CECS 378 midpoop 2 electric boogaloo

DoS: Which option best defines denial of service? A. A connection awaiting the client's final ACK after the server sent SYN-ACK.; B. An attack that makes a system or service unavailable to legitimate users.; C. An attack that saturates the network path or link with traffic.; D. It leaves many connections half-open, filling the server's bounded SYN backlog.

Correct answer: B. An attack that makes a system or service unavailable to legitimate users.

DoS: Which CIA property does DoS target? A. Forging the source IP address in packets.; B. Availability.; C. Response bytes divided by request bytes.; D. Overprovisioning, CDNs, and traffic scrubbing.

Correct answer: B. Availability.

DoS: What finite resource classes can a DoS exhaust? A. Bandwidth; system state/CPU/memory; application resources; and connectivity to the…; B. A Layer 7 attack that consumes server-side work or connections using requests that may…; C. Dropping all traffic to a targeted IP as a last resort, making that address unreachable.; D. It leaves many connections half-open, filling the server's bounded SYN backlog.

Correct answer: A. Bandwidth; system state/CPU/memory; application resources; and connectivity to the network.

DoS: What is a volumetric DoS? A. A connection awaiting the client's final ACK after the server sent SYN-ACK.; B. UDP has no handshake to validate the source address.; C. An attack that makes a system or service unavailable to legitimate users.; D. An attack that saturates the network path or link with traffic.

Correct answer: D. An attack that saturates the network path or link with traffic.

DoS: What is source-address spoofing? A. Overprovisioning, CDNs, and traffic scrubbing.; B. Response bytes divided by request bytes.; C. An attack that saturates the network path or link with traffic.; D. Forging the source IP address in packets.

Correct answer: D. Forging the source IP address in packets.

DoS: How does a TCP SYN flood consume resources? A. An attack that saturates the network path or link with traffic.; B. An attack that makes a system or service unavailable to legitimate users.; C. It leaves many connections half-open, filling the server's bounded SYN backlog.; D. Dropping all traffic to a targeted IP as a last resort, making that address unreachable.

Correct answer: C. It leaves many connections half-open, filling the server's bounded SYN backlog.

DoS: What is a half-open TCP connection? A. A connection awaiting the client's final ACK after the server sent SYN-ACK.; B. An attack that makes a system or service unavailable to legitimate users.; C. Dropping all traffic to a targeted IP as a last resort, making that address unreachable.; D. An attack that saturates the network path or link with traffic.

Correct answer: A. A connection awaiting the client's final ACK after the server sent SYN-ACK.

DoS: What is a SYN cookie? A. A Layer 7 attack that consumes server-side work or connections using requests that may…; B. The attacker forges the victim's address in requests to third-party services; their…; C. A technique that encodes pending connection state in the SYN-ACK sequence number and…; D. Ingress filtering rejects packets with source IPs that should not originate from the…

Correct answer: C. A technique that encodes pending connection state in the SYN-ACK sequence number and delays state allocation.

DoS: How does reflection work? A. A technique that encodes pending connection state in the SYN-ACK sequence number and…; B. Ingress filtering rejects packets with source IPs that should not originate from the…; C. The attacker forges the victim's address in requests to third-party services; their…; D. It keeps many server connections occupied by sending request headers slowly, using…

Correct answer: C. The attacker forges the victim's address in requests to third-party services; their replies go to the victim.

DoS: Define amplification factor. A. Overprovisioning, CDNs, and traffic scrubbing.; B. UDP has no handshake to validate the source address.; C. Response bytes divided by request bytes.; D. Forging the source IP address in packets.

Correct answer: C. Response bytes divided by request bytes.

DoS: Why are UDP services used for reflection? A. Overprovisioning, CDNs, and traffic scrubbing.; B. Response bytes divided by request bytes.; C. UDP has no handshake to validate the source address.; D. An attack that saturates the network path or link with traffic.

Correct answer: C. UDP has no handshake to validate the source address.

DoS: What does BCP 38 do? A. A technique that encodes pending connection state in the SYN-ACK sequence number and…; B. The attacker forges the victim's address in requests to third-party services; their…; C. A Layer 7 attack that consumes server-side work or connections using requests that may…; D. Ingress filtering rejects packets with source IPs that should not originate from the…

Correct answer: D. Ingress filtering rejects packets with source IPs that should not originate from the sending network.

DoS: What is an application-layer DoS? A. A Layer 7 attack that consumes server-side work or connections using requests that may…; B. Ingress filtering rejects packets with source IPs that should not originate from the…; C. A technique that encodes pending connection state in the SYN-ACK sequence number and…; D. Dropping all traffic to a targeted IP as a last resort, making that address unreachable.

Correct answer: A. A Layer 7 attack that consumes server-side work or connections using requests that may look legitimate.

DoS: How does Slowloris exhaust service? A. It keeps many server connections occupied by sending request headers slowly, using…; B. The attacker forges the victim's address in requests to third-party services; their…; C. Dropping all traffic to a targeted IP as a last resort, making that address unreachable.; D. A technique that encodes pending connection state in the SYN-ACK sequence number and…

Correct answer: A. It keeps many server connections occupied by sending request headers slowly, using little bandwidth.

