Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A SOC analyst is reviewing network logs and notices that an internal host is sending a large number of ICMP echo requests to a broadcast address. The analyst suspects a Smurf attack. Which mitigation would be MOST effective in preventing the network from being used as an amplifier?

   • AImplement MAC address filtering on all switches to prevent spoofed MAC addresses.
   • BDisable ICMP on all internal hosts and block all ICMP traffic at the firewall.
   • CConfigure routers to drop directed broadcast traffic and enable ingress filtering at the network perimeter.
   • DIncrease the ARP cache timeout on all hosts to reduce the number of broadcast requests.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC analyst is reviewing a web application and notices that the application uses a hidden form field to store the user's role (e.g., 'user' or 'admin'). The analyst suspects that an attacker could modify this field to escalate privileges. Which attack is the analyst most concerned about, and what is the best mitigation?

   • ASQL injection; parameterize the role field in the database query
   • BCross-site scripting (XSS); encode the hidden field value
   • CDDoS attack; rate-limit the form submission endpoint
   • DPrivilege escalation via parameter tampering; store the role on the server-side session instead of a hidden field
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   An attacker submits the following input to a login form: `' OR '1'='1`. This input causes the application to return all user records instead of just the requested one. Which application-based attack is being performed?

   • APacket sniffing
   • BSQL injection
   • CCross-site scripting (XSS)
   • DCross-site request forgery (CSRF)
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A SOC analyst is reviewing web server logs and sees a request to a file upload endpoint that contains a filename with a path traversal payload: `../../../../etc/passwd`. The server responded with a 200 OK and the contents of the `/etc/passwd` file. Which attack is occurring, and what is the best mitigation?

   • ADDoS attack; rate-limit the file upload endpoint
   • BCross-site scripting (XSS); encode the filename in the response
   • CSQL injection; parameterize the file upload query
   • DPath traversal, an application-based attack; implement input validation and use a whitelist of allowed filenames
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC analyst notices that a web application's login page is receiving a high volume of requests from many different IP addresses, each attempting to submit a small number of login attempts with credentials that appear to be from a recent data breach. The requests are coming from legitimate browsers and the application is not crashing, but the account lockout policy is being triggered for many legitimate users. Which type of attack is the analyst most likely observing?

   • AA distributed denial-of-service (DDoS) attack that is overwhelming the login service with traffic
   • BA host-based privilege escalation attack that is using a vulnerability in the login module
   • CA man-in-the-middle (MITM) attack that is intercepting and replaying login credentials
   • DA distributed credential stuffing attack that is using a botnet to distribute login attempts across many source IPs
   Reveal Solution Discussion Select an answer first