Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has a mix of Windows and Linux servers. The SOC team has detected a host-based attack where a process is running with root privileges on a Linux server, but the process was started by a non-root user. The team suspects a kernel vulnerability was exploited. The server is business-critical and cannot be rebooted during business hours. Which action should the team take to balance security and availability?

   • ARestore the server from a backup taken before the attack.
   • BKill the malicious process and continue monitoring; no further action is needed.
   • CIsolate the server from the network, snapshot the memory for forensics, and apply a hot patch if available; schedule a reboot during the next maintenance window.
   • DImmediately reboot the server to clear the malicious process from memory.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SOC analyst is reviewing web server logs and sees a request to a search endpoint that contains the following URL-encoded parameter: `q=1%27%20OR%20%271%27%3D%271`. The application returned an HTTP 200 response with a database error message in the body. Which attack technique is being attempted, and what is the most immediate next step for the analyst?

   • ACross-site scripting (XSS); block the source IP address immediately
   • BSQL injection; report the finding and recommend input validation and parameterized queries
   • CCross-site request forgery (CSRF); reset all user sessions
   • DPacket sniffing; enable encryption on the web server
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A SOC team is responding to a ransomware incident. The ransomware has encrypted files on several servers and workstations. The team has isolated the affected hosts, but they are unsure how the ransomware initially gained access. The logs show that a user clicked a phishing link and entered their credentials on a fake login page. The user's account had administrative rights on several servers. Which combination of attack types occurred, and what is the MOST effective long-term prevention?

   • ADDoS and MITM; deploy a firewall and use VPN for remote access.
   • BSQL injection and XSS; implement input validation and output encoding.
   • CUnauthorized access and malware; reset all passwords and run antivirus scans.
   • DPhishing (social engineering) and privilege escalation; implement security awareness training and enforce least privilege.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A SOC analyst is investigating a report of slow network performance. The analyst captures traffic and sees a large number of UDP packets sent to a single IP address, with the source IP spoofed to be the company's DNS server. The packets are directed at port 53 of the victim. Which attack is this, and what is the primary purpose of spoofing the source IP?

   • ADNS cache poisoning; the spoofed source IP is used to inject false records into the victim's DNS cache.
   • BSmurf attack; the spoofed source IP causes the victim to receive ICMP echo replies from all hosts on the network.
   • CDNS amplification; the spoofed source IP makes the victim appear to be the requester, so the response is sent to the victim.
   • DUDP flood; the spoofed source IP hides the attacker's identity but does not affect the direction of the traffic.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC analyst is investigating an incident where an attacker intercepted a user's session cookie and used it to access the user's account. The analyst discovers that the application uses HTTP without TLS and sets cookies without the Secure flag. The application also allows session IDs to be passed in the URL. Which combination of weaknesses allowed this attack, and what is the BEST remediation?

   • ACSRF attack; add anti-CSRF tokens and validate the Origin header.
   • BPrivilege escalation; remove the user from the Administrators group.
   • CSQL injection; use parameterized queries and input validation.
   • DSession hijacking via packet sniffing and URL leakage; enforce HTTPS with HSTS and set cookies with the Secure and HttpOnly flags.
   Reveal Solution Discussion Select an answer first