6.8 Identify the Vulnerability Exploited from an Initial Attack Vector CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A user receives a spearphishing email with a malicious attachment. After the user opens the attachment, the attacker gains initial access. Which of the following best describes the initial attack vector?

   • ADrive-by compromise
   • BPhishing
   • CValid accounts
   • DExploitation of a public-facing application
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is reviewing an alert where a user received an email with a link to a website that hosted a malicious JavaScript. The user visited the website, and the JavaScript exploited a vulnerability in the browser to execute code. The Falcon data shows that the browser process spawned a child process. Which initial attack vector is most likely?

   • AA phishing email with a malicious attachment
   • BA vulnerability in the email client
   • CA drive-by download from a malicious website
   • DA vulnerability in the operating system's network stack
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Falcon analyst is investigating a compromised workstation. The data shows that the initial process was 'winword.exe', which then spawned 'powershell.exe'. The analyst also sees that the user had previously opened a document from a shared network drive. The document was not from an external source. Which initial attack vector is most likely?

   • AA malicious document on the shared network drive
   • BA vulnerability in the network share service
   • CA phishing email with a malicious link
   • DA drive-by download from a malicious website
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An analyst observes that an attacker exploited a vulnerability in an Internet-facing web server to execute commands. Which initial attack vector is indicated by this evidence?

   • ASupply chain compromise
   • BPhishing
   • CExternal remote services
   • DExploitation of a public-facing application
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Falcon analyst observes a server that is directly exposed to the internet. The server is running an outdated version of a web application. The analyst sees a series of HTTP requests with unusual SQL syntax in the URL parameters, followed by a process spawning from the web server's working directory. Which vulnerability was most likely exploited?

   • AA denial-of-service vulnerability in the web server
   • BSQL injection in the web application
   • CA remote code execution vulnerability in the web application
   • DA cross-site scripting vulnerability in the web application
   Reveal Solution Discussion Select an answer first