Q1. A multinational corporation's IT department is investigating a persistent, low-volume data exfiltration attempt targeting intellectual property stored on an on-premises file server. Network traffic analysis reveals that the data is being sent out in small, encrypted chunks over an unusual, non-standard port, but the destination IP addresses are ephemeral and appear to be part of a botnet. The malware responsible has evaded signature-based antivirus and intrusion detection systems. What is the MOST likely underlying vulnerability being exploited or the MOST effective immediate mitigation strategy?
-
Exploiting an unpatched vulnerability in the file server's operating system that allows remote code execution.
-
Implementing egress filtering on the firewall to block all outbound traffic except to authorized destinations and on approved ports. ✓ Correct
-
Leveraging weak authentication credentials on the file server, allowing an attacker to gain unauthorized access and install the malware.
-
Deploying an application-layer firewall to inspect outbound encrypted traffic for suspicious patterns or keywords.
Why: The scenario describes data exfiltration disguised with encryption and non-standard ports, evading traditional defenses. Egress filtering is the most effective immediate mitigation because it directly addresses the unauthorized outbound communication, regardless of the specific malware or exploited vulnerability. While an unpatched OS vulnerability or weak credentials (options A and C) could facilitate the initial compromise, they don't directly stop the exfiltration itself once the malware is active. An application-layer firewall (option D) is less effective here because the traffic is described as encrypted, making deep inspection difficult or impossible without additional, potentially performance-impacting, measures.
Q2. A security analyst is reviewing logs from a critical web application and notices a series of failed login attempts originating from a single IP address, followed by a successful login using a username that is not a recognized user account. Immediately after the successful login, several administrative functions are accessed. The web server's configuration shows that it is running outdated software with known vulnerabilities. Which of the following BEST describes the attack vector and the IMMEDIATE security action to take?
-
The attack vector is likely credential stuffing, and the immediate action is to reset all administrative passwords.
-
The attack vector is likely a SQL injection attack, and the immediate action is to update the web application's database queries.
-
The attack vector is likely an account enumeration and brute-force attack, and the immediate action is to block the source IP address. ✓ Correct
-
The attack vector is likely session hijacking, and the immediate action is to implement HTTPS for all traffic.
Why: The sequence of failed logins followed by a successful login with an unrecognized username strongly suggests an attacker first enumerated valid usernames and then attempted to brute-force or guess a password, potentially for a default or newly created administrative account. Blocking the source IP is the most immediate step to halt the ongoing attack. While updating the web application (addressing outdated software) is crucial for long-term security, it's not the immediate response to an active attack. Credential stuffing (option A) typically involves using lists of stolen credentials, and while possible, the unrecognized username points more towards enumeration and brute force. SQL injection (option B) and session hijacking (option D) have different log patterns and would require different immediate responses.
Q3. A company has recently suffered a ransomware attack that encrypted critical financial data. During the incident response, it was discovered that the initial infection vector was an employee clicking on a malicious link in a spear-phishing email. The company has backups, but restoring them would take significant time and could result in the loss of several days' worth of transactions. The attackers are demanding a ransom payment. Which of the following BEST represents a primary mitigation strategy against the vulnerability that allowed this incident to occur?
-
Implement robust endpoint detection and response (EDR) solutions with behavioral analysis capabilities.
-
Deploy a next-generation firewall with advanced threat protection and sandboxing features.
-
Conduct regular user awareness training focused on identifying and reporting phishing attempts. ✓ Correct
-
Enforce a strict principle of least privilege for all user accounts.
Why: The root cause of the infection, as described, was an employee clicking a malicious link in a spear-phishing email. Therefore, the most direct and effective mitigation strategy against this specific vulnerability is to train users to recognize and avoid such threats. While EDR (option A), next-gen firewalls (option B), and least privilege (option D) are all important security controls, they address different aspects of security and are not the primary defense against the human element exploited in phishing attacks.
Q4. A development team is building a new web application that will handle sensitive customer information. To minimize the risk of common web vulnerabilities, they are incorporating security best practices during the coding phase. They are particularly concerned about preventing attackers from injecting malicious scripts into the application's output that could be executed in a user's browser. Which of the following techniques is MOST effective for mitigating this specific threat?
-
Input validation to ensure that all user-submitted data conforms to expected formats.
