Emerging Threats, Threat Actors, and Attack Vectors TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A small business has a website that allows users to upload profile pictures. Recently, attackers have been uploading files that contain malicious scripts, and when other users view the profiles, the scripts execute in their browsers. Which attack vector is being exploited?

   • AMan-in-the-middle attack intercepting the uploaded files.
   • BSQL injection through the file upload form.
   • CStored cross-site scripting (XSS) via malicious file uploads.
   • DCross-site request forgery (CSRF) using a malicious image.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A software development company uses a public code repository to host some of its open-source projects. A developer accidentally commits a file containing AWS access keys. Within hours, the company notices unusual activity in their AWS account. What is the most likely attack vector that was exploited?

   • ACredential leakage through a public repository, leading to unauthorized access.
   • BA supply chain attack on the open-source library used by the project.
   • CA brute-force attack on the AWS account password.
   • DA phishing email sent to the developer to steal the keys.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A regional hospital's IT team notices an increasing number of phishing emails that contain realistic-looking but fake Microsoft 365 login pages. The emails are personalized with the recipient's name and job title, and they reference recent internal projects. The hospital's security team wants to reduce the risk of credential theft. Which combination of actions would be most effective?

   • ARequire users to change their passwords every 30 days.
   • BBlock all inbound email from external domains that are not on an approved sender list.
   • CEnable multi-factor authentication (MFA) for all user accounts and conduct a targeted phishing simulation campaign.
   • DDeploy an email gateway that quarantines all messages containing links to external login pages.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A regional hospital's security team notices an increase in phishing emails that contain realistic-looking but fake invoices from a known medical supplier. The emails include a link to a credential-harvesting page that mimics the supplier's portal. The team suspects a specific threat actor. Which combination of threat actor profile and attack vector best matches this scenario?

   • AFinancially motivated cybercriminal group using spear-phishing with a credential-harvesting link
   • BInsider threat using a USB drop attack in the hospital parking lot
   • CHacktivist collective using a distributed denial-of-service (DDoS) attack on the hospital's public website
   • DNation-state espionage group using a watering-hole attack on a medical forum
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which characteristic is most typical of a ransomware-as-a-service (RaaS) operation?

   • AThe ransomware is designed to steal intellectual property rather than encrypt files or demand payment.
   • BThe ransomware is exclusively developed and deployed by a single state-sponsored group with no external involvement.
   • CAffiliates pay a fee or share a percentage of ransom payments to use the ransomware developed by the core group.
   • DThe ransomware is distributed only through physical media, such as USB drives, to avoid detection.
   Reveal Solution Discussion Select an answer first