Attack Vectors CCOA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security guard finds an unattended USB drive in the company parking lot. An employee picks it up, plugs it into their workstation, and opens a file labeled 'Salary_Report.xlsx'. The workstation immediately shows signs of malware infection. Which attack vector was exploited in this scenario?

   • AA physical USB drop attack
   • BA drive-by download attack
   • CA phishing email attack
   • DA credential theft attack
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company discovers that a software update pushed by a third-party vendor to all employee workstations contained malware. The vendor's update server had been compromised, and the attacker injected malicious code into the update package. Which type of attack vector does this incident represent?

   • AA physical attack vector
   • BA supply chain attack
   • CA wireless network attack
   • DA phishing attack
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security analyst is investigating a breach where an attacker stole customer data from a web application. The analyst finds that the attacker submitted a crafted request to the application's login form that included a malicious SQL payload. The application returned an error message that revealed the database schema. The attacker then used this information to extract data from the database. Which attack vector was used, and what is the most effective remediation?

   • AZero-day exploit; implement intrusion detection and patch management
   • BCross-site scripting (XSS); implement output encoding and content security policy
   • CSQL injection; implement parameterized queries and disable verbose error messages
   • DCredential theft via phishing; implement MFA and security awareness training
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An employee receives an email from an unknown sender with a subject line 'Urgent: Invoice Overdue'. The email contains a link to a document-sharing site. When the employee clicks the link, a file downloads and the employee opens it. Shortly after, the employee's machine begins exhibiting unusual behavior, including high CPU usage and outbound network connections. Which attack vector was most likely used to deliver the malware?

   • AA phishing email with a malicious attachment
   • BA physical USB drop attack in the parking lot
   • CA brute-force attack on the employee's credentials
   • DA malicious link that triggered a drive-by download
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   An attacker sends an email with a PDF attachment that contains a malicious macro. What is the primary delivery method being used?

   • AWatering hole
   • BDrive-by download
   • CEmail attachment
   • DMalicious link
   Reveal Solution Discussion Select an answer first