Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC analyst is investigating a series of alerts on a web application. The analyst finds that an attacker has been able to submit a form that changes the user's email address without the user's knowledge. The application uses a session cookie for authentication, but does not use any anti-CSRF tokens. The analyst also notices that the application is vulnerable to XSS in the search field. Which attack is the most likely cause of the email change, and what is the best mitigation?

   • ACSRF attack; implement anti-CSRF tokens and also fix the XSS vulnerability
   • BSQL injection attack; parameterize the email update query
   • CMITM attack; enable HTTPS on the application
   • DPrivilege escalation attack; restrict the user's permissions
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's network has been experiencing intermittent connectivity issues. The SOC team discovers that an attacker has been performing ARP spoofing to intercept traffic between the gateway and several hosts. The team also finds that the attacker used the intercepted credentials to log into a server and install a backdoor. Which combination of attacks occurred, and what is the BEST overall mitigation strategy?

   • APacket sniffing and privilege escalation; disable the network interface and remove the user from the Administrators group.
   • BDDoS and malware; deploy a firewall and run antivirus scans.
   • CSQL injection and XSS; implement input validation and output encoding.
   • DMITM and unauthorized access; implement Dynamic ARP Inspection and enforce MFA for all server logins.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC analyst is investigating a server that has been compromised. The analyst finds that an attacker used a known vulnerability in the web server software to gain a foothold, then used a separate exploit to gain root access. Which combination of host-based attacks occurred, and what is the BEST defense-in-depth approach?

   • ASQL injection followed by XSS; implement input validation and output encoding.
   • BInitial exploitation followed by privilege escalation; patch the web server and implement host-based intrusion detection and least privilege.
   • CUnauthorized access followed by malware; reset all passwords and run antivirus scans.
   • DDDoS followed by packet sniffing; deploy a firewall and enable network monitoring.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A user downloads a file attachment from an email, and after opening it, the system starts running unauthorized processes and sending sensitive files to an external server. Which type of host-based attack is this?

   • APacket sniffing
   • BPrivilege escalation
   • CMalware
   • DUnauthorized access
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst is reviewing endpoint logs and sees that a standard user account has successfully executed a command that requires administrative privileges. The analyst checks the system and finds that the user is a member of the local Administrators group, which is unusual. Which type of host-based attack is this, and what is the BEST long-term remediation?

   • APrivilege escalation; remove the user from the Administrators group and implement least privilege.
   • BUnauthorized access; reset the user's password and enable MFA.
   • CPacket sniffing; disable the network interface and analyze captured traffic.
   • DMalware infection; run a full antivirus scan and remove the malicious process.
   Reveal Solution Discussion Select an answer first