Free GIAC Certified Incident Handler GCIH Practice Questions

Correct answer: B. Containment

All four actions listed, removing network cables, isolating on a VLAN, using firewalls/access lists, and changing DNS entries, are classic containment measures designed to limit the scope and impact of a security incident. Containment is the phase where responders take steps to stop the attack from spreading and prevent further damage, while preserving evidence. Identification focuses on detecting the incident, eradication removes the threat, and recovery restores systems to normal operation.

Why the other options are wrong

• A. Identification is the detection and confirmation of a security incident, not the implementation of isolation measures.
• C. Eradication removes the attacker's tools and access, but the listed actions are preventative controls rather than removal steps.
• D. Recovery restores systems to normal operation after the threat is eliminated; it does not involve isolation or access prevention.

Correct answer: A. Computer is infected with the stealth kernel level rootkit.

A stealth kernel-level rootkit operates at the system's deepest level and can hide its presence and activities from standard monitoring tools, antivirus, and anti-spyware software. The key indicator here is that the system is visibly slowing down with mysteriously disappearing windows, yet antivirus and anti-spyware software detect nothing, suggesting something hidden from these tools. The massive loss of disk space (190 GB consumed) combined with popups that vanish quickly points to rootkit activity that typical security tools cannot detect because the rootkit controls what the OS reports.

Why the other options are wrong

• B. A stealth virus typically replicates by attaching to files and would be more likely detected by antivirus software, which is running on this system.
• C. Trojan viruses are generally detected by antivirus software and don't typically cause the hidden resource consumption characteristic of rootkits.
• D. Worms cause visible file replication and network spreading; they are usually detected by antivirus and would not evade detection as effectively as a kernel-level rootkit.

Correct answer: A. Denial of Service attack

A Denial of Service (DoS) attack is specifically designed and intended solely to make a resource unavailable to legitimate users by overwhelming it with traffic or exploiting vulnerabilities to crash the service. The defining characteristic of a DoS attack is that its only goal is availability disruption, not data theft, authentication bypass, or other objectives.

Why the other options are wrong

• B. A replay attack involves capturing and resending valid data to impersonate a user or gain unauthorized access, not merely denying availability.
• C. A teardrop attack is a specific DoS technique that sends fragmented packets, but it is a type of DoS rather than the category that encompasses only availability attacks.
• D. A land attack sends spoofed packets with the target's own IP as both source and destination, designed to crash the system, but is a specific DoS variant rather than the general category.

Correct answer: A. Brute force attack

A brute force attack systematically tries many password combinations or hashes until a match is found. When attacking a hashed password, an attacker can generate hashes of candidate passwords and compare them to the target hash, a process that is computationally intensive but does not require the hash to be reversed. Brute force is the fundamental technique for guessing hashed passwords.

Why the other options are wrong

• B. Evasion attacks are techniques to bypass security controls and detection systems, not password cracking methods.
• C. Denial of Service attacks aim to disrupt availability, not to guess or crack passwords.
• D. Teardrop attacks are a fragmented packet DoS technique with no connection to password guessing or hashing.

Correct answer: A. Ping of death

The Ping of Death is a classic DoS attack in which an attacker sends an ICMP echo request (ping) packet larger than the maximum allowed size of 65,536 bytes. When the target system attempts to process this oversized packet, it can cause a buffer overflow, crash, or system hang. This attack exploits a limitation in older TCP/IP implementations.

Why the other options are wrong

• B. Jolt is a DoS attack that sends fragmented ICMP echo requests, not oversized single packets.
• C. Fraggle is a DoS attack that exploits the UDP echo and chargen services by sending spoofed broadcast traffic, not ICMP oversized packets.
• D. Teardrop sends overlapping IP fragments that cause processing errors, but is not specifically characterized by a single packet larger than 65,536 bytes.

Correct answer: C. MAC spoofing

MAC spoofing occurs when an attacker configures their network interface card to use a different MAC address than the one assigned by the manufacturer. In this case, the unfamiliar machine connected to Adam's wireless network has the same MAC address as Adam's laptop, meaning someone has spoofed Adam's MAC address to gain access to his network. Despite MAC filtering being enabled, the attacker mimicked Adam's laptop's MAC address to bypass this control.

Why the other options are wrong

• A. NAT spoofing is not a recognized standard attack terminology; NAT (Network Address Translation) is a routing function.
• B. DNS cache poisoning involves corrupting DNS records in a cache to redirect traffic, not spoofing MAC addresses to join a wireless network.
• D. ARP spoofing involves sending false ARP replies to associate an attacker's MAC address with someone else's IP address, but the scenario describes a MAC address duplication rather than ARP poisoning.

Correct answer: B. Indirect prompt injection

Indirect prompt injection occurs when an LLM ingests content from an external source, such as a website or file, that contains instructions the model then follows. The user typed a harmless request, and the malicious instructions arrived through the fetched page, which is what makes the injection indirect. OWASP describes this exact pattern: a summarized web page with hidden instructions makes the model insert an image link that exfiltrates the private conversation. Mitigations include segregating and clearly marking untrusted content and filtering output before it is rendered.

Why the other options are wrong

• A. Direct injection comes from the user's own prompt, and here the user's request was benign while the instructions came from the fetched page.
• C. Poisoning manipulates pre-training, fine-tuning or embedding data, while this attack arrived in content read at inference time.
• D. Unbounded consumption describes excessive, uncontrolled inference that drains resources or money, not data theft through injected instructions.

Correct answer: D. Performing Neotracerouting

Manual network mapping is done by hand: gathering the organization's private and public IP addresses, collecting information about employees, and banner grabbing to identify services and versions. Tracing routes with a tool such as NeoTrace is automated mapping, so it is the step that does not belong to the manual process.

Why the other options are wrong

• A. Gathering private and public IP addresses is a core part of manual network mapping.
• B. Collecting information about employees is part of the manual mapping of an organization.
• C. Banner grabbing identifies running services and their versions and is a manual mapping step.

Correct answer: A, B, C. tcp wrapper provides access control, host address spoofing, client username lookups, etc; When a user uses a TCP wrapper, the inetd daemon runs the wrapper program tcpd instead of running the server program directly; tcp wrapper allows host or subnetwork IP addresses, names and/or ident query replies, to be used as tokens to filter for access control purposes.

TCP wrappers is a host-based access control mechanism that intercepts network service requests. Statement A is correct: tcp wrappers provides access control, prevents host address spoofing through verification, and performs client username lookups via ident protocol. Statement B is correct: the inetd daemon is configured to invoke the tcpd wrapper program, which examines the request against access control rules before passing it to the actual service daemon. Statement C is correct: tcp wrappers uses IP addresses, hostnames, subnetwork specifications, and ident query responses as tokens for filtering decisions. Statement D is incorrect because tcp wrappers operates at the application layer and cannot prevent IP spoofing at the network layer; it can only filter based on source addresses but cannot verify their authenticity.

Why the other options are wrong

• D. TCP wrappers cannot prevent IP spoofing since spoofing occurs at the network layer and wrappers operate at the application layer.

Correct answer: D. Buffer overflow attack

Buffer overflow attacks result directly from poor programming techniques where developers fail to implement proper bounds checking on input data. This allows attackers to write beyond allocated memory boundaries, corrupting the stack and potentially executing arbitrary code. Evasion attacks are techniques to bypass security controls, DoS attacks aim to make services unavailable through resource exhaustion, and Ping of Death is a specific attack using malformed ICMP packets, none of these are inherently caused by poor programming practices in the fundamental sense that buffer overflows are.

Why the other options are wrong

• A. Evasion attacks are techniques used to circumvent security mechanisms, not inherently rooted in programming vulnerabilities.
• B. Denial-of-Service attacks flood resources but are not specifically a result of poor programming techniques.
• C. Ping of Death exploits a specific network layer limitation rather than being caused by poor programming practices.

Correct answer: A, B, C, D, F. Rootkit; Trojan; Crimeware; Worm; Virus

Antivirus applications can effectively detect and remove rootkits, trojans, crimeware, worms, and viruses through signature-based and heuristic detection methods. These malware types, while sophisticated, leave detectable artifacts and behaviors that antivirus software is designed to identify. Adware, however, is often not classified as malware by antivirus vendors and may be considered potentially unwanted programs (PUPs) rather than true malware, making it less likely to be actively disabled and destroyed by traditional antivirus applications.

Why the other options are wrong

• E. Adware is usually handled as a potentially unwanted program rather than as malware, so antivirus products tend to flag it for the user instead of disabling and removing it automatically.

Correct answer: D. Domain Name System Extension (DNSSEC)

DNSSEC (Domain Name System Security Extensions) is specifically designed to protect Internet resolvers and clients from forged DNS data and DNS cache poisoning attacks. It uses cryptographic signatures to validate DNS responses, ensuring that DNS data comes from authoritative sources and has not been tampered with or redirected by attackers.

Why the other options are wrong

• A. Stub resolvers are simplified DNS clients that forward queries to recursive resolvers; they don't provide protection against DNS poisoning.
• B. BINDER is not a recognized DNS security mechanism for protection against cache poisoning.
• C. Split-horizon DNS is a configuration technique that serves different DNS responses based on query source; it doesn't protect against forged DNS data.

Correct answer: C. Look at the system's registry, its memory, its hardware, and its processor instructions

Detecting virtual machines requires examining deep system characteristics. Registry keys, memory configuration, hardware specifications, and processor instruction sets (like VMX or SVM flags) contain telltale signs of virtualization that hypervisors cannot easily hide. The registry stores VM-specific drivers and settings, memory size often differs from physical machines, hardware identifiers are virtualized, and processor instructions reveal the hypervisor type. The other options examine operational characteristics that can be present on both physical and virtual machines.

Why the other options are wrong

• A. Firewall settings and service configurations are operational aspects unrelated to detecting virtualization.
• B. Processor utilization and network settings are runtime behavior indicators, not VM detection signatures.
• D. OS version and patch status are independent of whether the system is virtualized.

Correct answer: C. chkrootkit

Chkrootkit is specifically designed to search for rootkit signatures by leveraging common UNIX/Linux tools like strings and grep to scan system binaries for rootkit modification, and its helper programs such as chkproc and chkdirs check for signs of LKM trojans that hide processes and directories. rkhunter is a rootkit detection tool but uses a different approach based on hash comparisons and vulnerability scanning; OSSEC is a host-based intrusion detection system focused on log analysis; Blue Pill is a hypervisor rootkit, not a detection tool.

Why the other options are wrong

• A. rkhunter is a separate rootkit scanner that mainly compares file hashes and checks for known rootkit files, settings and backdoors.
• B. OSSEC is a host-based intrusion detection system built around log analysis and file integrity monitoring, not a signature search with strings and grep.
• D. Blue Pill is a proof-of-concept hypervisor rootkit, not a tool for detecting rootkits.

Correct answer: A. Active OS fingerprinting

These packet combinations represent active OS fingerprinting. Sending unusual flag combinations (ACK/FIN/PSH/URG to closed ports and SYN/FIN/URG/PSH to open ports) to observe how the target responds is characteristic of active fingerprinting techniques like those used by Nmap. Different operating systems respond distinctly to these malformed packets, allowing identification. This is active rather than passive because the attacker is directly probing the target.

Why the other options are wrong

• B. Host discovery typically uses ICMP or SYN packets to determine if a host is alive, not these specific flag combinations.
• C. Passive OS fingerprinting observes normal traffic patterns without sending probes; this is active probing.
• D. While this could evade some simple IDS rules, the primary purpose is OS fingerprinting identification.

Correct answer: C. Share only the extracted macro code, with customer data removed, through an approved AI tool

A generative AI assistant can speed up reading obfuscated code, but anything submitted may be retained, used for training or exposed later through the model's output. Financial details, personal data and confidential business records should therefore stay out of prompts. Extracting only the macro, stripping customer data and using a tool the organization has approved keeps the benefit of the assistant while limiting disclosure. The assistant's interpretation still has to be checked against the code before anyone acts on it.

Why the other options are wrong

• A. Uploading the whole workbook hands the customer bank details to an external service where they may be retained or disclosed.
• B. Asking a chatbot to forget data does not remove what has already been submitted to the service.
• D. Language models can help explain code, so refusing them outright gives up a legitimate aid that is safe when the data is handled properly.

Correct answer: D. Port scanning

Port scanning is the fundamental technique used during penetration testing to identify open ports, running services, and potential entry points for accessing unauthorized information on a target system. It is a standard reconnaissance and vulnerability assessment tool.

Why the other options are wrong

• A. Van Eck Phreaking is a side-channel attack that captures electromagnetic emissions, not a standard penetration testing technique.
• B. Phreaking involves exploiting telephone networks, not general penetration testing for accessing computer information.
• C. Biometrician refers to biometric analysis and authentication bypass, not a core penetration testing methodology.

Correct answer: A, B, C. To use firewalking, the attacker needs the IP address of the last known gateway before the firewall and the IP address of a host located behind the firewall; In this technique, an attacker sends a crafted packet with a TTL value that is set to expire one hop past the firewall; A malicious attacker can use firewalking to determine the types of ports/protocols that can bypass the firewall.

Firewalking is a network reconnaissance technique where an attacker determines which ports/protocols can pass through a firewall by sending packets with specific TTL values designed to expire just beyond the firewall (B). To execute this, the attacker must know both the last gateway IP before the firewall and a target host IP behind it (A). This allows mapping of firewall rules and identification of open ports (C). However, firewalking works primarily with ICMP and TCP; UDP packets are not typically used in the classic firewalking methodology.

Why the other options are wrong

• D. Firewalking primarily uses ICMP and TCP packets, not UDP packets.

Correct answer: A, B. The attacker must determine the right values for all the form inputs; The attacker must target a site that doesn't check the referrer header.

CSRF attacks have two fundamental limitations: (A) The attacker must know or guess the correct form input values since CSRF relies on predictable request structures, and (B) CSRF succeeds primarily against sites that don't validate the Referer header, which would identify cross-origin requests. Options C and D describe mitigation strategies the target site should implement, not limitations of CSRF attacks. Limited-lifetime cookies and GET/POST parameter authentication are defenses, not attack limitations.

Why the other options are wrong

• C. This describes a recommended defense (limited cookie lifetime) rather than a limitation inherent to CSRF attacks.
• D. This describes a defense strategy (parameter-based authentication) rather than a limitation of the CSRF attack itself.

Correct answer: A. --

The double hyphen (--) is the standard SQL comment delimiter used in SQL injection attacks. When injected into a query, it comments out the remainder of the original SQL statement, allowing the attacker to bypass authentication logic or modify query behavior. This is a fundamental SQL injection technique used across different database platforms.

Why the other options are wrong

• B. Single quote terminates string literals but is not a comment delimiter; it's used to break out of strings rather than comment them out.
• C. Asterisk (*) is a wildcard in SQL but not a comment delimiter.
• D. Semicolon terminates statements but is not a comment delimiter in standard SQL.
• E. This path traversal sequence is unrelated to SQL syntax or SQL injection.

Correct answer: C. API2:2023 Broken Authentication, addressed by stricter anti-brute-force controls and MFA

Trying username and password pairs leaked elsewhere is credential stuffing, and an API that permits it is vulnerable to API2:2023 Broken Authentication. Authentication endpoints, including password reset, need their own protection: anti-brute-force mechanisms that are stricter than the API's regular rate limiting, account lockout or captcha against attacks on single accounts, and multi-factor authentication where possible. A general limit shared with every other endpoint is not tuned to stop login abuse.

Why the other options are wrong

• A. Resource consumption concerns missing limits on memory, timeouts, upload sizes and similar resources, and longer timeouts would do nothing to stop password guessing.
• B. Sensitive business flows cover abuse of functions such as buying, booking or posting, and fingerprinting at checkout does not protect the login endpoint.
• D. Unsafe consumption concerns trusting data received from integrated third-party APIs, while these login attempts come directly from clients.

Correct answer: D. 5 minutes

A 22-letter dictionary word chosen as a password is extremely weak from a security perspective. Modern password cracking tools using dictionary attacks can crack such passwords in minutes or less. Dictionary words, regardless of length, have dramatically reduced entropy compared to randomly generated character combinations, allowing attackers to test millions of dictionary combinations per second.

Why the other options are wrong

• A. 22 hours vastly overestimates the time required to crack a simple dictionary word.
• B. 23 days is unrealistically long; dictionary attacks succeed far more quickly than this.
• C. 200 years assumes cryptographic strength that a dictionary word does not possess; modern hardware and algorithms make this estimate absurdly high.

Correct answer: B. net use \\10.0.0.1\one adminpassword /u:adminuser

The 'net use' command is the correct Windows utility for establishing connections to remote shares. The proper syntax is 'net use \\IP\share password /u:username', which creates an administrative session and mounts the remote share locally.

Why the other options are wrong

• A. The 'mount' command is not the correct Windows tool for network shares; it's a Unix/Linux command.
• C. 'net mount' is not a valid Windows command; the correct command is 'net use'.
• D. While 'net use' is correct, the parameter order is wrong; the username flag /u: should precede the password in standard syntax.

