Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC analyst is monitoring network traffic and notices that a workstation is sending a large number of ARP replies claiming that its MAC address is the gateway's IP address. The analyst also sees that the workstation is receiving traffic that was destined for other hosts on the same subnet. Which attack is occurring, and what is the most effective mitigation?

   • ADDoS attack; block the workstation's IP address at the firewall
   • BARP spoofing, a man-in-the-middle attack; enable dynamic ARP inspection on the switch
   • CPrivilege escalation attack; reinstall the operating system on the workstation
   • DPacket sniffing attack; enable port security on the switch
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A SOC analyst is investigating an alert on a Windows workstation. The analyst finds that a legitimate user account has been added to the local Administrators group, and a scheduled task has been created that runs a PowerShell script to download and execute a binary from an external IP address. The user denies making these changes. Which type of attack is most likely occurring, and what is the best immediate containment action?

   • APacket sniffing attack; enable full disk encryption on the workstation
   • BApplication-based SQL injection attack; disable the web server
   • CNetwork-based MITM attack; change the user's password immediately
   • DHost-based attack involving privilege escalation and persistence; isolate the workstation from the network
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security administrator discovers that a user's workstation has been infected with ransomware. The ransomware encrypted the user's files and displayed a ransom note. The administrator has isolated the host. Which additional action should the administrator take to prevent the ransomware from spreading to other hosts?

   • ADisable the user's account and revoke any stored credentials that the host may have used.
   • BRun a full antivirus scan on the isolated host to remove the ransomware.
   • CPay the ransom to obtain the decryption key and recover the files quickly.
   • DRestore the user's files from the last backup immediately.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A user reports that their online banking session was used to transfer money to an attacker's account. The user did not enter any credentials during the transfer. The bank's web application uses session cookies and does not validate the Referer header. Which attack likely occurred, and what is the BEST defense?

   • ASession fixation; regenerate the session ID after login.
   • BXSS; sanitize all user input and use output encoding.
   • CCSRF; implement anti-CSRF tokens and validate the Origin/Referer header.
   • DSQL injection; use parameterized queries for all database access.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A user reports that their computer is running slowly and showing pop-up advertisements. The SOC analyst finds a suspicious browser extension that was installed without the user's knowledge. The extension has access to all websites the user visits. Which type of host-based attack is this, and what is the BEST immediate action?

   • AUnauthorized access; reset the user's password and enforce MFA.
   • BMalware (adware/browser hijacker); remove the extension and scan the host for other malicious software.
   • CPrivilege escalation; check the user's group memberships and remove any administrative rights.
   • DSQL injection; review the web application logs for suspicious queries.
   Reveal Solution Discussion Select an answer first