midterm scenarios

A company's payroll server has an unpatched weakness. The likelihood of an attack is rated 4 and the impact is rated 5. Calculate the risk score. What should the company do?

Risk = likelihood × impact, so 4 × 5 = 20. The weakness is the missing security update, which an attacker could exploit. The company should install the patch to remove the weakness. This is a technical and preventive control. If patching must wait, it can restrict access to lower the risk temporarily.

Alice and Bob want to send private messages over a public network. They exchange calculated public values but never send their secret key. How can they end up with the same key, and what happens next?

They can use Diffie-Hellman key exchange. Each person keeps a private value and combines it with a public value received from the other person. The calculations give both sides the same shared secret without sending that secret over the network. They can use it to create an AES key that encrypts their messages.

An attacker intercepts Alice and Bob's key exchange and replaces the public values being sent. Why is this dangerous, and how can they protect against it?

This can become a man-in-the-middle attack. Basic Diffie-Hellman creates a shared secret, but it does not confirm who the other person is. The attacker could establish one secret with Alice and another with Bob, then intercept their messages. An authenticated key exchange, often supported by trusted certificates, helps prevent this.

Your browser connects to a bank's HTTPS website. The website sends a certificate and a public key. How does the browser decide whether it can trust the website?

The certificate connects the bank's website name to a public key. The browser checks the name, expiration date, and digital signatures. It follows the certificate chain through any intermediate certificate authority to a trusted root authority. This helps verify that the public key belongs to the website rather than to an impersonator.

You download a software installer. Its calculated SHA-256 value does not match the value posted on the software company's trusted website. What does this mean, and what should you do?

SHA-256 is a hash function that produces a fixed-length digest based on the file's contents. Different digests mean the files or reference values are not the same, so the download may be damaged or altered. Do not run it; obtain a fresh copy from a trusted source. A matching hash is useful only when the expected hash is trustworthy.

A manager signs a contract electronically, then claims someone changed it and denies signing it. How can the signature help? Does it keep the contract secret?

A digital signature is created with a private key and checked with the matching public key. A successful check helps show that the signed content was not changed and that the signature matches that key. This supports integrity, authenticity, and nonrepudiation, assuming the key is tied to the manager. Signing does not hide the contract; encryption is needed for confidentiality.

A hospital suffers three problems: attackers steal patient records, change some test results, and make the patient portal unavailable. Identify the security property affected by each problem.

Stealing records violates confidentiality because unauthorized people can read private information. Changing test results violates integrity because the data is no longer reliable. Taking the portal offline violates availability because authorized users cannot access it. A single attack can affect all three parts of the CIA triad.

Employees use badges to enter a data center, cameras record the doors, and everyone completes security training. Classify each control by its type and purpose.

The badge reader is a physical, preventive control because it restricts entry. The cameras are physical and detective because they record activity; visible cameras can also be deterrent. Training is administrative and can be directive because it explains required behavior. One control can have both a form and a purpose.

A company installs warning signs, intrusion alarms, and backups. Explain what each is meant to accomplish during a possible security incident.

Warning signs are deterrent controls: they discourage unwanted actions. Intrusion alarms are detective controls: they alert staff when something suspicious happens. Restoring information from backups is a recovery action: it brings data or services back after a disruption. These controls serve different purposes and complement one another.

A hospital has a medical device with a known weakness, but the vendor cannot provide a patch for two months. What should the hospital do in the meantime? Is the weakness gone?

The hospital can isolate the device, limit which systems may contact it, and monitor it closely. These steps reduce the chance or impact of an attack, so they are mitigation or compensating controls. They do not remove the actual weakness. The hospital should document the remaining risk, install the patch when available, and verify the fix.

An accounts-payable employee receives an email claiming to be from the CEO. It demands an immediate payment to a new bank account. What is happening, and what should the employee do?

This is a likely business email compromise attempt. The attacker uses impersonation and authority by pretending to be the CEO, plus urgency to pressure a quick payment. The employee should stop and verify the request through a trusted phone number or existing contact. The normal payment-approval process should still be followed.

A message advertises a giveaway: 'Only ten places left!' and 'Everyone on your team has already joined.' What two persuasion tactics are being used?

'Only ten places left' uses scarcity by making the opportunity seem limited. 'Everyone on your team has joined' uses social proof, also called consensus, by suggesting other people's actions prove it is safe. Both claims pressure the person to participate before checking whether the offer is genuine.

A caller helps an employee with a small issue, asks for an easy favor, and then requests approval of an unexpected login. Which persuasion tactics explain this approach?

The earlier help can create reciprocity: the employee may feel obligated to return the favor. Agreeing to the small request can create commitment and consistency: the next request feels like following through. Neither feeling makes the login safe. The employee should reject an unexpected approval and verify the request separately.