Correct answer: B. nc -z

The 'nc -z' command performs port scanning using Netcat. The '-z' flag enables zero-I/O mode, which causes Netcat to scan ports without sending data, making it suitable for port scanning. The '-t' flag enables telnet emulation, '-w' sets timeout values, and '-g' specifies a source routing hop, none of which are port scanning options.

Why the other options are wrong

• A. The -t flag enables telnet mode for interactive connections, not port scanning.
• C. The -w flag sets connection and read timeouts, not used for port scanning specifically.
• D. The -g flag specifies source routing gateway hops, unrelated to port scanning.

Correct answer: B. Confirm each behavior and indicator against the script itself and other trusted evidence

Language models can hallucinate, producing content that sounds accurate but is fabricated, and overreliance occurs when users trust that output without verifying it. In an investigation a fabricated indicator can misdirect blocking, scoping and reporting. The assistant's summary is a lead: each claimed behavior and indicator should be cross-checked against the script, sandbox results or log evidence before it enters the report, with a trained human making the final call.

Why the other options are wrong

• A. Having the full script does not stop the model from inventing or misreading details, so unverified output can still be wrong.
• C. A self-rated confidence score comes from the same model and is not independent verification.
• D. Indicators can be hallucinated just like behaviors, so the domain needs the same verification.

Correct answer: C. Verify the signature with an allow-listed algorithm only, and reject tokens at or after exp

Because a JWT's header and payload are only base64url-encoded, their values can be forged unless the signature is verified. The verifier should accept only the algorithms it expects, never alg none, which marks an unsecured token with an empty signature. RFC 7519 also requires that a JWT not be accepted on or after its exp time. OWASP lists accepting unsigned tokens and skipping the expiration check as API2:2023 Broken Authentication weaknesses.

Why the other options are wrong

• A. Reading the payload without verifying the signature trusts data an attacker can write freely, so a valid user ID proves nothing.
• B. Placing tokens in the URL exposes them in logs and history, and OWASP lists it as a broken authentication weakness rather than a validation step.
• D. Letting the token's own header choose the algorithm is what makes alg none and algorithm confusion attacks possible.

Correct answer: D. The user that ran the Netcat listener

When a Netcat listener receives a connection and spawns a shell, the commands executed run with the privileges of the user who started the Netcat listener process. If root started the listener, commands run as root; if an unprivileged user started it, commands run with that user's privileges. This is fundamental Unix/Linux process privilege inheritance, a child process inherits the security context of its parent.

Why the other options are wrong

• A. Commands only run as root if the listener was specifically started by root.
• B. The 'nobody' account is not involved unless it was the user that started Netcat.
• C. The client user's privileges are irrelevant; only the listener process owner matters.

Correct answer: C. By examining your firewall logs.

Firewall logs record outbound and inbound network traffic, including unauthorized communications from rootkits attempting to contact external command-and-control servers. By examining firewall logs for suspicious outbound connections from internal systems, you can detect rootkit activity without an IDS. This is a standard detection method for lateral movement and external communications.

Why the other options are wrong

• A. Domain controller logs primarily track authentication and directory service events, not rootkit communications to external attackers.
• B. This is incorrect because firewall logs provide a viable detection method without requiring an IDS.
• D. A DMZ is a network architecture for isolating services, not a detection mechanism for rootkit communications.

Correct answer: D. In this type of attack, a hacker sends ICMP packets greater than 65,536 bytes to crash a system.

A Ping of Death attack involves sending ICMP Echo Request packets (ping packets) that exceed the maximum IP packet size of 65,536 bytes. When these oversized packets are reassembled by the target system, they cause buffer overflow conditions that can crash or destabilize vulnerable systems. This is a classic network-based DoS attack that exploits IP protocol limitations.

Why the other options are wrong

• A. This describes a buffer overflow or DoS attack in general terms, but not specifically the Ping of Death mechanism, which uses oversized ICMP packets.
• B. This describes a dictionary attack or brute-force password attack, which is unrelated to Ping of Death attacks.
• C. Maliciously cutting network cables is a physical attack method, not a Ping of Death attack, which is a network-based cyber attack.

Correct answer: D. Active IDS

An Active IDS (also called Intrusion Prevention System or IPS) not only detects attacks but can automatically respond by closing connections, blocking traffic, restarting services, or taking other defensive actions. This capability to automatically respond and take corrective action distinguishes it from passive detection systems.

Why the other options are wrong

• A. Signature-based IDS detects known attack patterns but only passively identifies them without automatic response capabilities.
• B. Network-based IDS monitors network traffic but is primarily a passive detection system without automatic action capabilities.
• C. Passive IDS only detects and reports attacks without taking automatic actions to stop or mitigate them.

Correct answer: A. SPI

SPI (Stateful Packet Inspection) is most useful against DoS attacks because it monitors the state of active connections and can identify and block suspicious traffic patterns characteristic of DoS attacks, such as incomplete connection attempts or unusual traffic volumes. SPI firewalls can detect and mitigate both volumetric and protocol-based DoS attacks by analyzing packet states.

Why the other options are wrong

• B. A distributive firewall is not specifically designed to prevent DoS attacks; it focuses on distributed architecture rather than attack prevention mechanisms.
• C. Honey pots are used for detection and research of attacks, not for preventing DoS attacks from affecting the network.
• D. Internet bots are tools used by attackers to launch DoS attacks, not to prevent them.

Correct answer: B. Ping of death attack

Adam is performing a Ping of Death attack. This attack involves sending ICMP echo request packets that are fragmented such that when reassembled, they exceed the maximum allowed IP packet size of 65,535 bytes (or 65,536 bytes total). Systems receiving these oversized packets often crash or become unstable because the IP protocol was not designed to handle packets larger than this limit. This was a common DoS vulnerability in older systems.

Why the other options are wrong

• A. Fraggle attack uses ICMP echo requests and UDP packets directed at broadcast addresses, not fragmented oversized packets.
• C. SYN Flood attack involves sending massive numbers of TCP SYN packets, not fragmented ICMP packets.
• D. Land attack sends packets with spoofed source and destination addresses being the same, not oversized fragmented ICMP packets.

Correct answer: B. Use a permission-aware vector store with strict per-tenant partitioning

OWASP LLM08 Vector and Embedding Weaknesses describes cross-context leaks in multi-tenant environments where different users or applications share one vector database, so embeddings from one group are retrieved for another. The recommended fix is fine-grained, permission-aware vector and embedding stores with strict logical and access partitioning of datasets, so retrieval only returns content the requester is authorized to see. Detailed immutable logs of retrieval activity help responders confirm what was exposed and to whom.

Why the other options are wrong

• A. Retrieving more documents widens exposure and does nothing to restrict which tenant's data is eligible.
• C. Fine-tuning does not add access control to the shared retrieval store, which is where the leak occurs.
• D. Temperature changes sampling randomness, not which documents the retriever supplies to the model.

Correct answer: C. Denial of Service

The key indicators are: (1) the user is unaware of the activity, (2) the user lacks technical knowledge to execute an attack, and (3) traffic bursts emanate from a single machine. This profile indicates the machine is compromised and being used as part of a botnet to launch a Denial of Service attack without the owner's knowledge. The activity happening without user awareness strongly suggests the system has been compromised.

Why the other options are wrong

• A. While spyware could exist on the machine, it typically monitors and exfiltrates data rather than generating outbound traffic bursts characteristic of DoS attacks.
• B. Ping Flood is a specific type of DoS but doesn't account for why an unknowing user's machine would be performing it without malware.
• D. Session Hijacking involves stealing active sessions, not generating sustained outbound traffic bursts from a compromised machine.

Correct answer: B. Preparation

The standard hacking process consists of five phases: Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Covering Tracks. Preparation is not a recognized phase in the established hacking methodology framework. Reconnaissance involves gathering information, Scanning involves active probing, and Gaining Access involves exploiting vulnerabilities, all are core phases of the attack lifecycle.

Why the other options are wrong

• A. Scanning is a critical phase where attackers identify open ports and services on target systems.
• C. Gaining access is the core offensive phase where attackers exploit vulnerabilities to compromise systems.
• D. Reconnaissance is the first phase where attackers gather passive information about targets.

Correct answer: B. Reconnaissance attack

A reconnaissance attack is the phase where an attacker gathers information about a target system to identify vulnerabilities and plan subsequent access attacks. This information-gathering stage precedes actual attacks and includes techniques like scanning, enumeration, and footprinting.

Why the other options are wrong

• A. A Land attack is a DoS attack involving malformed packets, not an information-gathering phase.
• C. A vulnerability attack exploits known weaknesses rather than gathering information beforehand.
• D. A DoS attack attempts to disrupt service availability, not collect reconnaissance data.

Correct answer: A, B. Passive OS fingerprinting; Sniffing

Nmap is a network scanning tool that performs active reconnaissance through port scanning and active OS fingerprinting by sending packets and analyzing responses. However, nmap cannot perform passive OS fingerprinting, which requires observing network traffic without sending probes, as this is outside its active scanning paradigm. Nmap also cannot function as a packet sniffer in the traditional sense; while it can capture some traffic during scans, dedicated sniffing tools like Wireshark are designed for that purpose.

Why the other options are wrong

• C. Active OS fingerprinting is a core nmap function that identifies OS by sending crafted packets and analyzing responses.
• D. Port scanning is nmap's primary and most well-known capability.

Correct answer: B. File integrity auditing

File integrity auditing is the process of computing and comparing cryptographic hash values of system executables and configuration files to detect unauthorized modifications. By comparing current hash values against baseline or original values, administrators can verify that files have not been altered, which is essential for maintaining system security and detecting compromised files.

Why the other options are wrong

• A. Shoulder surfing is a social engineering attack involving observing someone entering credentials or information, unrelated to hash comparisons.
• C. Reconnaissance is the initial phase of gathering information about a target system, not comparing cryptographic hashes.
• D. Spoofing involves impersonating another entity or system, not verifying file integrity through hash functions.

Correct answer: B. LLMNR

When DNS fails, modern Windows systems fall back to LLMNR (Link-Local Multicast Name Resolution) as the next name resolution mechanism. LLMNR allows hosts on the local network segment to resolve names without a DNS server by using multicast queries.

Why the other options are wrong

• A. The local host file is typically consulted before DNS, not after DNS failure in standard resolution order.
• C. NBT-NS (NetBIOS over TCP/IP) is an older mechanism that modern Windows systems deprioritize in favor of LLMNR.
• D. WINS (Windows Internet Name Service) is legacy technology largely deprecated in modern Windows environments.

Correct answer: A, D. escapeshellarg(); escapeshellcmd()

escapeshellarg() (A) and escapeshellcmd() (D) are both PHP functions specifically designed to prevent shell injection attacks. escapeshellarg() escapes arguments to shell commands, and escapeshellcmd() escapes shell metacharacters in command strings. Both functions neutralize attacker-supplied input by treating it as literal data rather than executable code. mysql_real_escape_string() is designed for SQL injection prevention, not shell injection, making it inappropriate for this threat. regenerateid() is a session management function unrelated to shell injection prevention.

Why the other options are wrong

• B. mysql_real_escape_string() prevents SQL injection attacks, not shell injection attacks.
• C. regenerateid() is used for session management and session fixation prevention, not shell injection defense.

Correct answer: D. nmap -sU

The nmap -sU flag performs a UDP port scan. UDP (User Datagram Protocol) scanning is used to discover open UDP ports on target systems. This is distinct from TCP scanning methods. The -sY flag is for SCTP scanning, -sS performs a TCP SYN stealth scan, and -sN performs a TCP Null scan. The -sU flag is the correct and standard Nmap option for UDP port scanning.

Why the other options are wrong

• A. nmap -sY performs SCTP scanning, not UDP scanning.
• B. nmap -sS performs a TCP SYN stealth scan, not UDP scanning.
• C. nmap -sN performs a TCP Null scan, not UDP scanning.

Correct answer: A, B, C. Freeze the scene; Repair any damage caused by an incident; Prevent any further damage.

The primary goals of an incident handling team are to freeze the scene (preserve evidence and prevent tampering), repair damage caused by the incident (restore systems to normal operation), and prevent further damage (contain the incident and block attack vectors). These three objectives represent the core mission of incident response: preservation, recovery, and containment. Informing higher authorities is important for communication and reporting but is secondary to these primary operational goals.

Why the other options are wrong

• D. While informing higher authorities is part of incident response procedures, it is a communication and escalation task rather than a primary operational goal of the incident handling team.

Correct answer: D. Sending the database specially crafted queries containing quote characters

SQL injection attacks work by sending specially crafted queries containing quote characters (and other SQL metacharacters) that break out of the intended SQL statement context and allow attackers to inject arbitrary SQL commands. Quote characters are the fundamental tool that allows an attacker to terminate string literals and inject new SQL logic. Cookies, packet types, and SYN flooding are not the primary mechanisms for revealing information through SQL injection.

Why the other options are wrong

• A. While cookies can be used as a vector for SQL injection, the actual attack mechanism involves the crafted SQL in those cookies, not the cookies themselves.
• B. Sending SQL packets to take a database offline describes a denial-of-service attack, not information disclosure.
• C. SYN flooding is a network-layer DoS technique unrelated to SQL injection or database information gathering.

Correct answer: D. Active Attacks

Victor is performing active attacks on the steganographic image. The techniques described, smoothening, decreasing contrast, reducing noise, sharpening, rotating, resampling, and softening, are all active manipulation operations applied to the cover image to detect or destroy hidden information. Active attacks involve modifying the stego-object to degrade the quality of the embedded secret message. This contrasts with passive attacks that merely attempt to detect the presence of hidden data without altering it.

Why the other options are wrong

• A. Stegdetect is a detection tool that analyzes images for steganographic content, not a manipulation technique.
• B. Chosen-stego attacks involve creating stego-objects under controlled conditions, not analyzing and modifying existing images.
• C. Steg-only attacks work with only the stego-object without access to the original, but the scenario explicitly mentions comparing with the original cover.

Correct answer: C. nmap -O -p

The -O flag in Nmap enables OS detection, which performs TCP/IP stack fingerprinting by analyzing responses to probe packets and inferring the operating system. The -p flag specifies ports to scan. Together, nmap -O -p allows fingerprinting of specific ports on the target system. This is the standard method for passive OS fingerprinting using Nmap.

Why the other options are wrong

• A. nmap -sS performs a SYN scan but does not specifically fingerprint the TCP/IP stack or operating system.
• B. nmap -sU performs UDP scanning, which is not used for TCP/IP stack fingerprinting.
• D. nmap -sT performs a TCP connect scan without OS detection capabilities.

Correct answer: A. Agree that only handlers with VMware experience will access the system

The VMware system team's concern is that unqualified handlers could cause damage or misconfigure critical systems. Requiring that only handlers with VMware experience access VMware host servers directly addresses this concern by ensuring competent personnel handle sensitive infrastructure. A password reset disk could work but doesn't address the qualification concern. Having only one person know the password creates a single point of failure and doesn't ensure VMware expertise. Calling VMware for every incident creates delays and isn't practical.

Why the other options are wrong

• B. A password reset disk bypasses the access control but doesn't ensure handlers are qualified.
• C. Having one person know the password creates a single point of failure and doesn't guarantee VMware expertise.
• D. Calling for external assistance delays incident response and isn't a practical requirement for every incident.

Correct answer: B. Denial-of-Service (DoS) attack

The scenario describes a malicious hacker flooding the network with a large number of requests to slow down computers. This is the classic definition of a Denial-of-Service (DoS) attack, which overwhelms system resources and degrades performance across the network.

Why the other options are wrong

• A. SQL injection attacks target databases through input fields, not network flooding to slow down systems.
• C. A Man-in-the-middle attack intercepts communications between two parties, not floods the network with requests.
• D. A Buffer overflow attack exploits memory vulnerabilities in software, not network flooding.

Correct answer: B, D. It is a situation that occurs when an application receives more data than it is configured to accept; It can terminate an application.

A buffer overflow occurs when an application receives more data than its allocated buffer can handle (B). This condition can cause the application to crash or terminate (D), potentially allowing code execution or denial of service. These are accurate characterizations of buffer overflow vulnerabilities and their consequences.

Why the other options are wrong

• A. A buffer overflow is not about storage device space depletion; it is about exceeding the memory allocated to a specific buffer in an application.
• C. Buffer overflows degrade performance and create security risks; they do not improve application performance.

Correct answer: A. 1

Item 1 shows Internet Explorer processes connecting to an external domain when the administrator confirmed IE was not running on the console. This indicates unauthorized or malicious process masquerading as iexplore.exe or actual compromise, which warrants immediate investigation. Item 2 is a routine DHCP error, Item 3 shows expected server services, and Item 4 is vague performance degradation without concrete indicators.

Why the other options are wrong

• B. Item 3 shows legitimate services (FTP, HTTP, RPC, SMB, RTSP, IPMI, and others) listening on a file server, which is expected behavior.
• C. Item 2 is a standard DHCP lease failure message that does not indicate a security incident.
• D. Item 4 is too vague and non-specific; slow performance with active antivirus could have numerous causes and should not be the highest priority without additional evidence.

Correct answer: C. Reduced time between detecting an adverse system event and when the root cause is addressed.

