Network-Based, Application-Based, and Host-Based Attacks SCE Practice Questions (Page 9)

Questions 41–42

1. 41application · medium

   A SOC analyst is monitoring network traffic and sees a large volume of UDP packets sent to a single IP address on port 53. The packets have spoofed source IP addresses, and the destination is a DNS server. The analyst also notices that the DNS server is responding to these queries, and the responses are larger than the queries. Which attack is occurring, and what is the best mitigation?

   • ADNS amplification, a type of DDoS attack; configure the DNS server to disable recursion for external queries
   • BHost-based privilege escalation attack; patch the DNS server operating system
   • CPacket sniffing attack; enable DNSSEC on the DNS server
   • DDNS tunneling, a type of MITM attack; block port 53 on the firewall
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company's web application has been defaced. The SOC team finds that the attacker exploited a file upload vulnerability to upload a web shell, then used the web shell to modify the website's HTML files. The application runs on a shared hosting environment where the web server process runs with high privileges. Which combination of vulnerabilities contributed to the incident, and what is the BEST remediation?

   • APrivilege escalation and unauthorized access; reset all passwords and enable MFA.
   • BSQL injection and XSS; use parameterized queries and output encoding.
   • CDDoS and packet sniffing; deploy a firewall and enable traffic encryption.
   • DFile upload vulnerability and excessive privileges; implement strict file type validation and run the web server with least privilege.
   Reveal Solution Discussion Select an answer first