Emerging Threats, Threat Actors, and Attack Vectors TIE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is reviewing an incident where an attacker gained access to a company's network by sending a malicious link to an employee via a social media message. The link led to a fake login page that captured the employee's credentials. Which attack vector is being used?

   • ASQL injection attack
   • BSocial engineering via phishing
   • CZero-day exploit
   • DMan-in-the-middle (MITM) attack
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's HR department received an email that appears to be from the CEO, urgently requesting that all employees' W-2 forms be emailed to a specified address. The email address is slightly different from the CEO's real address. Which attack vector is being used?

   • ABusiness email compromise (BEC) via email spoofing.
   • BVishing (voice phishing) through a phone call.
   • CSpear phishing with a malicious attachment.
   • DSmishing through a text message.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst notices that a user's account is sending a large number of emails with malicious links to internal and external recipients. The user's workstation is also exhibiting unusual behavior. Which attack vector is most likely being used in this scenario?

   • ADNS spoofing to redirect users to a fake login page
   • BMan-in-the-middle (MITM) attack on the network
   • CSQL injection on a web application
   • DCompromised legitimate account used for phishing
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A hospital's network has been infected with a new variant of ransomware that not only encrypts files but also uses living-off-the-land binaries (LOLBins) to spread laterally. The hospital's IT team has isolated the infected systems, but they are unsure if the ransomware has exfiltrated any patient data. The hospital must comply with healthcare data breach notification laws. What is the most appropriate immediate action?

   • ARestore systems from backups and assume no data was exfiltrated because the ransomware only encrypted files.
   • BConduct a forensic investigation to determine the scope of the infection and whether data was exfiltrated, while preserving evidence.
   • CImmediately notify all patients that their data may have been compromised, even without confirmation.
   • DPay the ransom to ensure the attackers delete any stolen data.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is investigating a breach where the attacker used a combination of a watering-hole attack and a zero-day exploit to compromise a user's system. The attacker then used the compromised system to pivot to other systems. The team must determine the most effective way to prevent similar attacks in the future. Which strategy is most effective?

   • ACombine web filtering, patch management, and network segmentation
   • BImplement a web filtering solution to block access to known malicious sites
   • CDeploy a patch management solution to ensure all systems are patched
   • DUse network segmentation to limit lateral movement
   Reveal Solution Discussion Select an answer first