6.8 Identify the Vulnerability Exploited from an Initial Attack Vector CCFH Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A Falcon analyst is investigating a compromised web server. The server is running a custom web application and is behind a WAF. The analyst sees that the WAF logged a request with a payload that bypassed the WAF rules. The request was a POST to a file upload endpoint, and the response was a 200 OK. The analyst also sees that a process was spawned from the web root. Which vulnerability was most likely exploited?

   • AA file upload vulnerability that bypassed the WAF
   • BA vulnerability in the WAF itself
   • CA SQL injection vulnerability in the web application
   • DA cross-site scripting vulnerability in the web application
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Falcon administrator investigates an alert where a workstation established an outbound connection to a known malicious IP immediately after the user clicked a link in a phishing email. The connection occurred over port 443, and the process was a legitimate web browser. Reviewing the Falcon event data, the administrator sees the browser spawned a child process that was not a standard browser helper. Which vulnerability was most likely exploited as the initial attack vector?

   • AA privilege escalation vulnerability in the operating system
   • BA browser-based remote code execution vulnerability
   • CA network service vulnerability on the workstation
   • DA credential harvesting vulnerability in the email client
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization has a mix of legacy and modern systems. A legacy server running an outdated version of a database application is compromised. The Falcon data shows that the initial access was through a network connection to the database port, and the attacker was able to execute commands on the server. The analyst also notes that the server is not exposed to the internet but is on the internal network. Which vulnerability was most likely exploited?

   • AA brute-force attack on the database credentials
   • BA vulnerability in the firewall
   • CA vulnerability in the operating system's network stack
   • DA remote code execution vulnerability in the database application
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An attacker exploits a SQL injection vulnerability in a web application to extract sensitive data. Which vulnerability was exploited?

   • AA misconfiguration in the web server
   • BA lack of input validation in the web application
   • CA weak password on the database server
   • DAn unpatched operating system
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A Falcon analyst is investigating a compromised host that is part of a critical infrastructure environment. The host is not directly exposed to the internet but is accessible from a jump box. The analyst sees that the initial access was through a connection from the jump box, and the process that executed code was 'cmd.exe'. The analyst also notes that the jump box was recently compromised. Which initial attack vector is most likely?

   • AA vulnerability in the host's network service
   • BLateral movement from the compromised jump box
   • CA phishing email sent to the user
   • DA direct internet attack on the host
   Reveal Solution Discussion Select an answer first