An effective incident handling program's primary outcome is reducing the time between detection of an adverse system event and resolution of the root cause. This encompasses the full incident lifecycle from discovery through remediation. While option A addresses recovery time and B/D address preparatory measures, option C directly measures the efficiency of the incident handling process itself in identifying and fixing underlying issues.

Why the other options are wrong

• A. Recovery time (RTO) is important but relates to business continuity rather than the incident handling process itself.
• B. Business owner assignment is a preparatory control, not an outcome of incident handling.
• D. Backup and restore testing is a preventive measure, not an outcome of incident response.

Correct answer: C. You will use CryptCat instead of NetCat.

CryptCat is a netcat variant that adds encryption capabilities to network traffic. Since the task requires sending the credit card data in encrypted format through a backdoor without alerting network administrators, CryptCat provides the necessary encryption layer while maintaining the backdoor functionality of the original netcat tool.

Why the other options are wrong

• A. FTP transmits data in clear text, which would expose the theft attempt to network monitoring.
• B. Wireshark is a packet analyzer for capturing traffic, not for transmitting encrypted data.
• D. Brutus is a password cracking tool unrelated to encrypted file transfer.

Correct answer: C. For monitoring unauthorized zone transfer

Monitoring unauthorized zone transfers is a critical security reason for implementing logging on DNS servers. Zone transfers should only occur between authorized primary and secondary DNS servers; logging allows administrators to detect and investigate unauthorized zone transfer attempts, which could indicate DNS compromise or reconnaissance by attackers.

Why the other options are wrong

• A. Security logging does not directly prevent malware attacks; it records events for detection and analysis.
• B. Performance measurement is an operational concern, not a security reason for logging.
• D. Recording query counts is a performance metric, not a security objective for logging.

Correct answer: D. If resources allow, assign a helper to the primary incident responder

Assigning a helper to the primary incident responder is a universal best practice that improves evidence handling, provides documentation witnesses, reduces analyst fatigue, and enables better decision-making through consultation. Providing information to anyone who asks violates need-to-know principles. Requiring the handler to work alone actually compromises evidence integrity by removing oversight and creates safety/support issues. Limiting information to only the primary responder is overly restrictive and prevents necessary escalation and collaboration.

Why the other options are wrong

• A. Information should be restricted to those with a need-to-know, not provided to anyone who asks.
• B. Working alone compromises evidence integrity by removing oversight and documentation witnesses.
• C. Information should be shared with authorized team members and management as needed for proper incident handling.

Correct answer: A, D, E. Eradication; Recovery; Identification

Eradication removes the malware or threat from the system, Identification detects and confirms the incident (spam/email attacks in this case), and Recovery restores systems to normal operation. These three phases are essential for addressing the email attack vector. Preparation involves setting up incident response capabilities beforehand, which would have helped prevent this but doesn't resolve the current incident. Contamination is not a standard phase in incident handling; the issue is identification of the vulnerability, eradication of the spam attack vector, and recovery of normal operations.

Why the other options are wrong

• B. Contamination is not a recognized phase in the standard incident handling process model.
• C. Preparation occurs before an incident happens and involves setting up defenses, not resolving an active incident.

Correct answer: B. Network is still vulnerable to ping sweep attack.

While blocking ICMP ECHO requests will prevent traditional ping sweep responses, the network remains vulnerable because attackers can use alternative methods to discover active hosts. They can perform port scans on common ports, use ARP scanning, DNS enumeration, or other reconnaissance techniques that do not rely on ICMP. Blocking ICMP alone is an incomplete defense strategy.

Why the other options are wrong

• A. Blocking ICMP does not provide complete immunity; attackers have alternative discovery methods.
• C. The vulnerability persists regardless of server reboots; the issue is the incomplete defense mechanism.
• D. Ping of Death attacks are a separate vulnerability unrelated to blocking ICMP ECHO requests.

Correct answer: C. TCP handshake between the source and destination hosts

When a non-privileged user runs nmap without sudo, it defaults to a TCP connect scan. This requires completing full TCP handshakes (SYN, SYN-ACK, ACK) to determine port status. Since the target has tcp/445 open, nmap will establish complete three-way handshakes with the destination host to probe for open ports.

Why the other options are wrong

• A. ICMP echo requests are only used in ping scans (-sn flag) or as part of host discovery, not in a default TCP scan.
• B. The scan is active, not passive; it initiates connections to the target.
• D. ACK packets alone are not sent to probe for open ports; only a full handshake occurs.

Correct answer: D. Denial-of-service

A sudden increase in the number of logins to a database server is a classic indicator of a Denial-of-Service (DoS) attack. The attacker floods the server with numerous login attempts to consume resources and prevent legitimate users from accessing the system.

Why the other options are wrong

• A. Injection attacks target data input mechanisms, not login frequency.
• B. Viruses require user action to execute and don't typically cause a spike in login attempts.
• C. Worms self-replicate but would manifest differently, such as in network traffic or system processes, not just login counts.

Correct answer: D. Mandatory Access Control

Mandatory Access Control (MAC) enforces security policy through system-enforced restrictions that users cannot bypass voluntarily. It uses sensitivity labels on data and compares them to the clearance level of users accessing the system. This non-discretionary approach ensures compliance is not optional, preventing policy violations through user choice. RBAC uses roles, ABAC uses attributes beyond labels, and DAC allows user discretion, all mismatching the mandatory, label-based enforcement described.

Why the other options are wrong

• A. Role-based Access Control grants permissions based on user roles, not mandatory sensitivity labels.
• B. Attribute-based Access Control uses multiple attributes but doesn't specifically emphasize sensitivity labels and mandatory enforcement.
• C. Discretionary Access Control allows resource owners to determine access, which contradicts the non-voluntary enforcement described.

Correct answer: C. Sniffing

Sniffing attacks capture unencrypted data transmitted over networks. Cryptography prevents sniffing by encrypting data in transit, making captured packets unreadable to attackers who lack the decryption keys. This is a direct and effective mitigation of the sniffing threat.

Why the other options are wrong

• A. Buffer overflow exploits memory management vulnerabilities; cryptography does not prevent or mitigate buffer overflow exploitation, which requires code-level defenses.
• B. Web ripping involves unauthorized copying of web content; cryptography does not prevent this, as users downloading content can still copy it regardless of encryption during transit.
• D. DoS attacks overwhelm system resources through volume or algorithmic complexity; cryptography does not prevent or stop DoS attacks from consuming bandwidth or processing resources.

Correct answer: D. Management

Management makes the final decision on whether to take a system offline during incident containment. This decision involves business impact analysis, determining whether loss of service outweighs the risk of continued operation. While incident handlers recommend actions and security/IT teams execute them, management owns the business decision involving operational impact and risk acceptance.

Why the other options are wrong

• A. IT auditors assess controls but do not make operational containment decisions.
• B. Law enforcement may be involved in criminal incidents but does not control operational containment decisions.
• C. Incident handlers make recommendations, but management must authorize due to business impact.
• E. Security department implements decisions but management must authorize based on organizational risk tolerance.

Correct answer: D. SYN Floods

SYN floods are characterized by a high volume of half-open TCP connections (SYN packets without completion of the handshake), which directly creates large connection queues and consumes bandwidth. Monitoring for these specific conditions, queue depth and bandwidth from incomplete connections, is the primary defense against SYN flood attacks.

Why the other options are wrong

• A. Smurf attacks use ICMP echo requests and spoofed source addresses, not half-open TCP connections.
• B. Passive scans generate minimal traffic and don't create connection queues.
• C. CPUHog attacks target processor resources through computationally expensive operations, not connection queues.

Correct answer: D. Disable networking in a configuration file and map the sample's folder read-only

Windows Sandbox is a disposable, hypervisor-isolated desktop that is discarded when it closes, but it enables networking by default, so an untrusted program could still reach the internal network while it runs. The recommended approach for untrusted files is to start the sandbox with networking disabled through a configuration file and to map the folder holding the file in read-only mode. That keeps the sample away from the network and stops it from changing the host copy of the evidence.

Why the other options are wrong

• A. Disposability only removes changes after the session ends, while default networking still lets the sample reach the internal network during the run.
• B. Write access lets the sample modify, delete or encrypt the original evidence on the host.
• C. Letting the sample contact attacker infrastructure exposes the network and can alert the attacker that the sample is being examined.

Correct answer: D. DoS attack

A dramatic increase in broadcast traffic is a strong indicator of a DoS attack, particularly broadcast-based DoS attacks such as smurf attacks or UDP floods that generate excessive broadcast packets to overwhelm network capacity and consume bandwidth, degrading network performance.

Why the other options are wrong

• A. While some viruses may generate traffic, a sudden dramatic increase in broadcast traffic is more characteristic of a targeted DoS attack.
• B. SYN floods target specific hosts with unicast traffic, not broadcast traffic.
• C. A misconfigured router might cause some unusual traffic, but a dramatic spike in broadcasts is more indicative of an active attack than a configuration issue.

Correct answer: C. Wiping the contents of the hard disk with zeros.

The command loops 11 times, alternating between writing random data (/dev/random) and zero data (/dev/zero) to the hard drive (/dev/hda). This technique securely wipes the hard disk contents, making recovered data unrecoverable. By overwriting the disk multiple times with both random and zero patterns, Adam destroys evidence of his activities and the original data.

Why the other options are wrong

• A. Writing random and zero data does not create polymorphic virus strings.
• B. This command targets the physical hard drive, not log files specifically.
• D. The command writes to the disk; it does not copy from it for download purposes.

Correct answer: C. LLM10 Unbounded Consumption

Unbounded Consumption occurs when an LLM application allows excessive and uncontrolled inferences, leading to denial of service, economic losses, model theft or service degradation. Denial of Wallet is one of its listed examples: a high volume of operations exploits the cost-per-use model of cloud AI services. Mitigations include input size limits, rate limiting and per-user quotas, timeouts and throttling, and monitoring resource use for unusual patterns. MITRE ATLAS tracks the adversary's aim of driving up costs as Cost Harvesting.

Why the other options are wrong

• A. Supply chain risk concerns third-party models, packages and data, and nothing here involves a compromised component.
• B. Excessive agency involves an LLM taking damaging actions through tools, not a caller flooding the API.
• D. No sensitive data was exposed; the harm is the financial cost of uncontrolled usage.

Correct answer: D. Preparation

The Preparation stage of incident handling involves establishing policies, procedures, and infrastructure before incidents occur. This is where an organization decides on security standards, chooses appropriate technologies (like cable types), and establishes security policies for new extensions or infrastructure. The scenario describes preventive decision-making about networking setup and policy establishment, which is characteristic of the Preparation phase.

Why the other options are wrong

• A. Identification occurs when a security incident is detected; this scenario involves planning before incidents, not identifying them.
• B. Containment involves stopping an active incident from spreading; this scenario is about preventive setup, not responding to an incident.
• C. Eradication removes the threat after an incident; this scenario involves initial policy and infrastructure decisions before any incident occurs.

Correct answer: D. It grabs the /etc/passwd file when connected to UDP port 55555.

The command 'nc 55555 < /etc/passwd' connects netcat to port 55555 and redirects the contents of /etc/passwd file to that connection. This sends the /etc/passwd file data to UDP port 55555 when a connection is established. The '<' operator redirects file input to the netcat connection, effectively grabbing/transmitting the /etc/passwd file to the specified port.

Why the other options are wrong

• A. The command does not modify the /etc/passwd file; it only reads and transmits its contents.
• B. The command does not reset the file; it simply sends its contents to the network port.
• C. The command redirects the file to outgoing connections, not incoming connections.

Correct answer: B. IPsec

IPsec provides packet-level encryption and authentication for IP traffic, operating at the network layer to protect all communications between hosts. It is the standard protocol for securing LAN traffic at the packet level with encryption, integrity, and authentication services.

Why the other options are wrong

• A. PPTP operates at Layer 2 and is primarily used for VPN tunneling, not packet-level LAN encryption.
• C. PFS (Perfect Forward Secrecy) is a property of key exchange mechanisms, not a protocol that provides packet-level encryption.
• D. Generic tunneling protocols do not inherently provide packet-level encryption; they are transport mechanisms that can carry encrypted data.

Correct answer: D. Flooding

A flooding attack occurs when an attacker sends a large number of packets to a target computer, overwhelming its resources and causing a denial of service. This is the classic definition of a flood attack (like SYN flood, ICMP flood, etc.). Spoofing involves forging source addresses, snooping is passive eavesdropping, and phishing is social engineering via deceptive communications.

Why the other options are wrong

• A. Spoofing forges source addresses but does not inherently cause denial of service through packet volume.
• B. Snooping is passive eavesdropping and monitoring, not an active attack involving packet flooding.
• C. Phishing is a social engineering attack using deceptive communications, unrelated to packet flooding.

Correct answer: A. Rootkits

Rootkits are malware specifically designed to gain and maintain root/administrative privileges on a system, automatically obtaining full permissions while remaining hidden from detection. The description of software that automatically gains full permissions is the defining characteristic of rootkits, which operate at the kernel level to provide unrestricted system access.

Why the other options are wrong

• B. Viruses require user interaction to spread and don't automatically grant full permissions.
• C. Spyware focuses on surveillance and data theft, not on obtaining full system permissions.
• D. Adware displays advertisements and doesn't typically acquire elevated system permissions.

Correct answer: C. Install up to date anti-virus software on the host.

Up-to-date anti-virus software is the most effective defense against application-level backdoor trojans because it detects and removes known malware signatures and uses heuristic analysis to identify suspicious behavior. This provides comprehensive protection across the entire system regardless of how the malware attempts to execute.

Why the other options are wrong

• A. A personal firewall limiting outbound connections may help contain a backdoor after infection but cannot prevent initial infection of application-level trojans.
• B. Blocking all incoming connections does not protect against trojans delivered through user actions like downloads or email attachments.
• D. Blocking TCP ports 135-139 only prevents specific SMB exploitation vectors and does not protect against application-level backdoor trojans using other ports or delivery methods.

Correct answer: D. API10:2023 Unsafe Consumption of APIs, addressed by a redirect allowlist

Developers often trust data from integrated third-party APIs more than user input. OWASP's API10:2023 Unsafe Consumption of APIs covers an API that blindly follows redirections or fails to validate data received from other APIs. The fixes are to assess a provider's security posture, use TLS for every integration, validate and sanitize returned data before using it, and keep an allowlist of well-known locations an integrated API may redirect to instead of following redirects blindly.

Why the other options are wrong

• A. Server side request forgery starts from a URL supplied by the API's own user, while this destination came from a compromised partner's redirect.
• B. Object property authorization concerns users reading or changing sensitive object properties, not outbound requests sent to an attacker's domain.
• C. Function level authorization concerns users invoking functions their role should not reach, and no user role was involved in following the redirect.

Correct answer: D. Vulnerability enumerators

Vulnerability enumerators are specialized tools designed to scan networks and identify security vulnerabilities, misconfigurations, and weaknesses in network security. They go beyond basic enumeration to actively assess and report security issues.

Why the other options are wrong

• A. System enumerators identify system information but do not specifically assess vulnerabilities.
• B. Port enumerators identify open ports but do not assess overall network security vulnerabilities.
• C. Network enumerators gather information about network structure but do not specifically scan for security vulnerabilities.

Correct answer: C. Covert channel

Trojans typically use covert channels for communication to avoid detection by security systems and network monitoring tools. Covert channels allow hidden transmission of data through legitimate-looking network traffic or system mechanisms that are not intended for that purpose. Loop channels, open channels, and overt channels are not standard terminology for describing hidden Trojan communication; overt channels would actually be easily detectable, making them unsuitable for malicious purposes.

Why the other options are wrong

• A. Loop channel is not a recognized communication channel type used by Trojans.
• B. Open channels are publicly visible and monitored, making them unsuitable for Trojan command and control.
• D. Overt channels are openly visible and monitored by security systems, which is the opposite of how Trojans operate.

Correct answer: A, B, D. Fraggle attack; Smurf attack; Ping flood attack

Fraggle attack, Smurf attack, and Ping flood attack are all classic DoS attacks. Fraggle attacks use UDP packets, Smurf attacks use ICMP broadcasts, and Ping flood attacks overwhelm a target with ICMP echo requests. All three aim to consume bandwidth or resources to make services unavailable. Birthday attack is a cryptographic collision attack used in password cracking and hashing, not a network-based DoS attack.

Why the other options are wrong

• C. Birthday attack is a cryptographic attack used for breaking hashes and passwords, not a DoS attack targeting network availability.

Correct answer: A. It describes an attempt to transfer DNS zone data.

Reconnaissance includes zone transfer attempts, which is an attempt to transfer DNS zone data from a DNS server. This is a passive or active information gathering technique used by attackers to enumerate hosts and services on a target network.

Why the other options are wrong

• B. That definition describes a honeypot, not reconnaissance.
• C. That definition describes a backdoor or remote access tool, not reconnaissance.
• D. Half-open scanning describes a SYN scan technique, not reconnaissance as a whole.

Correct answer: A. Information Security representative

The Information Security representative is responsible for ensuring that the organization's security policies and information security requirements are enforced and followed during incident response activities. This role ensures that response actions align with security standards and policies. While Legal may handle compliance and liability, Human Resources handles personnel issues, and Technical representatives handle technical implementation, the Information Security representative specifically oversees policy enforcement during incidents.

