Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A developer is building a web form that allows users to change their email address. The form includes a hidden field with the user's ID. An attacker modifies the hidden field to another user's ID and submits the form, changing the victim's email address. Which type of attack is this, and what is the BEST defense?

   • ASession fixation; regenerate the session ID after login.
   • BSQL injection; use parameterized queries for the update statement.
   • CInsecure Direct Object Reference (IDOR); use server-side authorization checks and avoid exposing internal object references.
   • DCSRF; add anti-CSRF tokens to the form.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is investigating a workstation that is sending outbound connections to a known command-and-control server. The analyst finds a suspicious process running with SYSTEM privileges that was not started by any legitimate service. Which type of host-based attack is most likely occurring, and what is the FIRST step in containment?

   • APrivilege escalation; isolate the host from the network and terminate the suspicious process.
   • BUnauthorized access; change the user's password and enforce multi-factor authentication.
   • CDDoS; block the outbound IP address at the firewall.
   • DPacket sniffing; disable the network interface and capture traffic for analysis.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A developer is reviewing code for a web application that allows users to search a product database. The search query is inserted directly into a SQL statement without parameterization. Which attack is the application vulnerable to, and what is the BEST fix?

   • ACross-site request forgery; add a CSRF token to all forms.
   • BBuffer overflow; implement input length validation and use safe string functions.
   • CSQL injection; use parameterized queries or prepared statements.
   • DCross-site scripting; encode all user input before rendering it in HTML.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst notices that an internal web server is receiving a high volume of TCP SYN packets from many different source IP addresses, but the server never sends a SYN-ACK response. The server's connection table is filling up, and legitimate users are experiencing timeouts. Which type of attack is most likely occurring, and what immediate mitigation should the analyst recommend?

   • APing of death; block all ICMP traffic at the firewall and disable ICMP on the server.
   • BSmurf attack; configure the server to ignore broadcast ICMP requests and enable ingress filtering.
   • CTCP reset attack; block all TCP RST packets and require encrypted sessions for all clients.
   • DSYN flood DDoS; enable SYN cookies on the server and rate-limit incomplete connections at the perimeter firewall.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A network engineer is setting up a new wireless network for a small office. The engineer wants to prevent attackers from capturing sensitive data transmitted over the air. Which combination of controls would BEST mitigate packet sniffing on the wireless network?

   • ADisable SSID broadcast and enable MAC address filtering on the access point.
   • BUse WPA3-Enterprise with 802.1X authentication and enforce TLS for all internal web applications.
   • CUse WPA2-PSK with a strong passphrase and disable the guest network.
   • DSet the access point to use WEP with a 128-bit key to maximize compatibility.
   Reveal Solution Discussion Select an answer first