DoS: Name core volumetric defenses. A. Response bytes divided by request bytes.; B. Overprovisioning, CDNs, and traffic scrubbing.; C. Forging the source IP address in packets.; D. UDP has no handshake to validate the source address.

Correct answer: B. Overprovisioning, CDNs, and traffic scrubbing.

DoS: What is blackholing in DoS response? A. Dropping all traffic to a targeted IP as a last resort, making that address unreachable.; B. Bandwidth; system state/CPU/memory; application resources; and connectivity to the…; C. It leaves many connections half-open, filling the server's bounded SYN backlog.; D. It keeps many server connections occupied by sending request headers slowly, using…

Correct answer: A. Dropping all traffic to a targeted IP as a last resort, making that address unreachable.

Malware: What are malware's two classification axes? A. It blocks access to data, commonly through encryption, to demand payment.; B. Propagation mechanism (how it spreads) and payload action (what it does).; C. A hidden way to regain access while bypassing normal authentication.; D. System corruption, attack agent, information theft, and stealthing.

Correct answer: B. Propagation mechanism (how it spreads) and payload action (what it does).

Malware: What is a virus? A. It operates beneath ordinary user-mode tools and can filter their view of system state.; B. Propagation mechanism (how it spreads) and payload action (what it does).; C. It avoids trusting a possibly compromised installed OS or its rootkit-filtered view.; D. Malware that attaches to a host file/program and generally needs the host to run.

Correct answer: D. Malware that attaches to a host file/program and generally needs the host to run.

Malware: What is a worm? A. It blocks access to data, commonly through encryption, to demand payment.; B. An isolated, instrumented environment used to observe suspicious file behavior.; C. Self-propagating malware that spreads without a host program or user action.; D. A wrapper that hides or compresses a payload and unpacks it at runtime.

Correct answer: C. Self-propagating malware that spreads without a host program or user action.

Malware: What is a trojan horse? A. Stealing data before encryption and threatening to disclose it as well as demanding…; B. Malware disguised as legitimate software that relies on a user to run/install it and…; C. Ransomware-as-a-Service: developers provide tools/infrastructure to affiliates, often…; D. Signatures match known patterns; behavior detection looks at runtime actions or anomalies.

Correct answer: B. Malware disguised as legitimate software that relies on a user to run/install it and does not self-replicate.

Malware: What are the four virus life-cycle phases? A. System corruption, attack agent, information theft, and stealthing.; B. Dormant, propagation, triggering, execution.; C. Malware that rewrites its code body between variants.; D. Guessing devices' default credentials.

Correct answer: B. Dormant, propagation, triggering, execution.

Malware: What is a malware payload? A. System corruption, attack agent, information theft, and stealthing.; B. The action malware performs after execution.; C. A hidden way to regain access while bypassing normal authentication.; D. Guessing devices' default credentials.

Correct answer: B. The action malware performs after execution.

Malware: Name four malware payload categories. A. It blocks access to data, commonly through encryption, to demand payment.; B. System corruption, attack agent, information theft, and stealthing.; C. A hidden way to regain access while bypassing normal authentication.; D. An isolated, instrumented environment used to observe suspicious file behavior.

Correct answer: B. System corruption, attack agent, information theft, and stealthing.

Malware: What is an APT? A. An isolated, instrumented environment used to observe suspicious file behavior.; B. Propagation mechanism (how it spreads) and payload action (what it does).; C. It blocks access to data, commonly through encryption, to demand payment.; D. An advanced persistent threat actor or campaign; it is not a malware family.

Correct answer: D. An advanced persistent threat actor or campaign; it is not a malware family.

Malware: What is a rootkit? A. An isolated, instrumented environment used to observe suspicious file behavior.; B. Software that hides malware or activity by manipulating what the system reports.; C. Propagation mechanism (how it spreads) and payload action (what it does).; D. It operates beneath ordinary user-mode tools and can filter their view of system state.

Correct answer: B. Software that hides malware or activity by manipulating what the system reports.

Malware: Why is a kernel-mode rootkit hard to detect? A. Stealing data before encryption and threatening to disclose it as well as demanding…; B. A destructive disk wiper disguised with a ransom note; it had no practical recovery path.; C. It operates beneath ordinary user-mode tools and can filter their view of system state.; D. Signatures match known patterns; behavior detection looks at runtime actions or anomalies.

Correct answer: C. It operates beneath ordinary user-mode tools and can filter their view of system state.

Malware: What is a backdoor? A. A wrapper that hides or compresses a payload and unpacks it at runtime.; B. System corruption, attack agent, information theft, and stealthing.; C. A hidden way to regain access while bypassing normal authentication.; D. Malware that mutates its appearance, often with a changing decryptor.

Correct answer: C. A hidden way to regain access while bypassing normal authentication.

Malware: What does ransomware do? A. Propagation mechanism (how it spreads) and payload action (what it does).; B. Self-propagating malware that spreads without a host program or user action.; C. It blocks access to data, commonly through encryption, to demand payment.; D. A wrapper that hides or compresses a payload and unpacks it at runtime.

Correct answer: C. It blocks access to data, commonly through encryption, to demand payment.