A company executive receives a personalized text message that links to a fake company login page. Give three ways this phishing attempt can be classified.

It is smishing because the attack comes by text message. It is spear phishing because the message is tailored to a particular person. It is also whaling because the target is a senior executive. These names describe the channel, targeting, and victim, so one attack can fit all three.

Three people access company systems: one tests with written permission, one tests without permission but reports flaws, and one steals customer data for profit. Classify all three.

The approved tester is white hat because the company authorized the work. The unauthorized researcher is gray hat because a helpful intention does not replace permission. The data thief is black hat because the access is unauthorized and malicious. Permission and intention are the main distinctions.

A breach report says a criminal group stole employee passwords using fake login emails. Identify the threat actor, attack vector, and target. What does a report like the DBIR help us understand?

The criminal group is the threat actor: who carried out the attack. The fake login emails are the attack vector: how they reached employees. The passwords are the immediate target, with company accounts at risk afterward. Verizon's Data Breach Investigations Report (DBIR) compares incidents to show common attacker types and methods.

A well-funded group secretly accesses defense research for months. Is it reasonable to suspect a long-term advanced attack or a government-backed actor? What can you actually prove?

The planning, long duration, and valuable target are consistent with an advanced persistent threat (APT). A nation-state is possible because defense research has strategic value. However, those clues do not prove a government was responsible. Attribution requires several reliable pieces of evidence, and conclusions may remain uncertain.

An attacker looks up employees, prepares a malicious document, emails it to a worker, and exploits a software flaw when the worker opens it. Name the first four attack stages in order.

Reconnaissance: researching the employees. Weaponization: preparing the malicious document. Delivery: sending it to the worker. Exploitation: using the software flaw when the document opens. Those are the first four stages of the Cyber Kill Chain.

When a website loads, the device sends signals, uses MAC addresses locally, routes packets with IP, carries data with TCP, and requests pages with HTTP. Match these to OSI layers.

Physical signals belong to Layer 1 (Physical). Local MAC frames belong to Layer 2 (Data Link). IP routing belongs to Layer 3 (Network). TCP belongs to Layer 4 (Transport). HTTP belongs to Layer 7 (Application). Layer 5 manages sessions and Layer 6 deals with data representation in the conceptual OSI model.

A laptop enters a website address, receives an IP address, and needs to send a frame across its local network. What two lookup systems help, and what does each find?

DNS (Domain Name System) looks up information linked to the website name, usually an IP address. ARP (Address Resolution Protocol) finds the MAC address for a local IPv4 destination. If the website is on another network, ARP normally finds the MAC address of the local gateway. DNS handles names; ARP helps deliver local frames.

A system administrator needs to log in to a remote server. One colleague suggests an old plaintext terminal protocol; another suggests an encrypted alternative. Which is safer, and why?

SSH (Secure Shell) is safer than Telnet. Both allow remote command-line access, but SSH protects credentials and commands using encryption and integrity checks. Traditional Telnet sends them without that protection, allowing someone monitoring the network to read the traffic.

A company needs four resources: one to organize cyber-risk outcomes, one to run an information-security management system, one for practical security safeguards, and one for governing IT. Match each need.

NIST CSF organizes cybersecurity outcomes using Govern, Identify, Protect, Detect, Respond, and Recover. ISO/IEC 27001 provides requirements for an information security management system (ISMS). CIS Controls lists prioritized safeguards to implement. COBIT focuses on governing and managing enterprise information and technology.

Two computers have the same highly rated software flaw: one is an internet-facing payroll server and the other is an isolated lab computer. Which should the company fix first? Explain why.

The payroll server should usually come first because attackers can reach it more easily and it supports important business operations. CVSS describes the flaw's technical severity, but that score is not the same as business risk. Exposure, known exploitation, sensitivity of the data, and potential damage all influence priority.

A security team updates vulnerable software and closes the work ticket, but never tests the server again. What important step did it skip, and why does it matter?

It skipped verification. The team should rescan the server or perform another check to confirm that the weakness is actually gone. A closed ticket only shows that someone recorded the task as complete; it does not prove the system is secure. This verification step closes the vulnerability-management cycle.

A caller chats with an employee about a shared interest, then claims to work for IT and asks the employee to open a remote-access link. What persuasion tactics are involved, and what is a safe response?

The friendly conversation uses liking to create trust through a personal connection. Claiming to work for IT uses authority to make the request seem legitimate. The employee should avoid opening the unexpected link and contact the real IT department using a trusted number or channel.

A company requires employees to lock their screens, fixes an unsafe server setting, and restores files after ransomware. What kind of control is each action?

The screen-lock rule is directive because it tells employees what they must do. Fixing the unsafe configuration is corrective because it addresses an identified problem; the new setting can also help prevent another incident. Restoring files from backups is recovery because it brings data back after a disruption.