Why the other options are wrong

• B. Legal representative focuses on compliance, liability, and legal implications rather than enforcing organizational security policies.
• C. Human Resources handles personnel-related matters and employment policies, not information security policy enforcement.
• D. Technical representative implements the response actions but does not ensure organizational policies are being followed.

Correct answer: B, C, D. Route analytics; SNMP-based approaches; Active Probing

Route analytics (B) analyzes network paths and routing information to understand network topology. SNMP-based approaches (C) query network devices using SNMP to discover topology and device relationships. Active probing (D) sends packets and analyzes responses to map network structure. These three techniques are standard for large-scale network mapping. Packet crafting (A) is a technique for creating custom packets used in various security tests but is not a primary network mapping methodology.

Why the other options are wrong

• A. Packet crafting is a tool technique used in security testing but is not itself a network mapping approach or methodology.

Correct answer: D. Compare the file's MD5 signature with the one published on the distribution media.

MD5 hashing provides cryptographic verification of file integrity. By comparing the MD5 signature of the downloaded software against the published hash on the official distribution media, Adam can definitively verify that the software has not been modified, corrupted, or trojaned. Any modification to the file will produce a different hash value.

Why the other options are wrong

• A. File size can be easily manipulated by trojaned software and is not a reliable indicator of authenticity.
• B. Version numbers can be spoofed by attackers and provide no cryptographic proof of integrity.
• C. Virus signatures only detect known malware; they won't catch zero-day trojans or malicious modifications not in the signature database.

Correct answer: C. Replacing the Is command

Replacing the ls command is the most effective method to hide files from a user. The ls command is the primary tool users employ to list directory contents. If an attacker replaces ls with a compromised version that filters out malicious files, the user would not see those files when listing directories. This is a common rootkit technique for maintaining persistence and hiding artifacts.

Why the other options are wrong

• A. Deleting find would be disruptive and users could still use ls to discover files; find is secondary to ls.
• B. Stopping syslog only hides logging of file operations but does not prevent users from viewing files directly in directories.
• D. Redirecting ps affects process visibility, not file visibility in directories.

Correct answer: C. Egress network

Egress network traffic refers to data flowing outbound from a network toward external networks or the internet. The term 'egress' literally means 'exit' and is the standard networking terminology for outbound traffic originating from inside the network perimeter.

Why the other options are wrong

• A. Ingress describes network traffic flowing inward, from outside the network perimeter toward the inside.
• B. Inwards network is not standard networking terminology for traffic direction.
• D. Outwards network is not the correct technical term; the proper term is 'egress.'

Correct answer: D. MAC spoofing

MAC spoofing allows attackers to change their Media Access Control address to impersonate another computer on the network, thereby bypassing MAC-based access control lists and network restrictions. This attack operates at Layer 2 (data link layer) and is particularly effective against networks relying on MAC filtering for access control, allowing attackers to either hide their identity or assume another computer's identity.

Why the other options are wrong

• A. IP address spoofing operates at Layer 3 and forges source IP addresses but does not directly bypass MAC-based access control lists.
• B. VLAN hopping exploits VLAN configuration weaknesses but is a different attack vector than MAC address manipulation.
• C. ARP spoofing manipulates ARP tables for man-in-the-middle attacks but does not directly bypass access control lists through address masquerading.

Correct answer: D. nmap -sO

The -sO switch in nmap performs IP protocol scanning, which enumerates different IP protocols (TCP, UDP, ICMP, etc.) supported by the target rather than scanning ports. This directly addresses the objective of retrieving as many different protocols as possible being used by the server, making it the correct choice for protocol discovery during information gathering.

Why the other options are wrong

• A. -vO is not a valid nmap combination; -v is for verbosity and -O is for OS detection, not protocol enumeration.
• B. -sS performs TCP SYN port scanning to identify open ports, not to enumerate protocols.
• C. -sT performs TCP connect scanning to identify open ports, not to enumerate protocols.

Correct answer: D. Incident response policies

Incident response policies specifically define roles, responsibilities, and procedures for responding to security incidents, including who is responsible for each aspect of the response. These policies establish the organizational structure and accountability framework for incident handling.

Why the other options are wrong

• A. Disaster management policies address business continuity and recovery, not incident response roles.
• B. Incident response manuals provide procedural guidance but policies are the authoritative documents establishing responsibility.
• C. Disaster management manuals focus on recovery procedures rather than incident response role assignment.

Correct answer: A. wget

wget is a command-line utility specifically designed to download files and web pages from websites to a local system. It supports recursive downloads, can mirror entire websites, and is widely used for web scraping and archiving. jplag is a plagiarism detection tool, Nessus is a vulnerability scanner, and Ettercap is a network security tool for man-in-the-middle attacks.

Why the other options are wrong

• B. jplag is used for detecting plagiarism in code and documents, not downloading web pages.
• C. Nessus is a vulnerability assessment scanner, not a web download tool.
• D. Ettercap is a network sniffing and manipulation tool used for security testing, not web page downloading.

Correct answer: B. Logic bomb

A logic bomb is a malicious code segment that executes automatically when a predetermined condition or event occurs. Unlike other malware types, logic bombs remain dormant until their trigger condition is met, such as a specific date, time, system event, or user action. Once the triggering event happens, the malicious payload activates and executes its payload.

Why the other options are wrong

• A. A Trojan horse typically requires user interaction to execute or spread; it is not automatically triggered by events.
• C. MAC (Mandatory Access Control) is a security model for controlling access to resources, not executable malware.
• D. Worms autonomously replicate and spread continuously, not based on predetermined events.

Correct answer: D. Have the data owner verify the system before it is placed back in production

Before returning a compromised system to production, the data owner or system owner should verify that the system is secure, properly restored, and functioning as intended. This validation step is a fundamental best practice across all incident types and ensures accountability and system integrity before operational use resumes.

Why the other options are wrong

• A. While logging implementation is valuable, it is a hardening step, not a universal recovery practice required for all incident types.
• B. Monitoring for C2 traffic is part of detection and containment, not the recovery phase.
• C. Executive summary validation is important but occurs during reporting, not recovery, and is not specific to all incident types.

Correct answer: A. Find alternate data streams

LADS (List Alternate Data Streams) is a tool specifically designed to find alternate data streams (ADS) in NTFS file systems. Alternate data streams are hidden data attached to files that can be used by malware to hide code or data. The /S flag recursively searches the specified directory. Detecting rootkits requires different tools like kernel debuggers or rootkit detection utilities. Stopping processes requires process management tools. Removing malicious DLLs requires deletion tools, not stream enumeration.

Why the other options are wrong

• B. Detecting user-mode rootkits requires rootkit-specific detection tools, not ADS enumeration.
• C. Stopping processes is done with taskkill or similar process management tools, not LADS.
• D. Removing malicious files is done with deletion/cleanup tools, not by analyzing alternate data streams.

Correct answer: C, D, F, G, H. Brute force attack; Social engineering; Rainbow attack; Password guessing; Dictionary-based attack

Given that Andrew used 'Faulkner' (a dictionary word and personally identifiable information) as his password, multiple password-cracking methods could have been effective: Brute force attack tries all possible combinations, Social engineering exploits personal information he publicly shared, Rainbow attack uses precomputed hash tables, Password guessing tries logical variations of personal data, and Dictionary-based attack matches against word lists. DoS attacks and buffer-overflow attacks are not password-cracking methods but system attacks. Zero-day attacks exploit unknown vulnerabilities, not password weaknesses.

Why the other options are wrong

• A. Denial-of-service attacks disrupt service availability but do not crack passwords.
• B. Zero-day attacks exploit unknown vulnerabilities, not weak passwords.
• E. Buffer-overflow attacks exploit memory vulnerabilities, not password security.

Correct answer: C. A backdoor the intruder created so that he can re-enter the network.

An odd non-administrative account with remote access permissions discovered after an intrusion is almost certainly a backdoor created by the intruder to maintain persistent access to the network even after the initial breach is discovered. This is a standard post-exploitation technique allowing the attacker to re-establish access at will without going through the initial compromise vector again.

Why the other options are wrong

• A. Privilege escalation involves elevating existing account permissions, not creating new accounts with remote access.
• B. This explanation would be valid in normal circumstances, but context (finding it immediately after stopping an intrusion) makes a backdoor far more likely.
• D. IP spoofing is an attack technique unrelated to unauthorized account creation.

Correct answer: C. It is a condition in which an application receives more data than it is configured to accept.

A buffer overflow is a condition in which an application receives or writes more data than it is configured to accept, causing data to overflow into adjacent memory and potentially corrupting other data or enabling arbitrary code execution. Option A describes credential management systems, B describes software update packages, and D describes malware warnings, none of which relate to buffer overflows.

Why the other options are wrong

• A. Managing security credentials and public keys is the function of cryptographic systems, not buffer overflows.
• B. Collections of files for software updates are unrelated to buffer overflow vulnerabilities.
• D. False virus warnings are malware alerts, not technical descriptions of buffer overflow conditions.

Correct answer: C. A worm is self replicating, while a Trojan horse is not.

The fundamental difference between a worm and a Trojan horse is that a worm is self-replicating and can spread autonomously across networks, while a Trojan horse is a non-replicating malicious program that relies on social engineering or deception to be installed. Worms do not need user intervention once they begin spreading, whereas Trojan horses are static pieces of malware.

Why the other options are wrong

• A. Both worms and Trojans can spread via email; email is not exclusive to worms.
• B. Both worms and Trojan horses are forms of malicious programs, not utilities.
• D. Both are malicious programs; neither is antivirus software.

Correct answer: A, D. Anti-replay; Anti-spoofing

Authentication Headers (AH) in IPSec provide two key functions: authentication of the data origin (which enables anti-spoofing by verifying the sender) and anti-replay protection through sequence numbering. However, AH does not provide encryption of IP packets, that is the role of the Encapsulating Security Payload (ESP). AH does not directly authenticate individual users but rather authenticates the IP packets themselves.

Why the other options are wrong

• B. IP packet encryption is provided by ESP (Encapsulating Security Payload), not by Authentication Headers.
• C. AH provides packet-level authentication, not user-level authentication; user authentication is a separate concern handled at different OSI layers.

Correct answer: B. Session Hijacking

Session hijacking is the technique of taking control of an established session between a client and server, particularly with unencrypted protocols like TELNET and FTP. The attacker intercepts and takes over the communication stream after authentication occurs, allowing them to execute commands or access resources with the victim's privileges.

Why the other options are wrong

• A. Dictionary attacks target password authentication by trying common words and phrases, not by taking control of active sessions.
• C. Trojan horses are malicious programs that must be installed on a system; they don't inherently take control of network sessions between existing client-server connections.
• D. Social engineering manipulates people into divulging confidential information or taking certain actions; it doesn't directly take control of TCP/IP sessions.

Correct answer: C. Reconnaissance

Reconnaissance is the first phase of hacking where an attacker gathers information about a target without directly interacting with systems. Analyzing a company's career page to identify their technology stack (Windows Server 2003, Active Directory) is classic reconnaissance, passive information gathering used to profile the target organization. Scanning involves active probing, covering tracks involves erasing evidence post-attack, and gaining access involves actual exploitation, none of which apply here.

Why the other options are wrong

• A. Scanning involves active probing of systems with tools, not passive information gathering from public web pages.
• B. Covering tracks occurs after a successful attack to remove evidence, not during the initial information gathering phase.
• D. Gaining access requires active exploitation of vulnerabilities, which comes after reconnaissance and scanning phases.

Correct answer: E. Covering tracks

Accessing and modifying logs in 'Documents and Settings\logs' represents the attacker attempting to cover their tracks by altering evidence of their intrusion. This is the final phase of the attack lifecycle where attackers remove or manipulate audit trails and logs to hide indicators of compromise.

Why the other options are wrong

• A. Establishing a backdoor involves creating persistent remote access mechanisms, not accessing existing logs.
• B. Using steganography is a data hiding technique unrelated to accessing system logs.
• C. Initial reconnaissance involves information gathering before an attack, not post-intrusion log access.
• D. Port scanning occurs during early attack phases for network discovery, before system access is gained.

Correct answer: A. Despoof

Despoof is a Linux-based tool designed specifically to detect and alert on IP spoofing attacks by analyzing packet source addresses. Dsniff is a network sniffing tool for capturing traffic. Ethereal (now Wireshark) is a packet analyzer for viewing captured traffic. Neotrace is a traceroute utility; none of these are designed to detect IP spoofing attacks.

Why the other options are wrong

• B. Dsniff is a network sniffing tool for capturing and analyzing traffic, not for detecting IP spoofing attacks.
• C. Ethereal is a packet analyzer for examining captured packets but is not designed to detect IP spoofing attacks.
• D. Neotrace is a traceroute utility for network path analysis, not for detecting IP spoofing attacks.

Correct answer: A. Denial-of-Service

A Denial-of-Service attack floods a target with excessive network traffic or requests, causing performance degradation and service unavailability. The significant increase in network traffic observed in System Monitor is a classic indicator of a DoS attack affecting database performance.

Why the other options are wrong

• B. Injection attacks manipulate queries or code execution but don't typically cause widespread network traffic increases as the primary symptom.
• C. Internal attacks by authorized users usually target specific data and don't manifest as generalized network traffic spikes affecting overall performance.
• D. While viruses can degrade performance, they don't typically cause the specific symptom of increased network traffic in a database scenario.

Correct answer: D. A stateful inspection firewall

When the same IP address appears in consecutive traceroute hops (hops 19 and 20 both showing www.example.com at 65.195.239.22), this typically indicates a stateful inspection firewall is present. Stateful firewalls maintain connection state and can appear as the same hop multiple times because they monitor and respond to the traceroute probes while maintaining established connection information. Application firewalls and IDS systems would typically block or significantly alter the traceroute output differently. A Network Intrusion Prevention System would similarly behave differently.

Why the other options are wrong

• A. Application firewalls would typically block traceroute entirely or show different behavior than identical consecutive hops.
• B. An Intrusion Detection System monitors traffic but would not typically cause identical consecutive hops in traceroute output.
• C. A Network Intrusion Prevention System would block or alter traceroute differently than what is shown in the output.

Correct answer: C. Excessive permissions

OWASP splits the root causes of Excessive Agency into excessive functionality, excessive permissions and excessive autonomy. When an extension built to act for one user reaches downstream systems with a generic high-privileged identity, the problem is excessive permissions, because the extension can touch far more data than its task requires. The remedy is to execute extensions in the user's own context, for example through OAuth with the minimum scope, so actions on the user's behalf carry only that user's privileges.

Why the other options are wrong

• A. Excessive functionality means the extension exposes functions the task does not need, such as delete or send, rather than an overprivileged identity.
• B. Excessive autonomy means high-impact actions run without independent verification or user approval, which is not the flaw described.
• D. Improper output handling concerns unvalidated model output passed to downstream components, not the identity an extension uses.

Correct answer: D. smbclient

Smbclient is the command-line tool used to access Windows resources (shares, printers, files) from a Linux workstation. It implements the SMB/CIFS protocol, which is the native file sharing protocol used by Windows systems. This tool allows Linux users to browse and interact with Windows network resources directly from the command line.

Why the other options are wrong

• A. Mutt is an email client for Linux, not a tool for accessing Windows network resources.
• B. Scp is a secure copy utility for transferring files between systems over SSH, not specifically for accessing Windows network shares.
• C. Rsync is a file synchronization utility that can work across platforms but is not the standard tool for accessing Windows shares.

Correct answer: D. Loki

Loki is a specific hacking tool designed to provide shell access and covert communication over ICMP (Internet Control Message Protocol) packets, which are typically used for ping and network diagnostics. By tunneling shell commands through ICMP, Loki can bypass standard firewall rules that may block TCP/UDP traffic. John the Ripper is a password cracking tool, Nmap is a port scanner, and Nessus is a vulnerability scanner, none of which provide shell access over ICMP.

Why the other options are wrong

• A. John the Ripper is a password cracking and hash analysis tool, not a shell access mechanism.
• B. Nmap is a network discovery and port scanning tool, not designed for shell access.
• C. Nessus is a vulnerability assessment scanner, not a tool for establishing shell connections.

Correct answer: A. API5:2023 Broken Function Level Authorization

Broken function level authorization occurs when a user can invoke a function that their role should never reach, such as an administrative export, often just by guessing the endpoint or changing the HTTP method. OWASP warns against deciding whether an endpoint is administrative from its URL path, because admin functions often sit beside regular ones. The prevention is a consistent authorization module that denies all access by default and requires explicit grants to specific roles for every function.

Why the other options are wrong

• B. Broken object level authorization is access to another user's record through an endpoint the user is entitled to call, while here the whole function should have been off limits.
• C. Broken object property level authorization concerns reading or changing individual sensitive properties of an object, not invoking an administrative function.
• D. Security misconfiguration covers hardening gaps such as missing TLS, verbose errors or unneeded features, not a missing role check on a business function.