Malware: What is double extortion? A. A destructive disk wiper disguised with a ransom note; it had no practical recovery path.; B. It operates beneath ordinary user-mode tools and can filter their view of system state.; C. Signatures match known patterns; behavior detection looks at runtime actions or anomalies.; D. Stealing data before encryption and threatening to disclose it as well as demanding…

Correct answer: D. Stealing data before encryption and threatening to disclose it as well as demanding payment.

Malware: What is RaaS? A. Malware disguised as legitimate software that relies on a user to run/install it and…; B. Stealing data before encryption and threatening to disclose it as well as demanding…; C. Ransomware-as-a-Service: developers provide tools/infrastructure to affiliates, often…; D. Signatures match known patterns; behavior detection looks at runtime actions or anomalies.

Correct answer: C. Ransomware-as-a-Service: developers provide tools/infrastructure to affiliates, often for a share of proceeds.

Malware: How do signature and behavior detection differ? A. Stealing data before encryption and threatening to disclose it as well as demanding…; B. Signatures match known patterns; behavior detection looks at runtime actions or anomalies.; C. A destructive disk wiper disguised with a ransom note; it had no practical recovery path.; D. It operates beneath ordinary user-mode tools and can filter their view of system state.

Correct answer: B. Signatures match known patterns; behavior detection looks at runtime actions or anomalies.

Malware: What is a sandbox? A. Software that hides malware or activity by manipulating what the system reports.; B. An advanced persistent threat actor or campaign; it is not a malware family.; C. Self-propagating malware that spreads without a host program or user action.; D. An isolated, instrumented environment used to observe suspicious file behavior.

Correct answer: D. An isolated, instrumented environment used to observe suspicious file behavior.

Malware: What is polymorphic malware? A. System corruption, attack agent, information theft, and stealthing.; B. A hidden way to regain access while bypassing normal authentication.; C. Malware that mutates its appearance, often with a changing decryptor.; D. A wrapper that hides or compresses a payload and unpacks it at runtime.

Correct answer: C. Malware that mutates its appearance, often with a changing decryptor.

Malware: What is metamorphic malware? A. Malware that rewrites its code body between variants.; B. Dormant, propagation, triggering, execution.; C. System corruption, attack agent, information theft, and stealthing.; D. A hidden way to regain access while bypassing normal authentication.

Correct answer: A. Malware that rewrites its code body between variants.

Malware: What is a packer? A. Malware that mutates its appearance, often with a changing decryptor.; B. A wrapper that hides or compresses a payload and unpacks it at runtime.; C. A hidden way to regain access while bypassing normal authentication.; D. It blocks access to data, commonly through encryption, to demand payment.

Correct answer: B. A wrapper that hides or compresses a payload and unpacks it at runtime.

Malware: What was NotPetya's actual payload? A. Signatures match known patterns; behavior detection looks at runtime actions or anomalies.; B. Stealing data before encryption and threatening to disclose it as well as demanding…; C. A destructive disk wiper disguised with a ransom note; it had no practical recovery path.; D. It operates beneath ordinary user-mode tools and can filter their view of system state.

Correct answer: C. A destructive disk wiper disguised with a ransom note; it had no practical recovery path.

Malware: What was Mirai's recruitment vector? A. The action malware performs after execution.; B. Guessing devices' default credentials.; C. Dormant, propagation, triggering, execution.; D. Malware that rewrites its code body between variants.

Correct answer: B. Guessing devices' default credentials.

Malware: What does booting from known-clean media help with? A. Malware that attaches to a host file/program and generally needs the host to run.; B. An isolated, instrumented environment used to observe suspicious file behavior.; C. It avoids trusting a possibly compromised installed OS or its rootkit-filtered view.; D. Software that hides malware or activity by manipulating what the system reports.

Correct answer: C. It avoids trusting a possibly compromised installed OS or its rootkit-filtered view.

Social Engineering: What is social engineering? A. Manipulating people into actions or disclosures that undermine security.; B. It is targeted and contextualized for a particular person or organization.; C. Spearphishing directed at senior executives or other high-value targets.; D. Low-cost human pretext, modest technical foothold, outsized blast radius.

Correct answer: A. Manipulating people into actions or disclosures that undermine security.

Social Engineering: What are Cialdini's six principles? A. Authority, scarcity, social proof, liking, reciprocity, commitment/consistency.; B. Broad deceptive messaging designed to prompt an unsafe action or disclosure.; C. Repeated MFA approval prompts intended to pressure a person into approving one.; D. The study estimated a 45-98% success range depending on the experimental setting.

Correct answer: A. Authority, scarcity, social proof, liking, reciprocity, commitment/consistency.

Social Engineering: What is OSINT? A. Multiple redirects where each hop obscures the next destination.; B. Phishing through SMS or other text messaging.; C. The blast radius if an account or system is compromised.; D. Information collected from publicly available sources.

Correct answer: D. Information collected from publicly available sources.

Social Engineering: What is phishing? A. Broad deceptive messaging designed to prompt an unsafe action or disclosure.; B. It is targeted and contextualized for a particular person or organization.; C. A fabricated but plausible identity and scenario used to gain cooperation.; D. Authority, scarcity, social proof, liking, reciprocity, commitment/consistency.

Correct answer: A. Broad deceptive messaging designed to prompt an unsafe action or disclosure.

