Attack Vectors CCOA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An employee accidentally sends an email containing a spreadsheet of customer PII to the wrong recipient because the autocomplete feature selected a similar-looking email address. The email was not encrypted. Which type of insider threat does this incident represent?

   • AA supply chain attack
   • BA phishing attack
   • CAn accidental insider threat
   • DA malicious insider threat
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why are zero-day exploits particularly dangerous as attack vectors?

   • ABecause there is no known defense or patch available at the time of the attack
   • BBecause they only affect legacy systems
   • CBecause they are always delivered via email attachments
   • DBecause they are always used by nation-state actors
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company uses a third-party SaaS application for HR management. The SaaS vendor announces a data breach that exposed employee records. An investigation reveals that the attacker compromised the vendor's development environment and injected malicious code into a routine software update, which was then deployed to all customers. The company's own security controls were not bypassed. Which attack vector best describes this incident, and what is the most effective preventive measure for the company?

   • ASupply chain attack; implement vendor risk management and verify software integrity
   • BInsider threat; implement data loss prevention (DLP)
   • CZero-day exploit; deploy an intrusion prevention system (IPS)
   • DPhishing attack; conduct security awareness training
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which attack vector exploits the lack of encryption in wireless networks to intercept data?

   • ARogue access point
   • BEvil twin
   • CPacket sniffing
   • DDeauthentication attack
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary goal of a phishing email that contains a malicious link?

   • ATo test the recipient's awareness of security policies
   • BTo trick the recipient into clicking the link, which may lead to credential theft or malware installation
   • CTo establish a persistent network connection for later use
   • DTo encrypt the recipient's files and demand a ransom
   Reveal Solution Discussion Select an answer first