Correct answer: C, D. Dictionary attack; Brute Force attack

The password 'apple' is vulnerable to dictionary attack because it is a common word found in standard password dictionaries, making it easily crackable through dictionary lookup. It is also vulnerable to brute force attack since any password can eventually be discovered through exhaustive key searching, though dictionary attack would succeed much faster. Hybrid and rule-based attacks would also eventually work but are less direct than dictionary attack for common words.

Why the other options are wrong

• A. While a hybrid attack could eventually crack 'apple', it is not the most direct method for this common word.
• B. Rule-based attacks work by applying transformation rules but are less efficient than dictionary lookup for simple dictionary words.

Correct answer: B. Denial of Service

Connecting the echo service (which reflects back received data) to the chargen service (which generates continuous character streams) creates an amplification loop that consumes all available bandwidth. This is a classic Denial of Service attack that floods the network with traffic between two services.

Why the other options are wrong

• A. Smurf attacks use ICMP echo requests directed to broadcast addresses, not echo-to-chargen service connections.
• C. Evil Twin refers to rogue wireless access points impersonating legitimate networks, not bandwidth exhaustion.
• D. A virus is self-replicating malware; this describes a network-based attack, not malware.

Correct answer: A. Quotes (', ", etc.)

When conducting SQL injection attacks, attackers typically begin experimenting with quote characters (single quotes, double quotes, etc.) because these are the primary delimiters used in SQL syntax to define string boundaries. By inserting quotes, attackers can break out of the intended SQL query structure and inject their own commands. This is the most fundamental and obvious starting point for SQL injection testing.

Why the other options are wrong

• B. Alphabetic characters alone do not have special meaning in SQL syntax and would not reveal SQL injection vulnerabilities.
• C. Numeric characters alone cannot break SQL syntax or demonstrate injection capability.
• D. Percent signs (%) are SQL wildcards used in LIKE clauses but are not the primary starting point for discovering SQL injection vulnerabilities.

Correct answer: C. A court order

Before rendering assistance to law enforcement, an organization should require a court order to ensure proper legal authorization. A court order provides statutory authorization and protection for the organization, documenting that the request is lawful and binding.

Why the other options are wrong

• A. A memorandum of agreement is an internal arrangement; it doesn't provide legal authority over external requests.
• B. A verbal request alone lacks legal standing and documentation.
• D. A non-disclosure agreement protects confidentiality but does not establish legal authority for law enforcement requests.

Correct answer: C. Firewalking

Firewalking is a technique that uses TTL (Time To Live) values in packets to map out firewall rules and identify open ports. By sending SYN packets with the target system's TTL starting at port 1 and incrementing to port 1024, an attacker can determine which ports are allowed through the firewall based on which packets reach the destination. Port scanning discovers open ports, cloaking hides malicious activity, and spoofing falsifies source addresses.

Why the other options are wrong

• A. Port scanning discovers open ports directly, but firewalking specifically uses TTL values to map firewall rules.
• B. Cloaking refers to hiding malicious content or activity, not using TTL values to probe firewalls.
• D. Spoofing involves falsifying source addresses, not using TTL values for firewall reconnaissance.

Correct answer: D. Hide TCP connections within ICMP traffic

Since the attackers can ping their external host (ICMP works), but cannot establish TCP connections, they should tunnel TCP traffic within ICMP packets. This allows them to covertly send data through the ICMP protocol that they've confirmed is unblocked. Tools like ICMP tunneling can encapsulate TCP data within echo requests and replies. ASCII files in TCP headers is not a viable technique. Tunneling through SSH requires SSH connectivity which they don't have. A reverse HTTP shell requires outbound HTTP/HTTPS which appears to be blocked.

Why the other options are wrong

• A. TCP/IP headers have limited space and cannot reliably carry meaningful data payloads.
• B. SSH tunneling requires SSH connectivity, which the attackers cannot establish based on the scenario.
• C. A reverse HTTP shell requires outbound HTTP connectivity, which appears to be blocked in their situation.

Correct answer: A, B, D. The attacker sends a succession of SYN requests to a target system; SYN flood is a form of Denial-of-Service (DoS) attack; SYN cookies provide protection against the SYN flood by eliminating the resources allocated on the target host.

A SYN flood attack works by sending a succession of SYN requests (A is correct), and it is indeed a form of Denial-of-Service attack (B is correct). SYN cookies protect against this by encoding connection state in the initial sequence number, allowing the server to handle the connection without allocating full resources, thus eliminating resource exhaustion (D is correct). Option C is incorrect because SYN flood attacks send SYN packets, not ACK packets, and the attack doesn't involve sending thousands of ACKs.

Why the other options are wrong

• C. SYN flood attacks send SYN packets to initiate half-open connections, not ACK packets, and the mechanism is completely different from what is described.

Correct answer: C. 0xFFFFFFFFFFFF

The broadcast MAC address in networking is 0xFFFFFFFFFFFF (or FF:FF:FF:FF:FF:FF in standard notation), which represents all bits set to 1. This address is used to send frames to all devices on the local network segment. When performing ARP spoofing or Man-in-the-Middle attacks, attackers use broadcast frames with this destination MAC address to reach all hosts on the network.

Why the other options are wrong

• A. 0xDDDDDDDDD is not a valid or standard MAC address format.
• B. 0x00000000000 represents a null or reserved address, not a broadcast address.
• D. 0xAAAAAAAAAA is not the broadcast MAC address.

Correct answer: C. Smurf attack

A Smurf attack is a distributed denial-of-service attack where an attacker sends ICMP broadcast packets (ping requests) to a network's broadcast address with the source IP spoofed to be the victim's address. Network devices and hosts respond to the broadcast, sending replies back to the spoofed source address, overwhelming the victim's server with traffic. This creates a flood of return traffic amplified across the entire broadcast network.

Why the other options are wrong

• A. A SYN flood attack exploits the TCP three-way handshake by sending numerous SYN packets, not broadcast echo replies like a Smurf attack.
• B. Bluejacking is a Bluetooth-based attack involving unauthorized access to wireless devices, completely unrelated to broadcast packet flooding.
• D. IP spoofing is a technique used in Smurf attacks, but IP spoofing alone does not describe the specific attack pattern of broadcast amplification described in the question.

Correct answer: B. Allow-listing permitted destinations, schemes and ports, and not returning raw responses

The API fetched a resource from a user-supplied URL without validating it, which is API7:2023 Server Side Request Forgery. Cloud providers, Kubernetes and Docker expose management channels over HTTP on predictable, well-known paths, so SSRF can reach credentials that are never exposed to the internet. OWASP recommends isolating the fetching mechanism, using allow lists of remote origins, URL schemes and ports, disabling HTTP redirections, and never sending raw responses back to clients.

Why the other options are wrong

• A. The status code used for unknown webhook IDs has no effect on which destination the server requests.
• C. Re-authentication protects sensitive account changes but still lets an authenticated customer supply an internal URL.
• D. Pagination limits how many records a response returns and has no effect on where the server sends outbound requests.

Correct answer: B. Sigcheck

Static analysis examines a sample without executing it, and Sigcheck fits that step: it reports a file's version number, timestamp information and digital signature details, including certificate chains, and can also show file hashes. An unsigned file, or one whose signer does not match the publisher it claims, is a useful early lead. Process Monitor and TCPView only show activity once something is running, which belongs to dynamic analysis performed later in an isolated environment.

Why the other options are wrong

• A. Process Monitor shows real-time file system, registry and process activity, so it only helps once the sample is running.
• C. TCPView lists the TCP and UDP endpoints of running processes, which is dynamic observation, not inspection of the file itself.
• D. Windows Sandbox is an isolated environment for running files, which is the dynamic stage rather than examining the file at rest.

Correct answer: C. The zombie computer is the system interacting with some other system besides your computer.

In an idle scan, the IPID (IP identification field) should only increment predictably when the zombie responds to spoofed packets from the target. If the IPID increments on every query regardless of target response, or increments by irregular amounts, the zombie computer is generating its own traffic to other systems, making it unsuitable for idle scanning. This causes false positives and breaks the scan methodology.

Why the other options are wrong

• A. A firewall would block the scan entirely, not cause erratic IPID increments.
• B. Connectivity issues would prevent the scan from working at all, not cause this specific IPID behavior.
• D. Hping is fully capable of performing idle scans; the issue is with the zombie selection.

Correct answer: C. Set metadata token usage to required so that only IMDSv2 is accepted

IMDSv2 is session oriented: a client must first send a PUT request to obtain a token and then include that token in every GET request. When token usage is set to required, IMDSv1 calls fail and requests without a valid token receive 401 Unauthorized, so a simple SSRF that can only trigger GET requests cannot retrieve role credentials. IMDSv2 also rejects PUT requests that contain an X-Forwarded-For header, which blocks many requests passed through open reverse proxies.

Why the other options are wrong

• A. The PUT response hop limit is already 1 by default and does not make token-less IMDSv1 GET requests fail.
• B. Leaving IMDSv1 available is exactly what lets token-less GET requests keep returning metadata.
• D. The application reaches the metadata service from inside the instance at 169.254.169.254, so removing internet access does not stop the SSRF request.

Correct answer: D. Set the storage account's AllowBlobPublicAccess property to False

Anonymous access in Azure Blob Storage is controlled at two levels: a container setting and a storage account setting. Disallowing anonymous access on the account, by setting AllowBlobPublicAccess to False, overrides every container setting. Azure Storage then rejects all anonymous read requests, containers already configured for anonymous access stop accepting them, and users cannot configure anonymous access on new containers. Logs and metrics can first show which containers are being read anonymously so legitimate uses can be moved.

Why the other options are wrong

• A. Anonymous requests present no key at all, so rotating the account keys leaves anonymous container access unchanged.
• B. Soft delete protects data against deletion and does not restrict who can read it.
• C. Handing out a SAS gives applications authorized access but leaves the existing anonymous access on the containers in place.

Correct answer: C. Rainbow Tables cannot be used to crack the password

Salting password hashes prevents the use of rainbow tables, which are precomputed hash tables mapping common passwords to their hashes. By adding a unique salt value to each password before hashing, the same plaintext password produces different hashes, rendering precomputed rainbow tables ineffective. This is the primary security benefit of salting.

Why the other options are wrong

• A. Salting does not provide encryption; hashing and encryption are different mechanisms.
• B. Salting does not enforce particular encryption algorithms; it works with any hashing algorithm.
• D. Dictionary attacks work through repeated hashing attempts in real-time and are not prevented by salting alone.

Correct answer: A. Backdoor

A backdoor is a program or mechanism that bypasses normal authentication procedures to provide unauthorized remote access to a computer system. It is specifically designed to circumvent standard security controls and allow attackers to gain access without proper credentials.

Why the other options are wrong

• B. Worms are self-replicating malware that spread across networks, not authentication bypass tools.
• C. Adware displays advertisements and is not used for remote access authentication bypass.
• D. Spyware monitors user activity and steals information; it does not bypass authentication for remote access.

Correct answer: A. Use of the manual method of telnet to each of the open ports.

Manual telnet connections to open ports (A) provide the most accurate method for identifying services because they allow direct interaction with the service banner and protocol responses. Telnet reveals authentic service information, version details, and protocol specifics through actual communication. While port scanners and vulnerability scanners provide useful data, they rely on signature matching and can produce false positives. The manual telnet method provides definitive confirmation through direct service interrogation.

Why the other options are wrong

• B. Port scanners rely on signature databases and assumptions; they can misidentify services and produce false positives.
• C. Hit and trial guessing is unreliable and inefficient for accurate service identification.
• D. Vulnerability scanners attempt probing but rely on signatures and heuristics, less accurate than direct service interrogation via telnet.

Correct answer: A. Point the domain name to the IP address of a secondary, patched production server

By pointing the domain name to a secondary, patched production server, the organization maintains service availability for users while isolating the compromised server from handling legitimate traffic. This approach allows continuous observation of the attacker on the compromised system while providing uninterrupted service through an uncompromised alternative.

Why the other options are wrong

• B. Changing the IP address does not isolate the server or provide continuity of service.
• C. While isolation is important, quarantining to a separate VLAN interrupts service to users who depend on the Extranet as their browser homepage.
• D. Rebuilding during downtime stops the ability to watch the attacker and disrupts business services.

Correct answer: A. Replay attack

Adam is performing a replay attack by capturing an encrypted ARP request packet and re-injecting it hundreds of times per second back onto the network. Each retransmission causes the wireless host to respond with new encrypted packets using different initialization vectors (IVs). This is the classic replay attack pattern used to generate enough encrypted traffic to crack WEP encryption.

Why the other options are wrong

• B. MAC Spoofing involves forging MAC addresses, not replaying captured packets.
• C. Caffe Latte attack targets wireless clients disconnected from networks, not the replay of captured packets.
• D. Network injection attack is too generic; the specific technique of replaying captured packets to generate responses is a replay attack.

Correct answer: A. Brute force

Disabling passwords after four failed login attempts is a classic countermeasure against brute force attacks, which rely on multiple password guesses. By limiting the number of attempts an attacker can make, the organization prevents attackers from exhausting password combinations.

Why the other options are wrong

• B. Replay attacks involve reusing captured authentication credentials, not attempting multiple password guesses.
• C. Cross-site scripting (XSS) is a web application vulnerability involving script injection, unrelated to login attempt limits.
• D. Cookie poisoning involves tampering with cookies, not trying multiple passwords.

Correct answer: D. Nmap

Nmap is used for active OS fingerprinting, where it actively probes the target system by sending crafted packets. NetworkMiner, Satori, and p0f are all passive OS fingerprinting tools that identify operating systems by analyzing network traffic without sending probes.

Why the other options are wrong

• A. NetworkMiner is a passive OS fingerprinting tool.
• B. Satori is a passive OS fingerprinting tool.
• C. p0f is a passive OS fingerprinting tool.

Correct answer: A, B, C. SQLBF; SQLDict; FindSA

SQLBF, SQLDict, and FindSA are all recognized tools for performing brute force attacks against remote databases. SQLBF and SQLDict are specifically designed for SQL Server password cracking, while FindSA targets SQL Server SA (system administrator) accounts. Nmap is a network scanner used for port scanning and network discovery, not database brute force attacks.

Why the other options are wrong

• D. Nmap is a network reconnaissance and port scanning tool, not designed for database credential brute forcing.

Correct answer: B. Blended threat

A blended threat is defined as malware that combines multiple attack vectors and capabilities, including multiple trigger mechanisms and replication methods. It typically combines characteristics of viruses, worms, and trojans. Macro viruses, boot sector viruses, and trojans are individual malware types with specific characteristics, not the comprehensive multi-vector threat that blended threats represent.

Why the other options are wrong

• A. Macro viruses are limited to spreading through macro-enabled documents with a single replication method.
• C. Trojans do not typically replicate themselves; they rely on user action or other means for distribution.
• D. Boot sector viruses infect the boot sector specifically and have limited trigger and task capabilities compared to blended threats.

Correct answer: C. DNS poisoning

DNS poisoning is the attack method where an attacker distributes incorrect IP addresses by corrupting DNS cache or responses. When users query a domain name, they receive a false IP address pointing to the attacker's server instead of the legitimate destination. IP spoofing involves forging source IP addresses in packets, MAC flooding involves overwhelming a switch's MAC table, and MITM intercepts communications without necessarily distributing incorrect addresses.

Why the other options are wrong

• A. IP spoofing forges the source IP address in packet headers, not distributing incorrect addresses to users.
• B. MAC flooding overwhelms a switch's MAC address table and does not involve IP address distribution.
• D. MITM attacks intercept and relay communications but do not inherently distribute incorrect IP addresses.

Correct answer: D. sniffer

A sniffer (packet sniffer) can detect session hijacking by capturing and analyzing network traffic to identify anomalous patterns, such as unexpected sequence numbers, out-of-order packets, or duplicate acknowledgments that indicate session hijacking. Nmap is a port scanner, Brutus is a password cracking tool, and ntop is a network monitoring tool, while ntop could help with traffic analysis, a sniffer is the most direct and appropriate tool for detecting hijacking at the packet level.

Why the other options are wrong

• A. Nmap is a port scanning tool used for network discovery and enumeration, not for detecting active session hijacking.
• B. Brutus is a password cracking and brute-force tool, not designed to detect session hijacking attacks.
• C. Ntop is a network traffic monitoring tool, but it is not specifically designed or commonly used for detecting session hijacking attacks.

Correct answer: B. Indirect object reference map

An indirect reference map replaces direct identifiers, such as database keys or account numbers, with values that only have meaning for the current user or session. The server resolves them to real objects, so a value copied from another user's list cannot select an object outside the requester's own map. OWASP's Authorization Cheat Sheet recommends user or session specific indirect references alongside avoiding exposed identifiers and performing access control checks on every request for the specific object.

Why the other options are wrong

• A. Deny by default means access is refused unless a rule explicitly grants it; it does not describe translating identifiers.
• C. The translation happens on the server, and client-side checks must never be the deciding access control.
• D. RBAC grants permissions through roles and does not by itself hide or remap object identifiers.