Social Engineering: How does spearphishing differ from phishing? A. It is targeted and contextualized for a particular person or organization.; B. A fabricated but plausible identity and scenario used to gain cooperation.; C. Manipulating people into actions or disclosures that undermine security.; D. Low-cost human pretext, modest technical foothold, outsized blast radius.

Correct answer: A. It is targeted and contextualized for a particular person or organization.

Social Engineering: What is whaling? A. It is targeted and contextualized for a particular person or organization.; B. Low-cost human pretext, modest technical foothold, outsized blast radius.; C. Manipulating people into actions or disclosures that undermine security.; D. Spearphishing directed at senior executives or other high-value targets.

Correct answer: D. Spearphishing directed at senior executives or other high-value targets.

Social Engineering: What is pretexting? A. A fabricated but plausible identity and scenario used to gain cooperation.; B. Phishing that uses a QR code to conceal or deliver a deceptive destination.; C. It is targeted and contextualized for a particular person or organization.; D. Low-cost human pretext, modest technical foothold, outsized blast radius.

Correct answer: A. A fabricated but plausible identity and scenario used to gain cooperation.

Social Engineering: What is vishing? A. Voice-based phishing or social engineering.; B. The blast radius if an account or system is compromised.; C. Multiple redirects where each hop obscures the next destination.; D. Information collected from publicly available sources.

Correct answer: A. Voice-based phishing or social engineering.

Social Engineering: What is smishing? A. Information collected from publicly available sources.; B. Multiple redirects where each hop obscures the next destination.; C. The blast radius if an account or system is compromised.; D. Phishing through SMS or other text messaging.

Correct answer: D. Phishing through SMS or other text messaging.

Social Engineering: What is BEC? A. The study estimated a 45-98% success range depending on the experimental setting.; B. Authority, scarcity, social proof, liking, reciprocity, commitment/consistency.; C. Fraud using impersonated or compromised business email to induce payment or disclosure.; D. It adds an independent check through a separate channel before a high-impact action.

Correct answer: C. Fraud using impersonated or compromised business email to induce payment or disclosure.

Social Engineering: What is quishing? A. A fabricated but plausible identity and scenario used to gain cooperation.; B. Low-cost human pretext, modest technical foothold, outsized blast radius.; C. Phishing that uses a QR code to conceal or deliver a deceptive destination.; D. It is targeted and contextualized for a particular person or organization.

Correct answer: C. Phishing that uses a QR code to conceal or deliver a deceptive destination.

Social Engineering: What is a redirect chain? A. The scale of harm or systems affected after an initial compromise.; B. Calling a known, separately verified number to confirm a request.; C. Multiple redirects where each hop obscures the next destination.; D. Manipulating people into actions or disclosures that undermine security.

Correct answer: C. Multiple redirects where each hop obscures the next destination.

Social Engineering: What is MFA fatigue? A. The study estimated a 45-98% success range depending on the experimental setting.; B. Authority, scarcity, social proof, liking, reciprocity, commitment/consistency.; C. Broad deceptive messaging designed to prompt an unsafe action or disclosure.; D. Repeated MFA approval prompts intended to pressure a person into approving one.

Correct answer: D. Repeated MFA approval prompts intended to pressure a person into approving one.

"Social Engineering: What does ""blast radius"" mean? A. Multiple redirects where each hop obscures the next destination.; B. Manipulating people into actions or disclosures that undermine security.; C. The scale of harm or systems affected after an initial compromise.; D. Calling a known, separately verified number to confirm a request."

Correct answer: C. The scale of harm or systems affected after an initial compromise.

Social Engineering: What human-element share did Verizon's 2026 DBIR report? A. Voice-based phishing or social engineering.; B. Information collected from publicly available sources.; C. Phishing through SMS or other text messaging.; D. About 62% of breaches.

Correct answer: D. About 62% of breaches.

Social Engineering: What did Tischer et al. find about found USB drives? A. It adds an independent check through a separate channel before a high-impact action.; B. The study estimated a 45-98% success range depending on the experimental setting.; C. Authority, scarcity, social proof, liking, reciprocity, commitment/consistency.; D. Repeated MFA approval prompts intended to pressure a person into approving one.

Correct answer: B. The study estimated a 45-98% success range depending on the experimental setting.

Social Engineering: What is the common anatomy of social-engineering incidents? A. Manipulating people into actions or disclosures that undermine security.; B. Low-cost human pretext, modest technical foothold, outsized blast radius.; C. It is targeted and contextualized for a particular person or organization.; D. Spearphishing directed at senior executives or other high-value targets.

Correct answer: B. Low-cost human pretext, modest technical foothold, outsized blast radius.

Social Engineering: What is an independent callback? A. Manipulating people into actions or disclosures that undermine security.; B. The scale of harm or systems affected after an initial compromise.; C. Calling a known, separately verified number to confirm a request.; D. Multiple redirects where each hop obscures the next destination.

Correct answer: C. Calling a known, separately verified number to confirm a request.

Social Engineering: Why use two-person out-of-band verification for a wire transfer? A. Authority, scarcity, social proof, liking, reciprocity, commitment/consistency.; B. Fraud using impersonated or compromised business email to induce payment or disclosure.; C. It adds an independent check through a separate channel before a high-impact action.; D. The study estimated a 45-98% success range depending on the experimental setting.

