Attack Types CCOA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A user reports that when they visit their online banking website, the page displays a warning about an invalid security certificate. After clicking through, they notice that their account balance appears different from what they expect. Later, they discover unauthorized transactions. Which attack is most likely responsible?

   • APhishing attack
   • BDenial-of-service attack
   • CSQL injection
   • DMan-in-the-middle (MitM) attack
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An employee accidentally clicks a malicious link in an email, which installs malware on the corporate network. How is this incident best classified?

   • AAdvanced persistent threat (APT)
   • BExternal threat
   • CInsider threat (malicious)
   • DInsider threat (accidental)
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A targeted phishing email is sent to the CFO of a company, using personal details gathered from social media to appear legitimate. Which social engineering technique does this describe?

   • AVishing
   • BWhaling
   • CBaiting
   • DSpear phishing
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A web application allows users to upload profile pictures. A security tester discovers that by uploading a file with a .html extension containing JavaScript, they can execute scripts in the context of other users' sessions when they view the profile. Which attack is this, and what is the most effective mitigation?

   • ASQL injection; use parameterized queries
   • BCSRF; implement anti-CSRF tokens
   • CStored XSS; validate and sanitize file uploads to only allow image types and serve them with appropriate content-type headers
   • DDirectory traversal; restrict file paths
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A security analyst is categorizing a set of observed incidents. Which incident is best classified as a social engineering attack?

   • AAn attacker sends a fraudulent email that tricks an employee into revealing their login credentials.
   • BAn attacker installs software that records keystrokes on a victim's computer without their knowledge.
   • CAn attacker exploits a buffer overflow vulnerability in a web server to execute arbitrary code.
   • DAn attacker floods a network with traffic to make a service unavailable to legitimate users.
   Reveal Solution Discussion Select an answer first