Q1. A cybersecurity analyst is investigating a series of security alerts indicating suspicious outbound network traffic originating from several workstations. The traffic appears to be communicating with known command-and-control (C2) servers. The analyst suspects a botnet infection. What is the MOST appropriate FIRST step to take to mitigate the immediate threat?
-
Reconfigure firewall rules to block all outbound traffic to the identified C2 servers.
-
Immediately isolate the affected workstations from the rest of the network. ✓ Correct
-
Deploy endpoint detection and response (EDR) agents to all workstations to scan for malware.
-
Notify the incident response team and begin forensic analysis of the infected workstations.
Why: The most critical initial step in a suspected botnet infection is to contain the spread. Isolating the affected workstations prevents them from communicating with the C2 servers and potentially infecting other systems on the network. While reconfiguring firewall rules can help, it might not be immediate enough, and the malware could adapt. Deploying EDR is a good remediation step, but isolation must come first to stop the bleeding. Forensic analysis is important but should follow containment.
Q2. A company is experiencing a surge in phishing attempts targeting its employees, leading to several successful credential compromises. The Chief Information Security Officer (CISO) wants to implement a technical control to reduce the likelihood of these compromised credentials being used for further unauthorized access. Which of the following controls would BEST achieve this objective?
-
Implement a Web Application Firewall (WAF) to filter malicious web content.
-
Enforce multi-factor authentication (MFA) for all user accounts. ✓ Correct
-
Deploy an Intrusion Detection System (IDS) to monitor network traffic.
-
Conduct regular security awareness training for all employees.
Why: Multi-factor authentication (MFA) is the most effective technical control for mitigating the risk of compromised credentials. Even if an attacker obtains a user's password through phishing, they would still need a second factor (e.g., a code from an authenticator app or a hardware token) to gain access. A WAF protects web applications, an IDS detects network intrusions, and security awareness training is crucial but preventative, not a direct mitigation for already compromised credentials being used.
Q3. A penetration testing team has successfully gained initial access to a client's internal network. They discover a legacy application running on an unpatched server that contains sensitive customer data. The application has known vulnerabilities that allow for remote code execution. What is the MOST likely next step the penetration testers will attempt to take?
-
Perform a denial-of-service (DoS) attack against the application server to disrupt its operations.
-
Leverage the remote code execution vulnerability to gain elevated privileges on the server. ✓ Correct
-
Initiate a phishing campaign targeting users with access to the application.
-
Scan the network for other vulnerable systems that can be used as pivot points.
Why: The penetration testers have identified a direct path to compromise the server by exploiting a known remote code execution vulnerability. The most logical next step is to use this exploit to gain higher privileges on the server, allowing them to access the sensitive data. A DoS attack is destructive and typically not a goal of a penetration test unless specifically requested. While phishing could be used to gain more access, it's not the immediate path presented by the RCE vulnerability. Pivoting is a possibility, but escalating privileges on the current compromised system is a more direct and likely immediate goal.
Q4. A company's IT department is responsible for maintaining a secure environment for customer data. During a routine audit, it's discovered that sensitive customer information is being stored in plain text on a database server, accessible via an internal network. The organization wants to implement a control to protect this data confidentiality, even if the database server itself is compromised. What is the BEST technical solution?
-
Implement full disk encryption on the database server.
-
Configure strong access control lists (ACLs) for the database files.
-
Apply encryption at rest to the sensitive data fields within the database. ✓ Correct
-
Implement a firewall to restrict network access to the database server.
Why: Encrypting the sensitive data fields at rest within the database provides the strongest confidentiality protection. Even if an attacker gains access to the database files or the server itself, the data will remain unreadable without the decryption key. Full disk encryption protects the entire drive but might not prevent access if the operating system is compromised and the disk is mounted. Strong ACLs are important for access control but don't protect data if an authorized user's credentials are compromised or if the system itself is breached. A firewall restricts network access but doesn't protect the data if an attacker bypasses it or gains access through an authorized internal source.
Q5. A remote workforce has significantly increased the attack surface for an organization. Employees are accessing company resources from various locations and potentially insecure networks. The CISO wants to ensure that all remote access is encrypted and authenticated securely to prevent eavesdropping and unauthorized access. Which technology is MOST suitable for this requirement?
-
Secure Shell (SSH) for remote administration.
-
Transport Layer Security (TLS) for web traffic.
-
Virtual Private Network (VPN) for network access. ✓ Correct
-
Secure Multipurpose Internet Mail Extensions (S/MIME) for email.
Why: A Virtual Private Network (VPN) creates an encrypted tunnel over public networks, allowing remote users to securely connect to the organization's internal network as if they were physically present. This inherently encrypts all traffic and provides strong authentication mechanisms. SSH is primarily for secure remote command-line administration of servers. TLS secures individual web sessions but doesn't provide broad network access. S/MIME is used for securing email content and is not relevant for general remote network access.