Correct answer: C. It adds an independent check through a separate channel before a high-impact action.

Social Engineering: What does least privilege limit? A. Multiple redirects where each hop obscures the next destination.; B. The blast radius if an account or system is compromised.; C. Calling a known, separately verified number to confirm a request.; D. Information collected from publicly available sources.

Correct answer: B. The blast radius if an account or system is compromised.

Exam Guide: Which subjects does Exam 2 cover? A. One optional 3 x 5 inch note card, handwritten; both sides may be used.; B. Malicious Software, Denial of Service Attacks, and Social Engineering.; C. The lecture notes; free primary sources cited in each section are linked in the Read lines.; D. The reasoning style expected on the exam, including classification, comparison, and explaining defenses.

Correct answer: B. Malicious Software, Denial of Service Attacks, and Social Engineering.

Exam Guide: What note-card aid is allowed? A. Malicious Software, Denial of Service Attacks, and Social Engineering.; B. The lecture notes; free primary sources cited in each section are linked in the Read lines.; C. The reasoning style expected on the exam, including classification, comparison, and explaining defenses.; D. One optional 3 x 5 inch note card, handwritten; both sides may be used.

Correct answer: D. One optional 3 x 5 inch note card, handwritten; both sides may be used.

Exam Guide: What is the primary reference for the exam readings? A. Malicious Software, Denial of Service Attacks, and Social Engineering.; B. One optional 3 x 5 inch note card, handwritten; both sides may be used.; C. The lecture notes; free primary sources cited in each section are linked in the Read lines.; D. The reasoning style expected on the exam, including classification, comparison, and explaining defenses.

Correct answer: C. The lecture notes; free primary sources cited in each section are linked in the Read lines.

Exam Guide: What kind of reasoning do the Check yourself questions model? A. The reasoning style expected on the exam, including classification, comparison, and explaining defenses.; B. Malicious Software, Denial of Service Attacks, and Social Engineering.; C. One optional 3 x 5 inch note card, handwritten; both sides may be used.; D. The lecture notes; free primary sources cited in each section are linked in the Read lines.

Correct answer: A. The reasoning style expected on the exam, including classification, comparison, and explaining defenses.

DoS Scenario: Several compromised cameras and routers receive commands from a few control machines, then send traffic at one service. Which roles describe this layout? A. Handlers relay commands; agents send the attack traffic.; B. Agents relay commands; handlers are the final victims.; C. Reflectors control the devices; the victim relays orders.; D. Every device is a separate command center.

Correct answer: A. Handlers relay commands; agents send the attack traffic. The handler/agent hierarchy distributes control and traffic across many real devices.

DoS Scenario: A response may be much larger than the request sent to a reflector. Which ordering best matches typical maximum amplification potential? A. DNS < NTP monlist < memcached.; B. Memcached < DNS < NTP monlist.; C. NTP monlist < memcached < DNS.; D. DNS < memcached < NTP monlist.

Correct answer: A. DNS < NTP monlist < memcached. Memcached can reach roughly 51,000x, well above NTP monlist and DNS.

DoS Scenario: An ISP wants to stop customers from sending packets with forged source IPs before they reach other networks. Which control fits? A. BCP 38 ingress filtering at the network edge.; B. SYN cookies on the ISP’s web servers.; C. A CDN in front of each customer website.; D. Blackholing all traffic to every customer.

Correct answer: A. BCP 38 ingress filtering at the network edge. BCP 38 filters packets whose source addresses should not originate from the sending network.

DoS Scenario: A provider hesitates to deploy source-address filtering because it is costly to configure and most benefits go to other networks. What explains the slow adoption? A. The deploying network gets little direct benefit, while other networks gain protection.; B. The filtering increases amplification for DNS and NTP.; C. It only works against HTTP floods, not spoofing.; D. It requires every destination server to install SYN cookies.

Correct answer: A. The deploying network gets little direct benefit, while other networks gain protection. BCP 38 creates a collective-action problem: the costs are local, while much of the benefit is external.

DoS Scenario: A website is hit by traffic that exceeds its upstream link capacity. Which response is most appropriate? A. Divert traffic to high-capacity scrubbing/CDN providers and overprovision capacity.; B. Use SYN cookies as the only mitigation.; C. Increase the web server’s TCP backlog only.; D. Block all UDP at the application server.

Correct answer: A. Divert traffic to high-capacity scrubbing/CDN providers and overprovision capacity. Volumetric traffic must be absorbed or filtered upstream of the saturated link.

DoS Scenario: A server is overwhelmed by incomplete TCP handshakes that consume pending-connection state. Which primary defense best matches the resource being exhausted? A. SYN cookies.; B. BCP 38 alone.; C. A web application cache.; D. Blackholing the entire data center.

Correct answer: A. SYN cookies. SYN cookies avoid reserving backlog state until the client returns a valid ACK.

DoS Scenario: A public DNS resolver is being abused to send large replies to spoofed victims. What should its operator do first? A. Disable open recursion or restrict it to intended clients, then apply rate limits and anti-spoofing controls.; B. Increase the size of replies to reduce packet count.; C. Advertise the resolver as an open recursive service.; D. Only block the victim addresses appearing in complaints.

