Threats, Threat Sources, and Vulnerabilities EHE Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A company's network administrator discovers that the firewall rule set has not been reviewed in two years, and several obsolete rules allow inbound RDP from the internet. Which vulnerability category does this represent, and what threat is most likely to exploit it?

   • AConfiguration vulnerability; an external attacker scanning for open RDP ports
   • BHuman-factor vulnerability; an insider who forgets to update the firewall
   • CPhysical vulnerability; a thief stealing the firewall hardware
   • DTechnical vulnerability; a natural disaster that disrupts the firewall
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   An organization discovers that several employees have written their passwords on sticky notes attached to their monitors. Which vulnerability category does this represent, and what is the most likely threat that could exploit it?

   • ATechnical vulnerability; a remote hacker exploiting a network service
   • BConfiguration vulnerability; a malware infection from a phishing email
   • CPhysical vulnerability; a natural disaster destroying the office
   • DHuman-factor vulnerability; an insider threat such as a curious coworker or a visitor who sees the password
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   An attacker sends a phishing email to employees, tricking them into entering their credentials on a fake login page. Which threat type is primarily being used?

   • ANatural disaster
   • BMalware
   • CSocial engineering
   • DPhysical threat
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A small business uses a legacy web application that still supports SSLv3. An attacker exploits this to decrypt session cookies. In this scenario, what is the vulnerability?

   • AThe attacker exploiting the weakness
   • BThe attacker's ability to intercept network traffic
   • CThe use of SSLv3, which has known cryptographic weaknesses
   • DThe session cookies being decrypted
   Reveal Solution Discussion Select an answer first