5.1 Define Key Security Concepts (threats, Vulnerabilities, Exploits, and Mitigation Techniques) 200-301 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A penetration tester is able to log in to a network switch using the default community string 'public' for SNMP. The tester then modifies the switch's configuration. Which vulnerability and exploit best describe this scenario?

   • AWeak configuration (default SNMP community) exploited via SNMP read-write access
   • BDenial-of-service attack via SNMP traffic flooding
   • CSoftware flaw in the switch firmware exploited via a buffer overflow
   • DPhishing attack against the network administrator
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An attacker sends a specially crafted input to a web application that takes advantage of a SQL injection flaw to retrieve the entire user database. Which term describes the action taken by the attacker?

   • AMitigation
   • BThreat
   • CVulnerability
   • DExploit
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small business runs a web server on an older operating system that no longer receives security updates. An attacker exploits a known buffer overflow in the web server software to install a backdoor. Which two concepts are demonstrated in this scenario?

   • AA threat actor exploiting a vulnerability to deliver an exploit
   • BA malware infection that creates a vulnerability in the operating system
   • CA vulnerability exploiting a threat to create a mitigation
   • DA mitigation technique preventing an exploit from reaching the server
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A company wants to reduce the risk of attackers exploiting known software vulnerabilities in its servers. Which mitigation technique directly addresses this goal?

   • AImplementing access control lists
   • BRegularly applying security patches
   • CConducting security awareness training
   • DEnforcing password complexity
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A security analyst discovers that a network switch has been left with the default administrative password, allowing unauthorized users to log in and change the configuration. Which type of vulnerability does this represent?

   • ASoftware flaw
   • BMisconfiguration
   • CWeak password
   • DExploit
   Reveal Solution Discussion Select an answer first