Correct answer: A. Disable open recursion or restrict it to intended clients, then apply rate limits and anti-spoofing controls. Restricting recursion removes the resolver’s role as a public reflector; rate limiting and source validation add protection.

Malware Scenario: A poisoned tax-software update installs malware that then spreads via SMBv1 and shows a ransom note, but cannot restore files. How should it be classified? A. Trojan-like initial delivery, worm-like propagation, and a wiper payload.; B. A harmless macro virus with a working recovery key.; C. A worm delivery, trojan propagation, and a ransomware payload.; D. A rootkit with no propagation mechanism.

Correct answer: A. Trojan-like initial delivery, worm-like propagation, and a wiper payload. NotPetya combined supply-chain delivery, network self-spread, and destructive wiping; the ransom note was deceptive.

Malware Scenario: A malware outbreak moves between unpatched Windows systems through SMB without users opening an attachment. Which mechanism best explains the spread? A. A vulnerability exploit, specifically EternalBlue against SMBv1.; B. A macro virus that needs a document opened.; C. A trojan that requires each user to install it.; D. A boot-sector virus that spreads only through firmware updates.

Correct answer: A. A vulnerability exploit, specifically EternalBlue against SMBv1. WannaCry used EternalBlue to exploit vulnerable SMBv1 systems and spread rapidly.

Malware Scenario: A virus runs before a host program, then returns control so the program appears to work normally. What did it most likely alter? A. The host program’s entry point or startup path.; B. The network’s BCP 38 filter.; C. A DNS resolver’s recursion policy.; D. The user’s MFA recovery phone.

Correct answer: A. The host program’s entry point or startup path. A virus can patch a host entry point so its code executes first, then hand control back to preserve normal behavior.

Malware Scenario: An infected document spreads when users open it, while an infected executable spreads when that program is run. Which pair names these targets? A. Macro virus; file infector.; B. Boot-sector infector; worm.; C. Rootkit; logic bomb.; D. Packer; backdoor.

Correct answer: A. Macro virus; file infector. Document macros are a common macro-virus target; executable files are targets for file infectors.

Malware Scenario: A sample uses USB and network spread, stolen signing certificates, multiple zero-days, rootkits, and activates only on specific Siemens PLCs. What does the activation condition show? A. The payload is selectively triggered against a narrow industrial target.; B. The malware is only a mass-mailing macro virus.; C. The signature proves the file is benign.; D. The malware can run only when a victim approves an MFA prompt.

Correct answer: A. The payload is selectively triggered against a narrow industrial target. Stuxnet’s PLC-specific trigger limited sabotage to a narrowly defined industrial environment.

Malware Scenario: Analysts inspect a program’s source and find no backdoor, yet a compromised compiler inserts one whenever it builds the login program and reproduces itself into later compilers. Which lesson fits Thompson’s “Trusting Trust”? A. Auditing source alone may miss malicious behavior embedded in the compiler/toolchain.; B. A clean source tree guarantees the resulting binary is trustworthy.; C. Only network worms can survive recompilation.; D. The login program must be a macro virus.

Correct answer: A. Auditing source alone may miss malicious behavior embedded in the compiler/toolchain. Thompson’s example shows how a compiler can insert a backdoor and perpetuate it without leaving it in the reviewed source.

Malware Scenario: A researcher wants to classify a malicious tool by how it spreads, what weakness it uses, and what it does after execution. Which reading framework matches those three questions? A. PrEP: Propagation method, Exploit, Payload.; B. CIA: Confidentiality, Integrity, Availability.; C. DDoS: Handler, Agent, Reflector.; D. TCP: SYN, SYN-ACK, ACK.

Correct answer: A. PrEP: Propagation method, Exploit, Payload. Herr’s PrEP framework organizes analysis around propagation method, exploit, and payload.

Malware Scenario: A group initially builds a botnet to gain an advantage in Minecraft server competition, using insecure IoT devices. What broader security lesson does the reading illustrate? A. A narrow financial or gaming motive can scale into botnet capability that enables wider DDoS harm.; B. Botnets require users to open macro documents one at a time.; C. IoT devices cannot be recruited without zero-day exploits.; D. The group’s motive proves it caused every major Mirai attack.

Correct answer: A. A narrow financial or gaming motive can scale into botnet capability that enables wider DDoS harm. The WIRED account connects a Minecraft-related motive with Mirai’s use of insecure IoT devices; it cautions against equating motive with responsibility for every incident.

Malware Scenario: A file changes its byte pattern between variants, then rewrites its whole code body; a packed sample avoids analysis until runtime. Which defense strategy best addresses this arms race? A. Combine signatures with behavior monitoring and isolated sandbox analysis.; B. Rely only on a fixed byte signature.; C. Disable all logging to avoid false positives.; D. Treat every signed file as safe.

Correct answer: A. Combine signatures with behavior monitoring and isolated sandbox analysis. Layered detection covers known patterns, runtime behavior, and files that reveal their behavior only when executed in isolation.