Correct answer: A. Scrub or mask sensitive content before data is used for training

This is Sensitive Information Disclosure (LLM02): personal data included in training resurfaced in model output. OWASP's first sanitization measure is to integrate data sanitization so user data does not enter the training model, which includes scrubbing or masking sensitive content before it is used in training. Supporting controls include least-privilege access to data sources, tokenization and redaction of confidential content, and clear policies that let users opt out of having their data used for training.

Why the other options are wrong

• B. System prompt restrictions may not always be honored and can be bypassed by prompt injection, while the data would remain in the model.
• C. Rate limiting caps request volume but does not stop a single reply from containing memorized personal data.
• D. Signing and hashing confirm model integrity and provenance, which is a supply chain control rather than a privacy control over training content.

Correct answer: C. Hardware keylogger

Hardware keyloggers are physical devices placed between a keyboard and computer that cannot be detected by anti-virus or anti-spyware products because they operate entirely outside the software layer. Since they are physical hardware interception devices, they leave no software signatures for security tools to detect.

Why the other options are wrong

• A. Kernel keyloggers operate at the OS kernel level in software and can be detected by anti-virus and anti-spyware tools that scan kernel memory and processes.
• B. Software keyloggers run as programs within the operating system and can be detected by anti-virus and anti-spyware products through signature and behavioral analysis.
• D. OS keyloggers are software-based components that operate at the operating system level and can be detected by security scanning tools.

Correct answer: A, D. mysql_real_escape_string(); Prepared statement

Prepared statements (D) are the most effective defense against SQL injection because they separate SQL code from data, preventing user input from being interpreted as code. mysql_real_escape_string() (A) escapes special characters in user input before it's used in SQL queries, preventing injection attacks. session_regenerate_id() is for session fixation protection, and mysql_escape_string() is deprecated and less reliable than real_escape_string().

Why the other options are wrong

• B. session_regenerate_id() addresses session fixation attacks, not SQL injection.
• C. mysql_escape_string() is deprecated and does not provide adequate protection against all SQL injection variants.

Correct answer: B. Replay attack

A replay attack captures valid authentication data (such as password hashes, tokens, or session credentials) during network transmission and reuses that captured data to gain unauthorized access without needing to crack or decrypt the original credentials. The attacker simply replays the intercepted authentication material to impersonate a legitimate user.

Why the other options are wrong

• A. Cross-site scripting attacks inject malicious scripts into web pages, not capture and reuse authentication hashes.
• C. Rainbow attacks involve precomputed hash tables to crack passwords, requiring decryption/decoding of hashes.
• D. Hashing attacks are a broad category that includes various methods but don't specifically describe the capture-and-reuse mechanism.

Correct answer: D. It is a temporary AWS STS access key that is used together with a session token

IAM marks every unique ID with a type prefix. AKIA identifies a long-term access key, while ASIA identifies a temporary access key issued by AWS STS, which works only in combination with its secret access key and a session token. Recognizing the prefix tells the handler that the activity came from a short-lived STS session rather than a stored user key, so the investigation follows how that session was obtained instead of starting with a user's long-term key.

Why the other options are wrong

• A. Long-term access keys carry the AKIA prefix, not ASIA.
• B. IAM role unique IDs carry the AROA prefix.
• C. EC2 instance profile unique IDs carry the AIPA prefix.

Correct answer: C. AS PATH Inference

AS PATH Inference is an internet mapping technique that uses BGP (Border Gateway Protocol) collectors to gather routing updates and routing tables, then infers autonomous system paths from this data. Various public BGP collectors worldwide collect and share this information for network analysis and internet topology research.

Why the other options are wrong

• A. AS Route Inference is not the standard term; AS PATH Inference is the recognized technique.
• B. PMTUD (Path MTU Discovery) is a mechanism for determining maximum transmission unit sizes, not an internet mapping technique.
• D. Firewalking is a technique for mapping firewall rules and network topology, not based on BGP collectors.

Correct answer: A. wtmp

The wtmp file (located in /var/log/wtmp) contains records of all successful user logins and logouts on Unix/Linux systems. It is a binary file that tracks login history and is consulted by the 'last' command. This file is essential for audit trails showing past successful authentication events.

Why the other options are wrong

• B. btmp contains failed login attempts, not successful logins.
• C. ctmp is not a standard Unix system file for login tracking.
• D. utmp tracks currently logged-in users in real-time, not past successful logins.

Correct answer: C, D. Place the directory containing nikto.pl in root's PATH environment variable; Restart nessusd service.

To integrate Nikto with Nessus, you must place the directory containing nikto.pl in the root user's PATH environment variable (C) so Nessus can locate and execute the Nikto script, and then restart the nessusd service (D) to reload the configuration and make Nikto available for use within Nessus scans. The other directories specified are not part of the proper Nikto integration process.

Why the other options are wrong

• A. Placing nikto.pl in /etc/nessus is not the correct location for Nikto integration.
• B. Placing nikto.pl in /var/www is for web server content, not for tool integration with Nessus.

Correct answer: C. Filter disallowed input characters for each possible encoding scheme at the application server

The log shows a cross-site scripting (XSS) attack attempt with HTML/JavaScript encoded in script tags. The most effective defense during preparation is to filter disallowed input characters across all possible encoding schemes at the application server level. This prevents the malicious payload from ever being processed, regardless of encoding techniques used to bypass simpler filters.

Why the other options are wrong

• A. Parameterized stored procedures protect against SQL injection, not the XSS attack shown in these logs.
• B. Configuring robots.txt does not prevent attacks; the attacker is ignoring robots.txt rules and attacking directly.
• D. Timestamps and random hashes are authentication/session mechanisms and do not specifically mitigate XSS attacks shown here.

Correct answer: A. Containment

The incident handling process follows a defined sequence: Preparation, Identification, Containment, Eradication, Recovery, and Post-Incident Activities. Since the question states that the DOS attack has already been identified, the next logical phase is Containment, which involves stopping the attack and limiting its scope and impact on the network.

Why the other options are wrong

• B. Preparation occurs before incidents happen and involves setting up tools and procedures, not after identification.
• C. Recovery is a later phase that occurs after containment and eradication are complete.
• D. Identification has already been completed as stated in the question.

Correct answer: C. Microsoft network server: Digitally sign communications (always)

SMB signing adds a signature generated from the session key to every message, and the signature also confirms the identities of the sender and receiver, which prevents relay attacks. The server policy with "always" sets RequireSecuritySignature, so the file server demands signing on every inbound session and a relayed session that cannot produce valid signatures is not usable. For SMB 2 and later, signing is controlled only by whether it is required, so a merely enabled setting does not protect the server.

Why the other options are wrong

• A. This policy limits anonymous enumeration, while a relay uses a real user's authentication rather than an anonymous session.
• B. The "if client agrees" setting maps to EnableSecuritySignature, which is ignored for SMB 2 and later and does not require signing.
• D. The client policy governs outbound connections from the computer it is applied to and cannot make the attacker's relaying client sign its connection to the file servers.

Correct answer: A, B, C, D. Organizational skills; Diplomatic skills; Methodical skills; Technical skills

All four skill types are essential for incident handling team members. Organizational skills are needed to coordinate complex response activities. Diplomatic skills help communicate with stakeholders and manage tensions. Methodical skills ensure systematic investigation and documentation. Technical skills are fundamental for analyzing the incident, containing threats, and implementing fixes.

Correct answer: A, B, C. It records all keystrokes on the victim's computer in a predefined log file; It can be remotely installed on a computer system; It is a software tool used to trace all or specific activities of a user on a computer.

Keyloggers are tools that record all keystrokes on a victim's computer in log files (A), can be installed remotely on systems (B), and are used to trace user activities on a computer (C). They function as surveillance tools to capture sensitive information like passwords, messages, and searches. Option D is incorrect because keyloggers are designed to capture information, not destroy or scramble data; that function belongs to other malware types like wipers or ransomware.

Why the other options are wrong

• D. Keyloggers are designed to record and exfiltrate keystrokes, not to destroy or scramble data on the hard disk; that is the function of destructive malware.

Correct answer: D. DDoS attack

A Distributed Denial of Service (DDoS) attack by definition involves multiple compromised systems (a botnet) coordinating to attack a single target system simultaneously. This distributed nature is what distinguishes DDoS from other attacks and makes it particularly effective at overwhelming target resources.

Why the other options are wrong

• A. Brute force attacks involve trying many password combinations from a single or limited source, not multiple systems.
• B. Replay attacks involve capturing and resending valid network packets, not using multiple compromised systems.
• C. Dictionary attacks involve guessing passwords using word lists, not using multiple systems to attack a single target.

Correct answer: D. An event ticket should be created and escalated to the security team to investigate the attempts.

When a SOC analyst detects abnormal activity like multiple failed logon attempts, the proper procedure is to create an incident ticket and escalate to the security team for formal investigation. This ensures proper incident handling chain of custody, allows for coordinated investigation across multiple systems, and prevents premature reactive measures. Escalation follows established incident response procedures rather than taking immediate unilateral action that could interfere with forensics.

Why the other options are wrong

• A. Suspending accounts prematurely could destroy evidence and is not the analyst's role without investigation.
• B. Deploying IDS signatures addresses monitoring but does not investigate the current attack in progress.
• C. Examining individual devices without coordination misses the enterprise-wide scope and proper investigation protocol.

Correct answer: C. Kernel level rootkit

Kernel level rootkits operate at the operating system kernel level and modify core kernel code and associated device drivers. This gives them deep control over the system. Hypervisor rootkits run below the operating system, boot loader rootkits compromise the boot process, and library rootkits intercept library calls, each operates at different layers but kernel level rootkits specifically replace portions of the kernel and drivers.

Why the other options are wrong

• A. Hypervisor rootkits run at a virtualization layer below the OS, not within the kernel itself.
• B. Boot loader rootkits compromise the boot process but do not replace kernel code and device drivers.
• D. Library rootkits intercept function calls at the library level rather than modifying kernel code.

Correct answer: C. Session hijacking

Session hijacking refers to the exploitation of an already-authenticated user session to gain unauthorized access to systems or information without needing to provide credentials. Piggybacking involves physical tailgating, hacking is a broad term for unauthorized access, and keystroke logging captures key presses, none specifically describe exploiting an existing valid session.

Why the other options are wrong

• A. Piggybacking refers to physical unauthorized entry by following someone through a door, not exploiting sessions.
• B. Hacking is a general term for unauthorized computer access and doesn't specifically refer to session exploitation.
• D. Keystroke logging records keystrokes to capture credentials or information, not exploit existing sessions.

Correct answer: C. Vulnerability scanning

Vulnerability scanning should be the highest priority when assessing web application security. It systematically identifies known vulnerabilities, misconfigurations, and security weaknesses in web applications. This directly addresses the client's stated critical concern about web application security and provides actionable findings specific to their primary risk.

Why the other options are wrong

• A. Setting up IDS is a defensive measure for ongoing monitoring, not the initial assessment priority.
• B. Port scanning is too general and doesn't specifically address web application vulnerabilities.
• D. Honeypots are deceptive detection tools, not assessment tools for identifying existing vulnerabilities.

Correct answer: D. Containment

According to FIRST organization classification guidelines, incident categorization and documentation (including category, criticality, and sensitivity classifications) should be documented during the Containment phase. This is when the incident is being actively managed and formally classified so appropriate response measures and communication channels can be established.

Why the other options are wrong

• A. Preparation occurs before incidents happen; classification of an active incident happens during response phases.
• B. Eradication focuses on removing the threat; classification documentation precedes this phase.
• C. Lessons Learned is the final phase used for post-incident review, not for initial incident documentation and classification.

Correct answer: D. Rebuild the server OS and application from original media, change exposed user passwords, and install all patches.

After a buffer overflow exploit that created a rogue administrator account, the safest recovery is a complete rebuild from original media, not backups. This ensures the vulnerability and any malicious code or persistence mechanisms are completely eliminated. Restoring from backups (option B) risks restoring compromised data or code. The server must be completely rebuilt, followed by patching and password changes.

Why the other options are wrong

• A. Removing the account and patching does not address potential persistence mechanisms or other backdoors the attacker may have left.
• B. Restoring from backups may restore the compromised state or backdoors the attacker installed before the backup was taken.
• C. Patching an already-compromised system does not remove potential persistence mechanisms or hidden backdoors.

Correct answer: B, C, D. IPTraf; MRTG; Ntop

IPTraf (B) is a real-time IP LAN traffic monitoring tool for Linux. MRTG (C) is a traffic monitoring tool that generates graphs of network traffic. Ntop (D) is a network traffic probe that shows network usage in a manner similar to top. All three are legitimate Linux network monitoring tools. Netbus is a Windows-based backdoor/remote access tool, not a network traffic monitoring tool for Linux.

Why the other options are wrong

• A. Netbus is a Windows remote access/backdoor tool, not a Linux network traffic monitoring tool.

Correct answer: C. http://www.myserver.com/search.asp?lname=adam%27%3bupdate%20usertable%20set% 20pass wd%3d %27hCx0r%27%3b--%00

Option C shows a classic SQL injection attack using URL parameters where single quotes, semicolons, and SQL commands (UPDATE, SET) are injected to modify the database query and alter user passwords. The encoded characters decode to SQL syntax that breaks out of the intended query.

Why the other options are wrong

• A. This is a directory traversal or buffer overflow attempt using encoded path manipulation characters, not SQL injection.
• B. This is a parameter tampering attack attempting to modify parameter values (account number and credit amount) but does not inject SQL code.
• D. This is a cross-site scripting (XSS) attack using encoded script tags to inject malicious JavaScript, not SQL injection.

Correct answer: C. Forced browsing

Forced browsing aims to enumerate and access resources that the application does not link to but that remain accessible, such as temporary directories, old backups and configuration files. Automated tools request well-known names from a list, and an HTTP 200 marks a resource worth inspecting, which matches the run of misses followed by hits here. OWASP also calls this predictable resource location or directory enumeration. Defenses include keeping backup and metadata files out of the web root, disabling directory listing and alerting on repeated access failures.

Why the other options are wrong

• A. Path traversal escapes the web root by manipulating file path parameters, while these requests simply guess paths inside the site.
• B. IDOR swaps an identifier in a parameter to reach another user's object, and no object identifiers are being changed here.
• D. Session fixation forces a victim to use a session ID chosen by the attacker and produces no pattern of guessed paths.

Correct answer: D. DoS attack

A Denial of Service (DoS) attack aims to prevent legitimate users from accessing services, which directly matches the attacker's intention described in the question. The use of IDS/IPS sensors to mitigate is a standard defensive measure against DoS attacks.

Why the other options are wrong

• A. Internal attack refers to threats from within the organization, but the question does not indicate the attacker is internal.
• B. Reconnaissance attack involves gathering information about the target, not preventing access to services.
• C. Land attack is a specific DoS variant using spoofed packets with matching source and destination, not the general category of service denial.

Correct answer: A. Filtered

In Nmap's XMAS scan (which sets FIN, PSH, and URG flags), ports that do not respond are typically filtered. A filtered port indicates that a firewall or filtering device is blocking the probe packets, preventing the target system from responding. Open ports would send a response, and closed ports would send an RST packet in response to XMAS probes.

Why the other options are wrong

• B. Open ports would respond to XMAS scans and therefore would be identified, not characterized by no response.
• C. Closed ports would send back RST (reset) packets, which constitutes a response, not the absence of response described in the question.

Correct answer: B. Nessus

Nessus is a comprehensive vulnerability scanner with a signature database that detects hundreds of vulnerabilities across UNIX, Windows, and web CGI scripts. It also identifies DDoS zombies and Trojans. SARA is similar but less comprehensive; Anti-x and Nmap are not vulnerability scanners with signature databases, Nmap is a port scanner without vulnerability detection capabilities.

Why the other options are wrong

• A. SARA is a vulnerability scanner but less comprehensive than Nessus for detecting DDoS zombies and Trojans.
• C. Anti-x is not a known vulnerability scanner matching this description.
• D. Nmap is a port scanning tool, not a vulnerability scanner with signature databases.

Correct answer: D. Packet captures from a sensor at the network border

Packet captures from a network border sensor are most likely to contain the complete binary file transmitted during the compromise. Since the rootkit was delivered via Internet activity, the network sensor would have captured the actual malicious binary in transit before it was executed on the host. Filesystem journals, IDS alerts, and proxy memory images would not contain the original binary in a form that can be easily reconstructed.

Why the other options are wrong

• A. Filesystem journal entries record metadata about files but typically do not contain the full binary content needed for reconstruction.
• B. IDS logs contain alerts and signatures but not the actual binary payload itself.
• C. A proxy server's memory image would only contain what passed through that proxy; an infected host may have received the binary directly from the internet without proxy involvement.

Correct answer: B. SQL injection attack

The input ='or''=' is a classic SQL injection payload designed to manipulate the authentication query. When inserted into a SQL query like SELECT * FROM users WHERE username='='or''='' AND password='='or''='', the condition becomes true because ''='' is always true, bypassing authentication. This grants unauthorized access to the user page. Dictionary attacks involve trying common passwords, replay attacks reuse captured credentials, and Land attacks are network-based DoS attacks, none fit this scenario.