-
Output encoding to convert potentially harmful characters into their safe, displayable equivalents. ✓ Correct
-
Implementing rate limiting on API endpoints to prevent brute-force attacks.
-
Using parameterized queries or prepared statements when interacting with the database.
Why: The question specifically asks for mitigation against injecting malicious scripts into the application's output that execute in the user's browser, which is the definition of Cross-Site Scripting (XSS). Output encoding is the primary defense mechanism for XSS, as it neutralizes malicious script characters before they are rendered by the browser. Input validation (option A) is important for preventing many attacks, including some forms of XSS and SQL injection, but it's not sufficient on its own for XSS. Rate limiting (option C) is for preventing brute-force and denial-of-service attacks, and parameterized queries (option D) are specifically for preventing SQL injection.
Q5. An organization's security team has detected an ongoing advanced persistent threat (APT) that appears to be using sophisticated techniques to maintain persistence on compromised systems. The attackers are regularly modifying system files, registry entries, and startup configurations to ensure their malware reactivates after reboots. What is the MOST effective defensive measure to detect and mitigate this type of persistence mechanism?
-
Implementing a file integrity monitoring (FIM) solution that alerts on unauthorized changes to critical system files and configurations. ✓ Correct
-
Deploying an intrusion prevention system (IPS) with signatures specifically designed to detect known APT tools.
-
Configuring strong password policies and enforcing multi-factor authentication (MFA) for all user access.
-
Regularly patching all operating systems and applications to the latest versions.
Why: The APT is maintaining persistence by modifying system files, registry entries, and startup configurations. File Integrity Monitoring (FIM) is specifically designed to detect unauthorized changes to critical system files and configurations, making it the most effective measure for identifying such persistence techniques. While an IPS (option B) might catch some known tools, it won't catch novel or modified persistence methods. Strong passwords and MFA (option C) are crucial for preventing initial access and privilege escalation but do not directly detect or mitigate ongoing persistence mechanisms. Regular patching (option D) is vital for closing vulnerabilities but doesn't address changes made after a system has already been compromised.
Q6. A company's IT infrastructure includes several legacy systems that cannot be updated with modern security patches due to compatibility requirements. These systems are connected to the internal network and house critical operational data. The security team is concerned about potential vulnerabilities in these legacy systems being exploited to gain a foothold for broader network compromise. What is the MOST appropriate security control to implement to protect these legacy systems?
-
Place the legacy systems in a secured, isolated network segment (VLAN) and restrict traffic flow using firewall rules. ✓ Correct
-
Deploy host-based intrusion detection systems (HIDS) on each legacy system to monitor for suspicious activity.
-
Implement full disk encryption on all legacy systems to protect data at rest.
-
Conduct frequent vulnerability scans specifically tailored for the known exploits targeting these legacy systems.
Why: Isolating legacy systems in a separate network segment (VLAN) with strict firewall rules is the most effective way to mitigate the risk posed by unpatchable vulnerabilities. This segmentation limits the potential blast radius if a legacy system is compromised, preventing attackers from easily moving laterally to other parts of the network. Host-based IDS (option B) can help detect an attack but doesn't prevent it from spreading once initiated on the legacy system. Full disk encryption (option C) protects data at rest but does not prevent unauthorized access or compromise of the system itself. Frequent vulnerability scanning (option D) is important for awareness but does not provide a containment or prevention mechanism for systems that cannot be patched.
Q7. A cybersecurity team is investigating a series of suspicious network connections originating from within their corporate network, targeting an external command-and-control (C2) server. Analysis reveals that the malware responsible for these connections is using DNS tunneling to exfiltrate small amounts of data disguised as legitimate DNS queries. The internal systems appear to be infected. What is the MOST effective strategy to prevent or detect this type of data exfiltration?
-
Implement DNS security solutions that analyze DNS traffic for anomalies, malicious domains, and unusually large query sizes or frequencies. ✓ Correct
-
Deploy application whitelisting on all endpoints to allow only approved executables to run.
-
Conduct regular security awareness training for employees regarding safe internet browsing habits.
-
Configure a Web Application Firewall (WAF) to inspect all HTTP and HTTPS traffic for malicious payloads.