Social Scenario: A finance employee joins a video call with people who appear to be executives and receives an urgent transfer request. Which control would best reduce the Arup-style deepfake risk? A. Verify the request through a known independent channel and require a second approver.; B. Trust the video appearance if several colleagues are visible.; C. Accept a new bank account when the caller sounds familiar.; D. Skip verification when the request is urgent.

Correct answer: A. Verify the request through a known independent channel and require a second approver. Arup’s case shows that realistic audio/video can be forged; independent verification and dual control address the payment process.

Social Scenario: A company receives an executive-impersonation email requesting a wire transfer to a new account. Which response could have interrupted the Ubiquiti-style fraud? A. Call back using a number from a trusted directory and independently confirm the payment.; B. Reply to the same email asking whether it is genuine.; C. Use the phone number included in the suspicious message.; D. Send a small test transfer before verifying.

Correct answer: A. Call back using a number from a trusted directory and independently confirm the payment. A separately sourced callback avoids relying on the potentially spoofed message channel.

Social Scenario: One targeted employee opens an Excel attachment; a remote-access tool is installed and the breach exposes a company’s global authentication product. Which case pattern does this resemble? A. RSA SecurID: spearphishing foothold followed by a large organizational blast radius.; B. A volumetric flood with no initial user action.; C. A QR redirect chain with no attachment.; D. A SYN flood that exhausted a DNS backlog.

Correct answer: A. RSA SecurID: spearphishing foothold followed by a large organizational blast radius. The RSA incident began with a targeted email attachment and affected SecurID infrastructure.

Social Scenario: Employees are tricked by phone into giving attackers access to an internal account-management tool, which is used to hijack prominent accounts. Which incident is the closest match? A. Twitter 2020.; B. NotPetya 2017.; C. GitHub memcached DDoS 2018.; D. WannaCry 2017.

Correct answer: A. Twitter 2020. Twitter’s 2020 incident involved phone-based social engineering and abuse of internal tools.

Social Scenario: A QR code resolves to a shortener, then uses JavaScript to redirect again. A HEAD request sees only a harmless page. What is the safest conclusion? A. The destination remains unverified; confirm the request with a trusted source instead of trusting the decoded shortener.; B. The URL is safe because HEAD did not show a malicious destination.; C. The first shortener proves the final destination is unchanged.; D. Scan the code on a work device to reveal the hidden page.

Correct answer: A. The destination remains unverified; confirm the request with a trusted source instead of trusting the decoded shortener. Client-side redirects can hide later hops; resolving the chain may require executing it, so verify the source and request independently.

Social Scenario: A firm deploys phishing-resistant FIDO2 keys, but help-desk agents can replace a lost key after a phone call. Where should the firm strengthen controls? A. Account recovery: verify identity independently and require a controlled approval process before re-enrollment.; B. The FIDO2 cryptography; it must be replaced with SMS codes.; C. The browser’s hover preview.; D. The user’s public social-media profile only.

Correct answer: A. Account recovery: verify identity independently and require a controlled approval process before re-enrollment. Hardware keys resist credential phishing, but people and recovery workflows still control access restoration.

Social Scenario: Annual click-through training gets high completion but employees hide mistakes and rarely report suspicious messages. Which change best matches the handout’s defense approach? A. Use recurring realistic practice, make reporting blame-free, and reinforce verification as normal.; B. Increase the number of punitive surprise tests.; C. Train only once, then rely on the click rate.; D. Tell employees never to question urgent executive requests.

Correct answer: A. Use recurring realistic practice, make reporting blame-free, and reinforce verification as normal. Continuous, realistic, blame-free training supports reporting and a culture where verification is expected.

Social Scenario: A caller claims to be the CEO, says a deal closes in ten minutes, and asks an employee to bypass the payment process. Which persuasion cues are being used, and what should the employee do? A. Authority and scarcity/urgency; pause and verify through the normal independent process.; B. Liking and reciprocity; comply to preserve the relationship.; C. Social proof and consistency; skip the callback.; D. Scarcity alone proves the request is legitimate.

Correct answer: A. Authority and scarcity/urgency; pause and verify through the normal independent process. The pretext combines authority with urgency; urgency is a reason to verify, not bypass controls.

Social Scenario: A student checks the FBI IC3 loss ranking cited by the exam guide for 2025. Where did Business Email Compromise rank by total reported losses? A. Second, behind investment fraud.; B. First, ahead of investment fraud.; C. Tenth, behind credit-card fraud.; D. It was not included in the report.

Correct answer: A. Second, behind investment fraud. The 2025 IC3 report listed investment fraud first and BEC second by total reported dollar loss.

DoS Scenario: A managed DNS provider is knocked offline by a flood. Unrelated sites then fail to load, although their own servers were not breached. Why? A. DNS service is needed to translate site names to addresses, so the outage causes collateral disruption.; B. The attack changed the TLS certificates stored by every site.; C. Each unrelated site was necessarily infected by the same malware.; D. DNS outages only affect the provider’s own website.

Correct answer: A. DNS service is needed to translate site names to addresses, so the outage causes collateral disruption. The Dyn case demonstrates collateral damage: dependent services can become unreachable when a shared DNS provider is disrupted.