Why the other options are wrong

• A. Dictionary attacks involve trying lists of common usernames and passwords, not crafted SQL syntax.
• C. Replay attacks capture and retransmit valid authentication credentials, not inject SQL code.
• D. Land attacks are TCP/IP level DoS attacks using forged packets, unrelated to web application input.

Correct answer: C. Lynx

Lynx is a text-based web browser that does not execute JavaScript, Java applets, or other executable code. This makes it ideal for safely testing websites known to contain malicious applets and code, as the malicious content cannot execute. Mozilla Firefox, Internet Explorer, and Safari are graphical browsers that support JavaScript and applets, making them vulnerable to the malicious content Adam wishes to test safely.

Why the other options are wrong

• A. Mozilla Firefox supports JavaScript and applets, which would execute malicious code on the website.
• B. Internet Explorer supports JavaScript and applets, creating risk when visiting malicious websites.
• D. Safari supports JavaScript and applets, exposing the user to execution of malicious content.

Correct answer: C. A SQL injection attack

The error message from the Microsoft OLE DB Provider is a database error that occurs when a single quote disrupts SQL query syntax. This is the hallmark indicator of a SQL injection vulnerability, where user input is improperly sanitized and interpreted as SQL code, allowing attackers to manipulate database queries.

Why the other options are wrong

• A. A buffer overflow error would typically manifest as a memory access violation or system crash, not a database provider error.
• B. A Denial-of-Service attack causes unavailability through resource exhaustion, not database query syntax errors.
• D. An XSS attack involves injecting scripts into web pages that execute in browsers, not causing database provider errors.

Correct answer: B. Pre-attack phase

The pre-attack phase (also called the reconnaissance phase) is the first stage of penetration testing where attackers gather information about the target system, network, and organization. This phase includes passive and active reconnaissance, data collection, and intelligence gathering. The attack phase involves exploiting vulnerabilities, the post-attack phase involves analysis and cleanup, and 'out-attack phase' is not a recognized penetration testing phase.

Why the other options are wrong

• A. The attack phase is where the tester exploits vulnerabilities, not where information about the target is gathered.
• C. The post-attack phase covers cleanup, restoring systems to their original state and reporting, after the testing work is done.
• D. There is no out-attack phase in the standard penetration testing phases.

Correct answer: C. Back door

A back door is a method or pathway that allows an attacker to bypass normal authentication procedures and gain unauthorized access to a system. Back doors can be built into software, created through exploits, or installed by malware. Teardrop and Smurf are denial-of-service attacks, and Trojan horse is a delivery mechanism for malicious code, while Trojans might install back doors, they are not themselves methods of bypassing authentication.

Why the other options are wrong

• A. Teardrop is a denial-of-service attack that exploits IP fragmentation, not a method of bypassing authentication.
• B. Trojan horse is a delivery mechanism for malware, not a direct method of bypassing authentication.
• D. Smurf is a distributed denial-of-service attack using ICMP, not an authentication bypass technique.

Correct answer: A, B, D. Host; Dig; NSLookup

Host, Dig, and NSLookup are all legitimate DNS query tools that can be used to perform zone transfers when misconfigured DNS servers allow them. Host is a simple DNS lookup utility, Dig is a powerful DNS query tool that supports zone transfer requests (AXFR), and NSLookup is a standard DNS lookup utility. DSniff is a collection of network sniffing/spoofing tools focused on packet sniffing and network attacks, not DNS zone transfers, making it unsuitable for this specific task.

Why the other options are wrong

• C. DSniff is a packet sniffing tool designed for network traffic interception, not DNS zone transfer enumeration.

Correct answer: D. HPing

HPing is a network analysis tool that sends packets with nontraditional or customizable IP stack parameters and analyzes responses, making it useful for both scanning and detailed network reconnaissance. Tcpview (A) is a process monitoring tool. Nessus (B) is a vulnerability scanner. Legion (C) is a network enumeration tool. Only HPing fits the description of sending crafted packets with non-standard IP parameters and gathering information from responses.

Why the other options are wrong

• A. Tcpview is a process and connection monitoring tool, not a packet crafting scanner.
• B. Nessus is a vulnerability scanner that does not specifically send packets with nontraditional IP parameters.
• C. Legion is an enumeration tool focused on network resource discovery, not packet manipulation.

Correct answer: B, C, D. They allow an attacker to set a Trojan in the operating system and thus open a backdoor for anytime access; They allow an attacker to replace utility programs that can be used to detect the attacker's activity; They allow an attacker to run packet sniffers secretly to capture passwords.

Rootkits enable attackers to establish persistent backdoor access (B), replace system utilities to evade detection (C), and run hidden network monitoring tools like packet sniffers to capture credentials (D). However, rootkits do not directly cause buffer overflows; buffer overflows are separate vulnerability exploitation techniques used to gain the elevated privileges that rootkits then maintain.

Why the other options are wrong

• A. Buffer overflows are attack vectors that may be used to install a rootkit, but rootkits themselves do not conduct buffer overflows.

Correct answer: C. Create incident checklists.

Incident checklists provide a structured, easy-to-follow reference that Adam can quickly consult during hectic incident response situations. Checklists ensure no steps are forgotten, require minimal administrative overhead compared to appointing personnel or creating new teams, and are far more practical than requiring manual reading during an active incident. This is the least administratively burdensome solution that directly addresses the issue.

Why the other options are wrong

• A. Requiring manual reading during a hectic incident is impractical and does not reduce administrative effort.
• B. Appointing someone to check procedures adds management overhead rather than reducing it.
• D. Creating a new sub-team significantly increases administrative effort and is unnecessary for this problem.

Correct answer: D. Reconnaissance

Dumpster diving is a passive reconnaissance technique where an attacker gathers information by searching through discarded materials. It falls under the reconnaissance phase, which is the first step of the hacking methodology where attackers collect information about the target before launching any active attacks.

Why the other options are wrong

• A. Multi-factor authentication is a security control mechanism, not a phase of the hacking process.
• B. Role-based access control is a security implementation, not part of the hacking methodology phases.
• C. Mutual authentication is a security protocol mechanism, not a phase in the hacking process.

Correct answer: B. Code review

Code review is the most effective method for finding flaws in web applications because it allows for thorough examination of application logic, data validation, and security controls at the source level. While vulnerability scanning and penetration testing are useful, code review provides the deepest insight into application design flaws before deployment. Manual penetration testing is time-consuming and may not catch all issues, while automated scanning typically only finds known signatures.

Why the other options are wrong

• A. Manual penetration testing is reactive and time-consuming, occurring after deployment rather than during development.
• C. Automated penetration testing may miss logic flaws and zero-day vulnerabilities specific to custom application code.
• D. Vulnerability scanning detects known issues but cannot identify custom application logic flaws or design weaknesses.

Correct answer: D. Compare the entire password against a blocklist of commonly used, expected or compromised values

Users respond to composition rules in predictable ways, so choices like Password1! remain easy to guess. SP 800-63B-4 instead requires verifiers to compare every prospective password against a blocklist of commonly used, expected or compromised passwords, checking the entire password rather than substrings, and to require a different choice and explain why when it matches. Combined with rate limiting of login attempts, the blocklist removes the guesses attackers are most likely to try first.

Why the other options are wrong

• A. The standard prohibits imposing composition rules such as mixtures of character types.
• B. The standard prohibits requiring periodic password changes and forces a change only on evidence of compromise.
• C. The entire password is compared with the blocklist, not substrings or words contained in it.

Correct answer: A, B. Educate users of the client computers to avoid malware; Educate users of the client computers about the problems arising due to malware.

Educating users to avoid malware (option A) and educating them about malware problems (option B) are both proactive defense strategies that address the human element of security. User awareness is critical since people are often the weakest link in security. Options C and D are impractical, preventing all program execution would disable the computers, and read-only permissions would prevent necessary work and system updates.

Why the other options are wrong

• C. Preventing users from executing any programs would render the client computers unusable for their intended business purposes.
• D. Read-only permissions would prevent legitimate software installation, updates, and normal business operations.

Correct answer: A. Reconnaissance

Reconnaissance describes an attempt to transfer DNS zone data, also known as a DNS zone transfer attack. This is an information gathering technique where an attacker attempts to obtain a copy of the DNS zone file to discover all hosts in a domain. Encapsulation is a networking concept, dumpster diving is physical information gathering, and spam is unsolicited messaging.

Why the other options are wrong

• B. Encapsulation refers to the layering of protocols in networking, not DNS zone data extraction.
• C. Dumpster diving is the physical act of searching through trash for information, not a DNS-based attack.
• D. Spam is unsolicited bulk messaging and is unrelated to DNS zone transfer attacks.

Correct answer: C. System owner for that system

The system owner for the accounting department's system should make the decision about returning it to production. The system owner has accountability for the system's business impact and is responsible for determining when their department's operational needs are satisfied and the system is ready for use.

Why the other options are wrong

• A. While the incident handler leads recovery, the decision to return to production is a business decision, not a technical one, and should rest with the owner.
• B. The CIO/Head of IS oversees IT operations but shouldn't override the specific system owner's accountability for their system.
• D. The system administrator executes the return to production but doesn't have the authority to make the business decision about timing.

Correct answer: D. Define what is acceptable and filter out everything else.

The best approach to input validation is to use a whitelist strategy: define what is acceptable and reject everything else. This positive security model is more secure than blacklisting because attackers frequently discover new harmful characters or encoding methods that could bypass a blacklist. By explicitly defining acceptable input (alphanumeric characters, specific symbols, required format), the application rejects any unexpected input regardless of attack sophistication.

Why the other options are wrong

• A. Client-side validation can be bypassed and should never be the sole validation layer; server-side validation is essential.
• B. Firewall and proxy filtering cannot effectively filter harmful characters in legitimate application data and may cause false positives.
• C. Blacklist approaches (filtering out what is unacceptable) fail when attackers use novel encoding or characters not previously identified as harmful.

Correct answer: C. Preparation

Preparation is the only steady-state phase of incident response that occurs continuously before an incident happens. It involves establishing tools, procedures, training, and infrastructure that remain constant over time. Containment, Eradication, and Recovery are all reactive phases that occur only when an active incident is happening and vary in nature depending on the specific incident.

Why the other options are wrong

• A. Containment is a reactive phase that occurs during an active incident to limit damage and spread.
• B. Eradication is a reactive phase performed during incident response to remove the threat from systems.
• D. Recovery is a reactive phase performed after the threat is eliminated to restore systems to normal operation.

Correct answer: A. By default, trails log management events only, and S3 object-level reads are data events that must be enabled

CloudTrail separates management events, which are control plane operations, from data events, which are data plane operations such as S3 GetObject, PutObject and DeleteObject. A trail logs management events by default but does not log data events unless they are configured, and they carry an extra charge. An empty search therefore does not prove that no objects were read. Enabling S3 data events, or S3 server access logging, ahead of an incident is what makes object-level exfiltration visible.

Why the other options are wrong

• B. GetObject is an object-level data event, and management events are the ones trails log by default.
• C. CloudTrail records GetObject as a Read data event when the trail is configured to log read data events.
• D. Data event logging is a setting of the trail itself and does not depend on GuardDuty.

Correct answer: B, C. strcat(); strcpy()

Both strcat() and strcpy() are vulnerable to buffer overflow attacks because they copy data without checking buffer boundaries. These functions do not perform length validation, allowing attackers to write beyond allocated memory and corrupt the stack or heap.

Why the other options are wrong

• A. printf() can be vulnerable to format string attacks but is not a primary buffer overflow vector like strcat() and strcpy().
• D. strlength() (or strlen()) only returns the length of a string and does not perform any copying or data manipulation that would cause buffer overflow.

Correct answer: B. Security token

A security token is a hardware device that generates time-based or challenge-response codes, typically combined with a PIN for two-factor authentication. Tokens are cost-effective alternatives to smart cards while still providing the hardware device plus PIN combination that the CEO requested. This matches the requirement for a hardware device used in tandem with a PIN.

Why the other options are wrong

• A. Biometric devices authenticate based on physical characteristics, not a combination of hardware and PIN as specified.
• C. Proximity cards provide single-factor authentication without requiring a PIN.
• D. One-time passwords are software-based or can be delivered via SMS, not necessarily a hardware device solution.

Correct answer: A. Replace the extension with one that implements only mail reading

OWASP classifies this as Excessive Agency, and its example scenario is nearly identical: a summarizing assistant whose plugin also contains send functions is hijacked through indirect prompt injection in an incoming email. The fix for excessive functionality is to limit extension functions to the minimum needed, so a read-only mail extension leaves the model nothing to abuse even when it is manipulated. Complementary fixes include a read-only OAuth scope and requiring the user to review and approve every outbound message.

Why the other options are wrong

• B. System prompt rules can be overridden by prompt injection, so they do not remove the dangerous send capability.
• C. Rate limiting only reduces the damage; the assistant could still forward sensitive data, just more slowly.
• D. More training data does not stop a model from following injected instructions, and the send function would remain available.

Correct answer: C. MAC address filtering

MAC address filtering limits network access based on the unique Media Access Control (MAC) address of a device's network interface, which is hardware-specific information. This strategy allows administrators to create whitelists or blacklists of devices permitted to connect to a network based on their physical hardware identifiers.

Why the other options are wrong

• A. EAP is an authentication protocol framework that validates user credentials, not hardware identifiers.
• B. WEP is a deprecated wireless encryption standard that protects data confidentiality, not access control based on hardware.
• D. WTLS is a security protocol for wireless transport that provides encryption and authentication, not hardware-based access limitation.

Correct answer: D. The client sent too many requests in a given time and is being rate limited

RFC 6585 defines 429 Too Many Requests as the user having sent too many requests in a given amount of time, which is rate limiting, and the response may include Retry-After to say how long to wait. Seeing 429 during a burst shows that the rate limit, a core OWASP control against unrestricted resource consumption and automated abuse, is engaging for that client. The handler should still check whether the same activity continued from other addresses that stayed under the limit.

Why the other options are wrong

• A. Rejected or missing credentials produce 401 Unauthorized rather than 429.
• B. An unexpected server-side condition is reported with 500 Internal Server Error rather than 429.
• C. An unsupported method is reported with 405 Method Not Allowed rather than 429.

Correct answer: B. VNC

VNC (Virtual Network Computing) is a legitimate remote control application that can be exploited as an application-level backdoor and typically listens on port 5900. It provides remote desktop access, making it useful for attackers who can compromise credentials or leave it installed. While Back Orifice, Sub7, and Netbus are also RATs, VNC is the specific tool known for port 5900 operations.

Why the other options are wrong

• A. Back Orifice is a RAT but does not typically use port 5900.
• C. Sub7 is a RAT but does not typically use port 5900.
• D. Netbus is a RAT but does not typically use port 5900.
• E. Hack-a-tack is not a recognized remote control tool.

Correct answer: A. Rainbow attack

A rainbow attack uses pre-calculated hash tables (rainbow tables) that contain hash values for a large number of possible passwords. The attacker simply looks up a target hash in these pre-computed tables to retrieve the corresponding plaintext password, making it much faster than computing hashes in real-time.

Why the other options are wrong

• B. Brute force attacks compute hashes in real-time by trying all possible combinations, not using pre-calculated tables.
• C. Dictionary attacks compare hashes against a list of common words or known passwords, not pre-calculated hash tables.
• D. Hybrid attacks combine dictionary words with character permutations, not relying on pre-calculated hash tables.

Correct answer: B, C, D. Disrupting services to a specific computer; Sending thousands of malformed packets to a network for bandwidth consumption; Sending lots of ICMP packets to an IP address

Denial of service attacks aim to disrupt or make services unavailable. Disrupting services to a specific computer (B) directly qualifies. Sending malformed packets for bandwidth consumption (C) is a classic DoS technique. Sending excessive ICMP packets (D) is ping flooding, a well-known DoS method. A backdoor attack (A) is an unauthorized remote access mechanism and does not constitute a denial of service attack.

Why the other options are wrong

• A. Backdoor attacks provide unauthorized access and are not denial of service attacks, which focus on disrupting availability.

Correct answer: B, C, D, E. Using ARP Guard utility; Using static ARP entries on servers, workstation and routers; Using ARP watch utility; Using IDS Sensors to check continually for large amount of ARP traffic on local subnets

The correct countermeasures include using ARP Guard utility (B) which detects ARP anomalies, implementing static ARP entries (C) to prevent dynamic ARP mapping manipulation, using ARP watch utility (D) to monitor ARP traffic for suspicious activity, and deploying IDS sensors (E) to detect large volumes of ARP traffic indicating poisoning attacks. Smash Guard is not a recognized ARP spoofing countermeasure utility.

Why the other options are wrong

• A. Smash Guard is not a standard or recognized utility for ARP spoofing defense.

Correct answer: B. Cyber Incident Response Plan

A Cyber Incident Response Plan is specifically designed to enable security personnel to identify, mitigate, and recover from malicious computer incidents including unauthorized access, denial-of-service attacks, and unauthorized system changes. This is the formal security-focused procedure for handling cyberattacks.

Why the other options are wrong

• A. A Disaster Recovery Plan focuses on restoring IT systems after disasters, not specifically on identifying and mitigating malicious incidents.
• C. A Crisis Communication Plan addresses how to communicate during organizational crises, not technical incident identification and mitigation.
• D. An Occupant Emergency Plan deals with physical safety procedures for building evacuation and emergencies, not cybersecurity incidents.