Why: DNS tunneling disguises data exfiltration within DNS queries. Therefore, the most effective strategy is to use DNS security solutions that are specifically designed to detect such anomalies, including malicious domains and unusual query patterns or sizes. Application whitelisting (option B) could help prevent the initial malware infection but is less effective at detecting data exfiltration by already compromised systems using legitimate-looking DNS traffic. Employee training (option C) is a general defense against malware but may not prevent sophisticated DNS tunneling. A WAF (option D) inspects web traffic and is not directly effective against DNS tunneling.
Q8. A small business is concerned about the security of its customer database, which contains personally identifiable information (PII). The database is hosted on a single server in their office and is directly accessible from the internet via a web application. The business owner wants to implement a control that provides the MOST significant protection against unauthorized access and potential data breaches, considering their limited resources. Which of the following controls should they prioritize?
-
Implementing robust access control lists (ACLs) on the server's network interface and the database itself, granting access only to necessary IP addresses and user accounts. ✓ Correct
-
Deploying a commercial antivirus solution with real-time scanning capabilities on the database server.
-
Encrypting the entire database server's hard drive using full disk encryption.
-
Regularly backing up the database to an offsite location.
Why: Given that the database is directly accessible from the internet via a web application and the concern is unauthorized access, implementing robust access controls (ACLs) at both the network and database levels is the most critical and foundational step. This directly limits who and what can attempt to access the sensitive PII. While antivirus (option B) is important, it's a reactive measure and may not catch all threats, especially those targeting specific application vulnerabilities. Full disk encryption (option C) protects data if the physical drive is stolen but doesn't prevent remote compromise. Regular backups (option D) are essential for recovery but do not prevent a breach from occurring in the first place.
Q9. A healthcare organization is experiencing a significant increase in ransomware attacks targeting its electronic health record (EHR) system. The attackers are using sophisticated phishing techniques to gain initial access, followed by lateral movement to encrypt critical patient data. The organization has robust backups, but the recovery process is time-consuming and disruptive to patient care. Which of the following mitigation strategies would BEST prevent the initial infection vector and limit the potential blast radius of future attacks?
-
Implement an intrusion detection system (IDS) with updated signatures to detect known ransomware behaviors.
-
Mandate multi-factor authentication (MFA) for all employee logins and deploy advanced endpoint detection and response (EDR) solutions. ✓ Correct
-
Regularly perform full system backups and encrypt all sensitive data at rest within the EHR system.
-
Deploy a web application firewall (WAF) in front of the EHR system to block suspicious HTTP requests.
Why: The correct answer is Mandate multi-factor authentication (MFA) for all employee logins and deploy advanced endpoint detection and response (EDR) solutions. MFA significantly reduces the success rate of credential-based attacks, including phishing, which is the initial vector mentioned. EDR solutions are designed to detect and respond to advanced threats like ransomware at the endpoint level, limiting lateral movement and potential encryption. The IDS, while useful, is reactive and relies on known signatures, which may not catch novel ransomware variants. Full backups and encryption at rest are crucial for recovery and confidentiality but do not prevent the initial infection or lateral spread. A WAF protects web applications, but the primary attack vector described is phishing, not direct web exploitation of the EHR interface.
Q10. A cloud-based SaaS provider is experiencing intermittent service disruptions and has identified that unauthorized applications are consuming excessive network bandwidth and CPU resources, impacting legitimate users. These rogue applications appear to be deployed by developers without proper security vetting or resource provisioning policies. What is the MOST effective control to implement to prevent this issue from recurring?
-
Implement strict egress filtering on the cloud network to block all traffic to unknown external destinations.
-
Deploy container security monitoring tools to identify and isolate anomalous application behavior.
-
Enforce a stringent application deployment pipeline with automated security checks, resource quotas, and approval workflows. ✓ Correct
-
Increase the overall resource allocation for all applications to accommodate unexpected spikes in usage.
Why: The correct answer is Enforce a stringent application deployment pipeline with automated security checks, resource quotas, and approval workflows. This approach addresses the root cause by controlling *how* applications are deployed, ensuring they are vetted, have appropriate security configurations, and are provisioned with defined resource limits, thereby preventing rogue applications from consuming excessive resources. Strict egress filtering might block legitimate application functions and is not the primary control for resource exhaustion by internal deployments. Container security monitoring is helpful for detecting issues *after* deployment but doesn't prevent the initial unauthorized deployment or resource hogging. Increasing resource allocation is a costly and unsustainable workaround that does not address the underlying problem of unmanaged application deployments.