Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A web application allows users to upload profile pictures. The application stores the files on the server and serves them back with the original filename. An attacker uploads a file containing malicious JavaScript with an .html extension. When another user views the profile, the script executes. Which type of attack is this, and what is the BEST mitigation?

   • AFile inclusion vulnerability; restrict file paths and use a whitelist of allowed directories.
   • BCSRF; add anti-CSRF tokens to the file upload form.
   • CReflected XSS; encode all user input before reflecting it in the response.
   • DStored XSS; validate file types and serve uploaded files with a Content-Disposition header and a non-executable content type.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A standard user account on a Windows workstation is able to run administrative commands and modify system settings that should require administrator privileges. Which type of host-based attack has likely occurred?

   • ACross-site scripting (XSS)
   • BMalware
   • CPacket sniffing
   • DPrivilege escalation
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company runs a public-facing web application behind a load balancer. The SOC team has observed a gradual increase in traffic that is causing intermittent availability issues. The traffic pattern shows a mix of HTTP GET requests for a specific API endpoint and a large number of TCP connections that complete the handshake but send no data. The source IPs are distributed across many countries. The team has limited budget and must maintain service availability. Which action should the team take FIRST?

   • AImplement rate limiting on the API endpoint and configure the load balancer to drop connections that do not send data within a short timeout.
   • BIncrease the load balancer's connection timeout to allow more time for clients to send data.
   • CBlock all traffic from the countries where the source IPs are located.
   • DPurchase a commercial DDoS protection service that provides always-on mitigation.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A web application has been suffering from repeated SQL injection attempts. The development team has implemented parameterized queries, but the SOC team still sees malicious payloads in the logs. A deeper analysis reveals that the application also reflects user input in error messages without encoding, and the application uses a shared database account with elevated privileges. Which combination of issues is present, and what is the MOST comprehensive remediation?

   • AThe application is vulnerable to command injection; validate all input against a whitelist.
   • BResidual SQL injection risk and reflected XSS; implement output encoding and enforce least privilege for the database account.
   • CThe application is vulnerable to CSRF; add anti-CSRF tokens to all forms.
   • DThe parameterized queries are ineffective; rewrite all queries using stored procedures.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A network administrator discovers that an attacker has been intercepting and modifying traffic between a user's laptop and the company's mail server. The attacker used ARP spoofing to redirect traffic through their machine. Which additional security control would BEST prevent this type of attack from succeeding in the future?

   • ADisable all ICMP redirects on the mail server and block UDP port 53 on the firewall.
   • BImplement Dynamic ARP Inspection (DAI) on the switches and use encrypted protocols such as TLS for mail access.
   • CConfigure the mail server to use a static ARP entry for the default gateway.
   • DIncrease the ARP cache timeout on all client machines to reduce the frequency of ARP requests.
   Reveal Solution Discussion Select an answer first