2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a typical ransomware attack, what happens immediately after the ransomware encrypts the victim's files?

   • AThe malware deletes itself to avoid detection
   • BThe attacker immediately releases the decryption key
   • CThe system automatically restores the files from backup
   • DThe attacker displays a ransom note demanding payment
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A vulnerability scanner reports that a web application has a buffer overflow in a function that processes user input. The application is running on a server with ASLR and DEP enabled. Which statement best describes the likely impact and the need for further analysis?

   • AThe overflow can be exploited to execute arbitrary code only if the attacker knows the exact memory layout.
   • BThe overflow may still be exploitable despite ASLR and DEP, so a manual review is needed to determine if code execution is possible.
   • CThe overflow will only cause a denial of service because ASLR and DEP prevent any code execution.
   • DThe overflow is not a security issue because the application is not running with elevated privileges.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is reviewing a vulnerability report for a custom application. The report states that a buffer overflow exists in a function that is called with user-controlled input. The application is running on a system with ASLR, DEP, and stack canaries enabled. The analyst must decide whether to prioritize this vulnerability for patching. Which consideration is most important?

   • AThe vulnerability is only a denial-of-service risk because DEP prevents code execution.
   • BThe vulnerability is not exploitable because stack canaries always detect buffer overflows.
   • CThe vulnerability should be deprioritized because the application is not internet-facing.
   • DThe presence of stack canaries and ASLR makes exploitation more difficult, but the vulnerability should still be patched because these controls can be bypassed.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an incident investigation, an analyst observes that a compromised host is sending DNS queries to a domain that resolves to a server controlled by the attacker. The queries contain encoded data in the subdomain labels. The analyst also sees that the host receives TXT record responses that contain commands. Which statement best describes this C2 communication technique?

   • AHTTP tunneling is being used to hide C2 traffic inside web requests.
   • BThe host is performing a DNS rebinding attack to bypass same-origin policy.
   • CThe host is using a DNS sinkhole to block malicious domains.
   • DDNS tunneling is being used to encode C2 traffic in DNS queries and responses.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which action is typically performed by an attacker using C2 infrastructure?

   • AConfiguring the endpoint's firewall to block all traffic
   • BInstalling security patches from the vendor
   • CExfiltrating stolen data from the compromised endpoint
   • DUpdating the endpoint's antivirus definitions
   Reveal Solution Discussion Select an answer first