Attack Vectors CCOA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A system administrator with legitimate access to the company's customer database is observed copying large volumes of customer records to a personal USB drive during off-hours. The administrator has no business need for this data. Which type of threat does this action represent?

   • AA supply chain attack
   • BAn accidental insider threat
   • CA zero-day exploit
   • DA malicious insider threat
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which scenario best illustrates a supply chain attack?

   • AAn attacker exploits a SQL injection vulnerability in a company's website to extract customer data
   • BAn attacker uses a brute force attack to guess a user's password and access the network
   • CAn attacker sends a spear-phishing email to a company's CFO to steal credentials
   • DAn attacker compromises a software vendor's update server and distributes malware through a legitimate software update
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following best describes how attackers typically exploit a software vulnerability?

   • ABy tricking a user into revealing their password through a fake login page
   • BBy physically accessing the server to install malicious hardware
   • CBy overwhelming the network with traffic to cause a denial of service
   • DBy sending crafted input that triggers a flaw in the software's code to execute unauthorized actions
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a zero-day exploit?

   • AAn exploit that only works on the day the vulnerability is disclosed
   • BAn exploit that has been known for more than a day and has a patch available
   • CAn exploit that requires physical access to the target system
   • DAn exploit that targets a previously unknown vulnerability for which no patch is available
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of a malicious insider threat?

   • AAn employee accidentally clicks a phishing link and compromises their account
   • BA user forgets to lock their workstation, allowing a passerby to view sensitive information
   • CA disgruntled employee deliberately exfiltrates proprietary data before leaving the company
   • DA contractor leaves a laptop in a taxi, exposing sensitive data
   Reveal Solution Discussion Select an answer first