6.5.12 Practice Questions Security Pro

Which of the following is the term used to describe what happens when an attacker sends falsified messages to link their MAC address with the IP address of a legitimate computer or server on a network?

ARP poisoning

A threat actor has successfully manipulated a client's DNS cache, causing the client to resolve domain names to incorrect IP addresses controlled by the threat actor. This allows the threat actor to redirect the client's network traffic to malicious websites.

Which type of attack does this scenario represent?

Client cache poisoning

A major online retail company has recently been experiencing intermittent downtime of its website. Network analysts observe a massive influx of traffic from multiple sources to the server. However, the traffic seems redirected from other systems.

What type of attack is the company likely experiencing?

Distributed denial-of-service (DDoS)

A company CEO is upset after receiving a call from a reporter at a local news station that the company is apparently at a launching point for a massive attack. The reporter provided detailed IP logs, and the network team reviewed them but could not find similar entries.

What could be a possible explanation for the different records?

DNS poisoning

A threat actor has successfully breached a company's network and has installed malicious code on a compromised host. The threat actor is now operating the compromised host remotely and maintaining access to it over a period of time. The threat actor's activity is disguised as part of the network's regular traffic.

Detection of this type of activity usually depends on identifying anomalous connection endpoints.

Which stage of the cyberattack lifecycle does this scenario represent?

Command and Control

A network administrator suspects an attacker is intercepting and potentially modifying communications between their organization's server and the client systems. The attacker is not detected by either party during this process.

Which type of attack is the network administrator likely observing in this instance?

On-path attack

A threat actor has launched an attack against a company's network. The threat actor spoofs the victim's IP address and attempts to open connections with multiple third-party servers. Those servers direct their responses to the victim host, rapidly consuming the victim's available bandwidth.

Which type of attack does this scenario represent?

Reflected attack

Which of the following statements about Bash is true?

Bash works in the background to execute commands using environment variables.

As a system administrator, you notice unusual network activity on a company server. Upon investigation, you discover that a PowerShell script is running in the background.

What type of malware is MOST likely responsible for this activity?

Fileless malware

How can Visual Basic for Applications (VBA) be used to perform malicious attacks?

VBA can be used to create a macro virus that opens a shell on the Windows operating system.