BEST guides this design?
-
Zero Trust with per-request policy enforcement ✓ Correct
-
Defense in depth using layered firewalls
-
Implicit deny at the network boundary
-
Segmentation via VLANs and subnetting
Why: Zero Trust is the concept that eliminates implicit trust and requires continuous authentication and authorization for each request regardless of location, which precisely matches the requirement. Defense in depth describes layering controls generally but does not specifically mandate per-request verification with no implicit internal trust. Implicit deny is a rule-set default, not an architectural model for authenticating every microservice request. VLAN segmentation limits blast radius but still relies on network-location trust, which is exactly what the firm wants to eliminate.
Q9. A hospital wants to allow researchers to analyze patient datasets without exposing real identities, but the data must remain reversible by an authorized custodian for follow-up care coordination. Which data protection technique BEST meets this requirement?
-
Tokenization ✓ Correct
-
Data masking
-
Hashing
-
Steganography
Why: Tokenization replaces sensitive values with surrogate tokens while a secure mapping allows an authorized custodian to reverse the process, satisfying both privacy and reversibility. Data masking typically produces obscured values that are not intended to be reversed, so it fails the care-coordination requirement. Hashing is a one-way function and cannot be reversed to recover the original identity. Steganography hides data within other media and provides no structured, reversible de-identification for analytics.
Q10. A company issuing signed firmware updates wants field devices to verify that an update genuinely came from the manufacturer and was not altered in transit, even if an attacker fully controls the delivery network. Which cryptographic concept provides this assurance?
-
Digital signatures using the vendor's private key ✓ Correct
-
Symmetric encryption with a shared session key
-
A message authentication code using a pre-shared key
-
Full-disk encryption on the device
Why: Digital signatures created with the vendor's private key and verified with the widely distributed public key provide both authenticity and integrity without sharing a secret, which is essential when the network is hostile. Symmetric encryption provides confidentiality but does not by itself prove origin, and distributing the shared key to all devices would let an attacker forge updates. A MAC with a pre-shared key requires every device to hold the secret, so compromise of one device could allow forged updates. Full-disk encryption protects data at rest on the device and does nothing to verify the source or integrity of an incoming update.