DoS Scenario: A defender traces a DDoS flood back to thousands of home devices but cannot identify the person directing them. What best explains the gap? A. Every botnet packet has the controller’s real source address.; B. The visible source IPs belong to compromised agents; handler layers separate them from the controller.; C. Traceback is impossible because routers do not record packet paths.; D. The target’s DNS cache rewrites the sender address.

Correct answer: B. The visible source IPs belong to compromised agents; handler layers separate them from the controller. Distributed agents make source blocking costly, while command relays obscure the operator behind compromised devices.

DoS Scenario: A response team is writing a defense matrix. Which set matches each attack class to a primary defense? A. SYN flood: CDN; reflection: SYN cookies; volumetric: user training; application-layer: BCP 38 only.; B. SYN flood: blackhole every network; reflection: CAPTCHA; volumetric: password reset; application-layer: DNSSEC.; C. SYN flood: SYN cookies; reflection: BCP 38; volumetric: scrubbing/overprovisioning; application-layer: rate limits and behavioral detection.; D. SYN flood: OSINT; reflection: sandbox; volumetric: least privilege; application-layer: clean boot media.

Correct answer: C. SYN flood: SYN cookies; reflection: BCP 38; volumetric: scrubbing/overprovisioning; application-layer: rate limits and behavioral detection. The best defense depends on the resource being exhausted and whether spoofing, link capacity, or application work is involved.

DoS Scenario: A server has low incoming bandwidth, but many client connections remain occupied by slowly delivered HTTP headers. Which resource and response fit best? A. The network link is saturated; add SYN cookies only.; B. The DNS cache is full; enable BCP 38 at the web server.; C. The CPU is used by a smurf attack; disable TCP acknowledgments.; D. The connection pool is exhausted; enforce connection timeouts and use a proxy that buffers complete requests.

Correct answer: D. The connection pool is exhausted; enforce connection timeouts and use a proxy that buffers complete requests. Slowloris is an application-layer state attack that can consume connections with little bandwidth.

Malware Scenario: A responder must classify four observed payloads: a wiper, a remotely controlled infected laptop, a keylogger, and a rootkit. Which mapping is correct? A. System corruption; attack agent; information theft; stealthing.; B. Information theft; stealthing; attack agent; system corruption.; C. Attack agent; system corruption; stealthing; information theft.; D. Stealthing; information theft; system corruption; attack agent.

Correct answer: A. System corruption; attack agent; information theft; stealthing. The examples map respectively to corruption, attack-agent, information-theft, and stealthing payload categories.

Malware Scenario: A new file has no known signature, looks suspicious to static rules, and behaves strangely only when run. Which description best separates the detection methods? A. Signatures observe runtime actions; heuristics require a clean-room rebuild; behavior detection matches only known hashes.; B. Signatures match known patterns; heuristics flag suspicious traits; behavior detection observes runtime actions.; C. All three methods are the same and fail only when malware is encrypted.; D. Behavior detection is a fixed byte-pattern list, while signatures judge intent.

Correct answer: B. Signatures match known patterns; heuristics flag suspicious traits; behavior detection observes runtime actions. Each method uses different evidence and has different blind spots; layered detection is more robust than one technique.

Malware Scenario: An analyst sees variants with changing decryptors, then rewritten code bodies, then a packed sample that checks for a virtual machine. Which sequence best names the evasion pattern? A. Metamorphism, SYN spoofing, BCP 38, and reflection.; B. Packing, macro infection, tailgating, and sandboxing.; C. Polymorphism, metamorphism, packing, and anti-analysis.; D. Signature detection, backdoor, worm propagation, and encryption.

Correct answer: C. Polymorphism, metamorphism, packing, and anti-analysis. Polymorphism changes the decryptor; metamorphism rewrites code; packing unpacks at runtime; anti-analysis avoids sandboxes.

Malware Scenario: A commercial CD installs a rootkit that hides files with a special prefix. Other malware later uses the same cloak. What is the key lesson? A. A rootkit protects only the software vendor that installed it.; B. Kernel-mode rootkits cannot hide files from any tool.; C. Commercial software cannot introduce security risk.; D. A concealment mechanism can be reused by any malware that knows how to invoke it.

Correct answer: D. A concealment mechanism can be reused by any malware that knows how to invoke it. The Sony BMG rootkit showed how a cloak created for one purpose can expand the hiding options available to other malware.

Social Scenario: A text message includes a plausible delivery link. On a phone, the recipient cannot hover to preview it and tapping resembles opening an ordinary link. Which risk factor is illustrated? A. The mobile interface removes a useful preview cue and makes the risky tap feel routine.; B. SMS automatically verifies the sender’s identity.; C. A QR code encrypts the destination until the user signs in.; D. Mobile links cannot redirect to another site.

Correct answer: A. The mobile interface removes a useful preview cue and makes the risky tap feel routine. The handout notes that limited link preview and familiar tap gestures can make smishing easier to act on.

Social Scenario: A stranger follows an employee through a badge-controlled door; nearby, a found USB stick is labeled “payroll.” Which pair names these physical tactics? A. Whaling and vishing.; B. Tailgating and baiting.; C. Smishing and quishing.; D. Pretexting and business email compromise.

Correct answer: B. Tailgating and baiting. Tailgating abuses someone else’s entry; baiting uses an enticing object to prompt an unsafe action.