A SOC analyst is investigating a network that has been compromised. The analyst finds that an attacker has been able to intercept traffic between a client and a server. The analyst also notices that the server is vulnerable to a known exploit that allows remote code execution. Which attack is the most likely cause of the compromise, and what is the best mitigation?

DDoS attack; rate-limit the server

MITM attack; enable HTTPS and patch the server vulnerability

SQL injection attack; parameterize the server's queries

Privilege escalation attack; restrict user permissions

A user visits a trusted website and unknowingly executes a malicious script that was injected into the page by an attacker. The script then steals the user's session cookie and sends it to the attacker. Which application-based attack is this?

Cross-site request forgery (CSRF)

A security analyst notices a large volume of UDP traffic flooding a single server from many different source IP addresses, causing the server to become unresponsive. Which type of network-based attack is this?

Distributed denial-of-service (DDoS)

A SOC analyst is investigating a web application that has been compromised. The analyst finds that the application is vulnerable to XSS, and that an attacker has been able to steal session cookies from users. The analyst also notices that the application uses HTTP only, not HTTPS. Which attack is the most likely cause of the session cookie theft, and what is the best mitigation?

MITM attack; enable HTTPS on the application

Privilege escalation attack; restrict user permissions

SQL injection attack; parameterize the session query

XSS attack; fix the XSS vulnerability and enable HTTPS with Secure and HttpOnly cookie flags

Which attack involves an attacker positioning themselves between two communicating parties to intercept or alter the traffic without either party knowing?

Distributed denial-of-service (DDoS)

EC-CouncilSOC Essentials

Domain 2Objective 3

Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 5)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

3concepts

Questions 21–25

21expert · hard
A SOC analyst is investigating a network that has been compromised. The analyst finds that an attacker has been able to intercept traffic between a client and a server. The analyst also notices that the server is vulnerable to a known exploit that allows remote code execution. Which attack is the most likely cause of the compromise, and what is the best mitigation?
Select an answer first
22foundation · easy
A user visits a trusted website and unknowingly executes a malicious script that was injected into the page by an attacker. The script then steals the user's session cookie and sends it to the attacker. Which application-based attack is this?
Select an answer first
23foundation · easy
A security analyst notices a large volume of UDP traffic flooding a single server from many different source IP addresses, causing the server to become unresponsive. Which type of network-based attack is this?
Select an answer first
24expert · hard
A SOC analyst is investigating a web application that has been compromised. The analyst finds that the application is vulnerable to XSS, and that an attacker has been able to steal session cookies from users. The analyst also notices that the application uses HTTP only, not HTTPS. Which attack is the most likely cause of the session cookie theft, and what is the best mitigation?
Select an answer first
25foundation · easy
Which attack involves an attacker positioning themselves between two communicating parties to intercept or alter the traffic without either party knowing?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 5)

Questions 21–25

A user visits a trusted website and unknowingly executes a malicious script that was injected into the page by an attacker. The script then steals the user's session cookie and sends it to the attacker. Which application-based attack is this?

A security analyst notices a large volume of UDP traffic flooding a single server from many different source IP addresses, causing the server to become unresponsive. Which type of network-based attack is this?

Which attack involves an attacker positioning themselves between two communicating parties to intercept or alter the traffic without either party knowing?

Keep studying — Fundamentals of Cyber Threats