2.8 Describe Endpoint-Based Attacks, Such as Buffer Overflows, Command and Control (C2), Malware, and Ransomware 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company's security team is reviewing their ransomware response plan. They have a mix of on-premises servers and cloud-based file storage. The plan includes regular backups, but the backups are stored on the same network as the production servers. Which improvement would most effectively reduce the impact of a ransomware attack?

   • AIncrease the frequency of backups to every hour to minimize data loss.
   • BTrain users to recognize phishing emails to prevent initial infection.
   • CMove backups to an isolated, offline storage solution that is not accessible from the production network.
   • DUse cloud storage with versioning to allow rollback of encrypted files.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is reviewing an alert about a user who downloaded a file from a website that was compromised. The file appeared to be a PDF but actually contained executable code that installed a backdoor. Which infection vector best describes this scenario?

   • AEmail attachment
   • BRemovable media
   • CNetwork propagation
   • DMalicious download
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A developer reports that a legacy C application crashes when processing a specially crafted input file. The crash occurs because the application copies the file contents into a fixed-size stack buffer without validating the length. A security analyst is asked to explain the likely root cause. Which description best matches the vulnerability?

   • AThe application writes more data to the buffer than it can hold, overwriting adjacent memory locations.
   • BThe application reads data from memory that has not been initialized, exposing sensitive information.
   • CThe application fails to release allocated memory, causing a denial of service over time.
   • DThe application uses a pointer after the memory it references has been freed, causing a crash.
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A security analyst is reviewing a vulnerability report for a web application. The report states that a buffer overflow exists in a function that processes user-supplied input. The analyst must decide which mitigation is most effective to prevent exploitation of this vulnerability. Which approach is the most reliable?

   • AApply the vendor-provided patch that fixes the buffer overflow
   • BEnable stack canaries in the application's compiler settings
   • CRestrict network access to the application
   • DDeploy a web application firewall (WAF) to filter malicious input
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security operations center (SOC) is investigating a host that is beaconing to a domain that was recently registered and has a low reputation. The beaconing uses HTTP with a unique User-Agent string. The SOC wants to block the C2 traffic without disrupting legitimate web browsing. Which approach is most effective?

   • ADisable HTTP traffic entirely and require HTTPS for all web browsing.
   • BBlock the specific domain and User-Agent string at the proxy, while allowing other web traffic.
   • CBlock all HTTP traffic to domains with low reputation scores.
   • DCreate a firewall rule to block all traffic from the compromised host.
   Reveal Solution Discussion Select an answer first