Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC analyst is monitoring network traffic and sees that a workstation is sending a large number of TCP SYN packets to a server on port 80, but the server is not responding with SYN-ACK packets. The analyst also notices that the source IP address of the SYN packets is spoofed and changes frequently. Which attack is occurring, and what is the best mitigation?

   • APacket sniffing attack; enable port security on the switch
   • BMITM attack; enable HTTPS on the server
   • CPrivilege escalation attack; patch the server's operating system
   • DSYN flood, a type of DDoS attack; enable SYN cookies on the server
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst is reviewing a web application that allows users to post comments. The analyst notices that the application reflects user input in the page without sanitization. An attacker could craft a URL that, when clicked by a victim, executes JavaScript in the victim's browser. Which type of attack is this, and what is the BEST mitigation?

   • ASQL injection; use parameterized queries for all database access.
   • BCSRF; add anti-CSRF tokens to all forms and validate the Origin header.
   • CStored XSS; sanitize input before storing it in the database.
   • DReflected XSS; implement output encoding and a Content Security Policy (CSP).
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SOC analyst is investigating a server that was compromised. The analyst finds a new user account with UID 0 on a Linux system, and the `/etc/passwd` file has been modified to grant this user a shell. The analyst also sees that the server is sending outbound connections to an IP address known to be a command-and-control server. Which type of attack is most likely, and what is the best immediate action?

   • AApplication-based SQL injection attack; patch the web application
   • BPacket sniffing attack; enable network encryption on the server
   • CHost-based attack with privilege escalation and backdoor; isolate the server and preserve evidence
   • DNetwork-based MITM attack; change the server's DNS settings
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst is reviewing network traffic and sees a TCP handshake to a web server on port 443. The handshake completes, but then the client sends a series of incomplete HTTP requests that never finish. The server is consuming resources waiting for the requests to complete, and the analyst notices that many other clients are doing the same thing. Which attack is occurring, and what is the best mitigation?

   • ACross-site scripting (XSS); sanitize HTTP request headers
   • BSQL injection; enable input validation on the web server
   • CSlowloris, a type of DDoS attack; configure the web server to limit the time a connection can remain idle
   • DPrivilege escalation; patch the web server operating system
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A SOC analyst is investigating a compromised Linux server. The analyst finds a new user account with UID 0 and a modified `/etc/passwd` file. The analyst also sees that the server is sending outbound connections to an IP address on port 4444. The server is also running a web application that is vulnerable to SQL injection. Which attack is the most likely initial vector, and what is the best immediate action?

   • ASQL injection was used to gain initial access, and the attacker escalated privileges and installed a backdoor; isolate the server and preserve evidence
   • BPacket sniffing was used to capture credentials, and the attacker used them to escalate privileges; enable network encryption
   • CMITM attack was used to intercept credentials, and the attacker used them to create a backdoor; change the server's DNS settings
   • DDDoS attack was used to overwhelm the server, and the attacker took advantage of the downtime; patch the web application
   Reveal Solution Discussion Select an answer first