Q6. A security team is investigating a potential data breach. They suspect that an attacker gained access to the network and has been exfiltrating sensitive files. The logs show large amounts of outbound data transfer from a specific server to an unknown external IP address over an unusual port. What is the MOST likely method the attacker is using for exfiltration?
-
DNS tunneling ✓ Correct
-
SQL injection
-
Cross-site scripting (XSS)
-
Man-in-the-middle (MitM) attack
Why: DNS tunneling is a technique where attackers encapsulate data within DNS queries and responses, allowing them to exfiltrate data over port 53, which is often less scrutinized than other ports. The unusual port and large outbound transfer are indicative of this method. SQL injection and XSS are web application attacks used to manipulate data or inject scripts, not typically for bulk data exfiltration. A MitM attack involves intercepting communications but doesn't directly explain large outbound transfers to an unknown IP over an unusual port.
Q7. A security analyst is reviewing logs from a web application firewall (WAF) and notices a significant increase in requests containing encoded JavaScript strings within URL parameters. These requests are being blocked by the WAF, but the volume suggests an automated tool is being used. What is the MOST likely type of attack the WAF is successfully mitigating?
-
SQL Injection (SQLi)
-
Cross-Site Scripting (XSS) ✓ Correct
-
XML External Entity (XXE) injection
-
Directory Traversal
Why: Encoded JavaScript strings within URL parameters are a hallmark of Cross-Site Scripting (XSS) attacks, where attackers attempt to inject malicious scripts into web pages viewed by other users. While SQL injection also involves injecting malicious input, it typically targets database queries rather than injecting scripts into the browser. XXE and Directory Traversal attacks have distinct payload patterns and are not characterized by encoded JavaScript in URL parameters.
Q8. During a penetration test, a security team discovers a legacy application that is vulnerable to remote code execution (RCE). The application is running on a server that also hosts critical business data. The team needs to ensure the application is isolated to prevent potential compromise of the entire server. Which of the following actions would BEST achieve this isolation while allowing continued operation of the vulnerable application?
-
Immediately disabling the vulnerable application service.
-
Implementing network segmentation with strict firewall rules. ✓ Correct
-
Upgrading the application to the latest secure version.
-
Applying host-based intrusion prevention (HIPS) signatures.
Why: Implementing network segmentation using firewall rules is the most effective method to isolate a vulnerable application running on a shared server. This limits the attack surface by restricting network access to only what is absolutely necessary, preventing attackers from easily moving laterally or accessing other services and data on the server. Disabling the service would stop operations, upgrading might not be feasible for legacy apps, and HIPS, while useful, is a defense-in-depth measure and might not fully contain an RCE exploit as effectively as network isolation.
Q9. A cybersecurity team is investigating a security incident where several user accounts were found to have been created with administrative privileges without proper authorization. Log analysis reveals that these accounts were created shortly after a series of failed login attempts against an unrelated, public-facing service. What is the MOST likely attack chain that occurred?
-
Password spraying followed by privilege escalation.
-
Credential stuffing leading to account enumeration and subsequent privilege abuse. ✓ Correct
-
Malware infection leading to local privilege escalation.
-
Phishing attack resulting in compromised credentials and lateral movement.
Why: The scenario describes failed logins on one system followed by unauthorized admin account creation, suggesting attackers used harvested credentials (from a breach elsewhere) to log into a system (credential stuffing), then enumerated for accounts and created new privileged ones. Password spraying uses one password against many accounts, which doesn't fit the description of failed logins against an 'unrelated' public service. Malware or phishing could lead to similar outcomes, but the sequence of failed logins on a separate service followed by admin account creation most strongly points to credential stuffing as the initial vector.
Q10. A company is experiencing a series of targeted attacks aimed at disrupting their online services. The attackers are using sophisticated techniques to bypass signature-based intrusion detection systems. The security team decides to implement a proactive defense strategy that focuses on detecting anomalous behavior rather than known malicious patterns. Which of the following security controls would be MOST effective in supporting this strategy?
-
Network Intrusion Detection System (NIDS) with up-to-date signatures.
-
Security Information and Event Management (SIEM) system with User and Entity Behavior Analytics (UEBA). ✓ Correct
-
Web Application Firewall (WAF) configured for common web attacks.
-
File Integrity Monitoring (FIM) for critical system files.
Why: User and Entity Behavior Analytics (UEBA), typically integrated into a SIEM, is designed to detect anomalous activities by establishing baseline behaviors for users and entities and then flagging deviations, which is precisely what's needed to counter sophisticated attacks bypassing signature-based detection. A standard NIDS relies on known signatures and would likely fail here. A WAF is effective against known web attack types but not necessarily novel or behavioral anomalies. FIM detects changes to files but not necessarily the behavior leading to those changes.