Information Security Attacks CCT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A ransomware attack encrypts all files on a company's file server, and the attackers demand payment to decrypt them. The company's backup system was also compromised, so they cannot restore the data. Which primary impact does this attack have on the CIA triad?

   • ALoss of integrity
   • BLoss of non-repudiation
   • CLoss of availability
   • DLoss of confidentiality
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An employee receives an email that appears to be from the CEO, urgently requesting a wire transfer to a new vendor. The email address is slightly different from the CEO's real address. Which attack vector and attack type is being used?

   • AHuman vector; phishing (specifically business email compromise)
   • BPhysical vector; tailgating
   • CApplication vector; SQL injection
   • DNetwork vector; DDoS attack
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team notices a series of sophisticated attacks targeting a government research lab. The attacks use zero-day exploits and custom malware, and the attackers appear to have deep knowledge of the lab's internal systems. The motivation appears to be stealing classified research data. Which threat actor type is most likely responsible?

   • AScript kiddie
   • BInsider
   • CHacktivist
   • DState-sponsored group
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is investigating a breach. The attacker used a zero-day exploit to gain access, then moved laterally to the domain controller, and finally exfiltrated data over encrypted HTTPS. The analyst needs to determine the most effective way to detect similar attacks in the future. Which approach would be most effective?

   • AEnable verbose logging on all firewalls and review logs manually.
   • BImplement endpoint detection and response (EDR) with behavioral analytics.
   • CDeploy an intrusion detection system (IDS) that monitors for known attack signatures.
   • DDeploy a web application firewall (WAF) to block SQL injection.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A manufacturing company discovers that a former employee's credentials were used to access the HR database at 2:00 AM over the weekend. The account had been disabled two weeks prior, but the logs show the authentication succeeded. The company suspects an insider. Which combination of factors most strongly supports the insider threat hypothesis?

   • AThe login originated from the company's on-premises VPN IP range and used a valid token that was not revoked.
   • BThe login occurred after a phishing email was sent to the employee's personal email address.
   • CThe login used a newly created service account that had not been used for months.
   • DThe login came from a foreign IP address and used a password that matched a breach database.
   Reveal Solution Discussion Select an answer first