Exploit Techniques CCOA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An attacker who has compromised one workstation wants to move to other systems in the network to reach a database server. This activity is best described as which post-exploitation action?

   • APersistence
   • BPrivilege escalation
   • CData exfiltration
   • DLateral movement
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is evaluating the risk of a new application that will be deployed to all employee workstations. The application processes untrusted files from the internet. The team is considering two mitigations: running the application in a sandbox and implementing strict application whitelisting. Which approach provides the most comprehensive defense against a client-side exploit, and why?

   • ASandboxing, because it prevents the exploit from executing at all by isolating the application.
   • BApplication whitelisting, because it prevents the malicious file from being opened by the application.
   • CSandboxing, because it contains the impact of a successful exploit by limiting the application's access to the OS and user data.
   • DApplication whitelisting, because it prevents the exploit from executing by blocking the malicious code.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is investigating an alert where a user clicked a link in a phishing email that led to a malicious website. The website then exploited a vulnerability in the user's browser to execute code. Which exploit delivery method and exploit category best describe this attack?

   • APhishing; local exploit.
   • BDrive-by download; remote exploit.
   • CDirect network exploitation; client-side exploit.
   • DPhishing; client-side exploit.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which exploit execution technique involves a program referencing memory that has already been freed, potentially allowing an attacker to control execution?

   • AUse-after-free
   • BCommand injection
   • CBuffer overflow
   • DInteger overflow
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A junior analyst is reviewing a security incident report. The report states that an attacker sent a specially crafted network packet to a vulnerable service, which caused the service to crash. The analyst notes that the attacker did not gain code execution. Which exploit category and execution mechanism best describe this incident?

   • ARemote exploit; denial-of-service via a buffer overflow that caused a crash.
   • BLocal exploit; denial-of-service via SQL injection.
   • CRemote exploit; persistence via code injection.
   • DClient-side exploit; privilege escalation via use-after-free.
   Reveal Solution Discussion Select an answer first