Correct answer: C. Accept an index value and map it server-side to an allowed file

OWASP's path traversal guidance prefers working without user input in file system calls and using indexes rather than actual portions of file names, so the user never supplies any part of the path. The server keeps the mapping, for example value 5 means a specific language file, and anything outside the allowed set is rejected. Input should be validated by accepting only known good values rather than sanitized, because filters that strip sequences often miss alternate encodings. Chrooted jails add containment.

Why the other options are wrong

• A. Stripping sequences is fragile because encoded variants can slip past the filter, and accepting only known good values is the safer approach.
• B. Client-side checks are bypassed by sending the request directly, so they cannot serve as the security control.
• D. HTTPS protects data in transit and does not change how the server resolves a requested file path.

Correct answer: C. OS Fingerprinting

OS Fingerprinting is the specific technique used to identify and determine the operating system running on a remote computer in a network environment. It analyzes response patterns to network probes and examines protocol implementations unique to different operating systems. Spoofing masks identity, Reconnaissance is a broader phase, and Social Engineering involves human manipulation rather than technical OS detection.

Why the other options are wrong

• A. Spoofing involves forging identity information, not identifying remote operating systems.
• B. Reconnaissance is the broader information-gathering phase that includes OS fingerprinting as a technique.
• D. Social engineering manipulates people rather than identifying technical OS signatures on remote systems.

Correct answer: A. PAM

PAM (Pluggable Authentication Modules) is the standard Linux framework for enforcing password policies and complexity requirements. It provides configurable modules like pam_cracklib or pam_pwquality that can mandate password strength, length, character composition, and other complexity rules system-wide.

Why the other options are wrong

• B. Password Guardian is not a legitimate Linux password complexity tool.
• C. Fast Lane is not a recognized Linux security or password management tool.
• D. Passfilt.dll is a Windows-specific DLL for password filtering, not a Linux tool.

Correct answer: A. Format string attack

Using printf(str) instead of printf("%s", str) creates a format string vulnerability. When user input is passed directly as the format string argument, an attacker can craft input containing format specifiers (like %x, %n) to read from or write to arbitrary memory locations, potentially leading to information disclosure or code execution.

Why the other options are wrong

• B. Cross Site Scripting (XSS) attacks involve injecting malicious scripts into web pages; this is a backend C/C++ printf issue unrelated to web page rendering.
• C. SQL injection attacks target databases through improper handling of SQL queries; printf format string vulnerabilities are distinct memory manipulation issues.
• D. Sequence++ is not a recognized attack vector; it appears to be a fabricated term.

Correct answer: A. FIN

The FIN (Finish) control bit is used to initiate a graceful termination of a TCP connection, signaling that the sender has finished sending data. This allows for an orderly shutdown where both sides acknowledge the connection closure. PSH pushes data immediately, SYN initiates connections, RST forcefully resets connections, and URG indicates urgent data, none of these initiate graceful termination.

Why the other options are wrong

• B. PSH (Push) forces immediate transmission of buffered data, not connection termination.
• C. SYN (Synchronize) initiates new TCP connections, not termination.
• D. RST (Reset) forcefully aborts a connection abnormally, not gracefully.
• E. URG (Urgent) indicates that urgent data follows, not connection termination.

Correct answer: B. Fraggle DoS attack

A Fraggle attack is a UDP-based Denial of Service attack that sends large volumes of UDP echo request packets to broadcast addresses with a spoofed source IP address. When broadcast hosts receive these requests, they send echo replies to the spoofed source, overwhelming it with traffic. This matches Maria's exact methodology: UDP packets, broadcast addresses, and spoofed source addresses.

Why the other options are wrong

• A. Ping flood attacks use ICMP echo requests, but the scenario explicitly states the firewall blocks ICMP messages.
• C. Teardrop attacks exploit IP fragmentation bugs by sending overlapping fragmented packets; this scenario describes broadcast UDP echoes.
• D. Smurf attacks are similar to Fraggle but use ICMP echo requests instead of UDP packets; ICMP is blocked in this scenario.

Correct answer: D. ARP spoofing

ARP spoofing allows an attacker to intercept and modify traffic on a local area network by mapping their MAC address to another IP address, enabling man-in-the-middle attacks where frames can be sniffed and altered. MAC spoofing only changes the source MAC address but doesn't enable traffic modification. IP and email spoofing operate at different layers and don't facilitate frame-level sniffing on LANs.

Why the other options are wrong

• A. MAC spoofing only changes the MAC address; it doesn't enable sniffing and modifying traffic on a LAN.
• B. IP address spoofing operates at Layer 3 and is not the primary technique for sniffing and modifying LAN frames.
• C. Email spoofing is used to forge email headers and is not related to LAN frame manipulation.

Correct answer: E. Worms spread without human interaction across a network

Worms are self-replicating malware that spread autonomously across networks without requiring human interaction, distinguishing them from viruses which typically require user action to execute and spread. Option E correctly identifies this key characteristic of worms. While viruses can infect various file types and both worms and viruses can target multiple operating systems, the fundamental difference is the propagation mechanism.

Why the other options are wrong

• A. Viruses infect both executable files and documents; worms also infect executables, so this distinction is incorrect.
• B. Worms attack multiple operating systems, not exclusively Linux systems.
• C. This reverses the definitions, viruses spread through human interaction while worms spread without it.
• D. Both viruses and worms can attack Windows systems; this is not a distinguishing characteristic.

Correct answer: D. Accepting only an allow-list of client-updatable properties instead of auto-binding all input

This is API3:2023 Broken Object Property Level Authorization in the form OWASP previously called mass assignment: the user may edit the profile object but not one of its sensitive properties. The fix is authorization at the property level. The API should avoid functions that automatically bind client input into internal object properties and should allow changes only to the properties the client is meant to update, so an unexpected field such as the subscription tier is never written.

Why the other options are wrong

• A. Rate limiting controls how often a client calls the endpoint, and a single request was enough to change the unauthorized property.
• B. TLS protects data in transit but does not decide which fields an authenticated user may modify.
• C. Unpredictable IDs make guessing other users' records harder, while this user changed a property on their own record.

Correct answer: A. Boot loader rootkit

Boot loader rootkits are specifically designed to attack full disk encryption systems by intercepting the boot process before encryption mechanisms are initialized or active. By compromising the bootloader, attackers can gain control before the encrypted filesystem is mounted or decrypted. Kernel level, library, and hypervisor rootkits operate at different privilege levels but do not specifically target the boot sequence required to compromise full disk encryption.

Why the other options are wrong

• B. Library rootkits hook or replace user-space library calls inside the running system and do not tamper with the boot process that full disk encryption depends on.
• C. Hypervisor rootkits place the running operating system inside a virtual machine they control, which is not aimed at the pre-boot sequence that unlocks an encrypted disk.
• D. Kernel level rootkits alter the running kernel, but it is the boot loader rootkit that targets the boot sequence full disk encryption relies on.

Correct answer: B, C. The writers of a Trojan horse can use it later to gain unauthorized access to a computer; It is a malicious software program code that resembles another normal program.

A Trojan horse is a malicious software program that resembles a normal, legitimate program (option C), deceiving users into executing it. Once installed, attackers can use it to gain unauthorized access to the compromised computer later (option B). Option A describes viruses or worms that attach themselves to files, while option D describes boot sector viruses, neither of which accurately describe Trojans.

Why the other options are wrong

• A. This describes viruses or worms, not Trojans. Trojans do not attach themselves to existing files.
• D. This describes boot sector viruses, which infect the boot record; Trojans are standalone executable programs.

Correct answer: A. Directory traversal

The URL uses encoded directory traversal sequences (..%co%af../ represents ../ in encoded form) to navigate up the directory tree and access the Windows system32 folder, ultimately attempting to execute cmd.exe. This is the classic directory traversal attack pattern attempting to bypass path restrictions by moving to parent directories outside the intended web root.

Why the other options are wrong

• B. Replay attacks involve capturing and retransmitting valid messages, not directory navigation.
• C. Session hijacking involves stealing session tokens, not manipulating URLs to access system files.
• D. URL obfuscation is encoding technique used within directory traversal but is not the attack type itself.

Correct answer: A, C, D. It disrupts services to a specific computer; It saturates network resources; It disrupts connections between two computers, preventing communications between services.

DoS attacks work by disrupting services to specific computers (A) through resource exhaustion or targeted attacks, saturating network resources (C) to make them unavailable, and disrupting connections between computers to prevent service communication (D). Option B is incorrect because DoS attacks do not change TCP/IP protocol configurations; they exploit existing protocols and network bandwidth. DoS attacks operate by overwhelming or blocking rather than reconfiguring.

Why the other options are wrong

• B. DoS attacks do not modify TCP/IP protocol configurations; they exploit protocols as they exist to overwhelm network resources.

Correct answer: D. Check on every request that the invoice belongs to the authenticated user

IDOR exists because the server returns an object without verifying that the requester may access it. OWASP's mitigation is an access control check for each object, such as a lookup scoped to the current user's own records, performed every time an access attempt is made. Complex random identifiers are only defense in depth: if an attacker obtains a valid identifier, the server must still block access. OWASP also advises against encrypting identifiers, which is difficult to do securely.

Why the other options are wrong

• A. UUIDs make guessing harder but remain defense in depth, since a leaked identifier still works without an ownership check.
• B. Hidden form fields and POST bodies are fully controllable by the client and can be tampered with just like URL parameters.
• C. Encrypting identifiers is hard to do securely and still leaves the missing authorization check in place.

Correct answer: A. The attack was social engineering and the firewall did not detect it.

Adam's attack was social engineering, he created a trusted-looking webpage to entice employees to click on embedded malicious code (a keylogger). The firewall did not detect this attack because the webpage appeared legitimate and came through normal web traffic, and social engineering relies on human psychology rather than technical exploitation. This bypassed the firewall's network-level protections because the threat was delivered through trust and deception.

Why the other options are wrong

• B. Security was compromised; even if internally hosted, the embedded keylogger represents a successful attack.
• C. While this could involve XSS techniques, the answer misses the social engineering component and incorrectly states the firewall blocked it.
• D. While it's true keyloggers may be invisible to firewalls, this doesn't explain the social engineering mechanism used to deploy it.

Correct answer: D. DDOS

When ICMP packets flood a network from multiple different IP addresses, this is a Distributed Denial of Service (DDoS) attack, where numerous sources collectively overwhelm the target. A Smurf attack uses ICMP echo requests to intermediate networks, but the question specifies packets from multiple sources. A SYN flood uses TCP SYN packets, not ICMP. A ping storm typically comes from a single source using ICMP. The defining characteristic of DDoS is the involvement of multiple source addresses.

Why the other options are wrong

• A. SYN flood attacks use TCP SYN packets, not ICMP packets.
• B. Ping storm typically originates from a single source, not multiple different IP addresses.
• C. While Smurf attacks do use ICMP, they typically amplify from a broadcast address rather than appearing as truly independent sources like a DDoS.

Correct answer: B. Grayware

Grayware refers to applications and files that are not classified as traditional viruses or Trojans but still pose security and performance risks, including spyware, adware, browser hijackers, and potentially unwanted programs (PUPs). These degrade system performance and compromise security without being formally categorized as malware.

Why the other options are wrong

• A. Hardware refers to physical computer components, not malicious software.
• C. Firmware is permanent software programmed into hardware devices, not classified security-threatening applications.
• D. Melissa is a specific virus, not a general category of unclassified malicious software.

Correct answer: C. yescrypt

A hashed passphrase in crypt format begins with a prefix that selects the hashing method, followed by options, salt and hash, usually separated by dollar signs. The $y$ prefix identifies yescrypt, a scalable passphrase hashing scheme based on scrypt and recommended for new hashes, with a tunable cost. Recognizing prefixes lets a handler judge how resistant stored hashes are to offline guessing and spot accounts still using older, weaker methods such as $1$ md5crypt.

Why the other options are wrong

• A. sha512crypt hashes use the $6$ prefix.
• B. bcrypt hashes use the $2b$ prefix, or the older $2a$, $2x$ and $2y$ variants.
• D. md5crypt hashes use the $1$ prefix.

Correct answer: C, D. Teardrop attack; Ping of Death attack

Teardrop and Ping of Death are both DoS attacks that exploit IP fragmentation mechanisms. Teardrop sends overlapping fragmented IP packets that confuse the reassembly process, while Ping of Death sends oversized ICMP packets that exceed the maximum IP packet size and cause fragmentation issues during reassembly. Land attacks exploit the TCP three-way handshake with spoofed source addresses, and SYN flood attacks overwhelm servers with SYN requests, neither relies on IP fragmentation.

Why the other options are wrong

• A. Land attacks use TCP/IP spoofing but do not employ IP fragmentation mechanisms.
• B. SYN flood attacks overwhelm a server with TCP SYN packets but do not use IP fragmentation.

Correct answer: B, C, D. You want to set the Netcat to execute command any time; You want to put Netcat in the stealth mode; You want to add the Netcat command to the Windows registry.

This registry command adds a Netcat entry to the Windows registry Run key (D), which executes automatically at startup (B). The command binds Netcat to listen on port 4444 and execute cmd.exe when a connection is received, creating a persistent backdoor. The registry modification ensures the backdoor activates on every reboot (B). While this could involve stealth considerations, the primary intent is persistence and remote command execution rather than pure stealth mode. Banner grabbing is not the goal of this command.

Why the other options are wrong

• A. Banner grabbing is a reconnaissance technique to identify services; this command is designed for persistence and remote access, not information gathering.

Correct answer: C. Macro virus

A macro virus is a script written in a macro language (such as VBA in Microsoft Office) that attaches itself to documents, templates, or applications. When the infected file is opened, the macro executes and can spread to other files and templates in the system.

Why the other options are wrong

• A. A boot sector virus infects the boot sector of storage devices, not script attachments to files or templates.
• B. A Trojan horse is malicious code disguised as legitimate software, not a script that attaches to templates.
• D. An email virus spreads through email messages but is not specifically defined by attaching as scripts to file templates.

Correct answer: D. Bots are software programs that perform an action on behalf of a human

A bot is software that performs automated actions on behalf of a user or system. Bots can operate autonomously, communicate with command-and-control servers, and execute instructions remotely. This definition encompasses the general functionality of bot software across various contexts, from legitimate chat bots to malicious botnets.

Why the other options are wrong

• A. This describes a traditional virus, not a bot; bots typically do not require human interaction but operate autonomously.
• B. This incorrectly describes bots as distribution channels; bots are the malware themselves, not distribution mechanisms.
• C. This description mixes bot autonomy with virus characteristics; bots do not typically infect carrier files like viruses do.

Correct answer: D. Worms replicate themselves while Trojan horses do not.

The key distinction between worms and Trojan horses is that worms have the capability to replicate and propagate themselves autonomously across networks and systems, while Trojan horses do not replicate themselves. Trojans require user action or delivery mechanisms to spread, whereas worms actively copy themselves and distribute to new hosts. This self-replication capability is the fundamental technical difference that defines a worm.

Why the other options are wrong

• A. Both Trojan horses and worms are forms of malicious code, so this statement is false.
• B. Both worms and Trojan horses are harmful to computers; worms are not less harmful.
• C. Trojan horses can also be distributed through emails; this is not an exclusive characteristic of worms.

Correct answer: D. Pre-attack phase

The pre-attack phase (also called reconnaissance) involves gathering information about the target through passive and active methods including whois queries, DNS enumeration, and network scanning. This information gathering helps map the target network and identify operating systems and applications before any actual attacks are conducted. This foundational phase precedes all active testing.

Why the other options are wrong

• A. Post-attack phase occurs after testing is complete and involves reporting and remediation.
• B. On-attack phase is not a standard penetration testing phase designation.
• C. Attack phase involves active exploitation, which comes after the reconnaissance and mapping described in the question.

Correct answer: C. Denial-of-Service (DoS) attack

A Denial-of-Service (DoS) attack is specifically designed to saturate network resources by flooding a target with excessive requests or traffic, thereby disrupting normal services to legitimate users of that computer or network.

Why the other options are wrong

• A. A Replay attack involves capturing and resending legitimate communications, not saturating network resources.
• B. A Teardrop attack exploits IP fragmentation vulnerabilities by sending fragmented packets, not by saturating resources.
• D. A Polymorphic shell code attack is a malware technique that changes its code, not an attack that saturates network resources.

Correct answer: C. Bonk

The Bonk attack sends corrupt or malformed UDP packets to Windows computers, causing them to crash or become unstable. This attack specifically targets Windows systems and exploits vulnerabilities in how Windows processes malformed UDP datagrams, making it a Windows-specific DoS attack.

Why the other options are wrong

• A. Fraggle attacks use ICMP echo requests sent to broadcast addresses, not corrupt UDP packets, and affect various systems.
• B. Ping flood attacks send numerous ICMP echo requests to overwhelm a target, not specifically sending corrupt UDP packets to Windows.
• D. Smurf attacks use spoofed ICMP echo requests sent to broadcast addresses to generate traffic, not corrupt UDP packets.