4.2 - Understand Network Threats and Attacks CC Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a common output of a vulnerability scan?

   • AA blocklist of malicious IP addresses.
   • BA real-time alert when an attack is detected.
   • CA backup of critical system files.
   • DA list of identified vulnerabilities with severity ratings and remediation recommendations.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An employee at a law firm opens an email attachment named 'Invoice_Q3.docm' from an unknown sender. After opening it, the employee notices that several files on their local drive have been renamed with a '.encrypted' extension. The firm's antivirus software is up to date and running. What is the most likely reason the antivirus did not prevent this outcome?

   • AThe antivirus only detects viruses, not ransomware, which is a different category of malware
   • BThe antivirus relies on signature-based detection, and the malware was a new or polymorphic variant not yet in its database
   • CThe .docm file extension is not a recognized executable format, so the antivirus skipped it
   • DThe antivirus is configured to only scan files on the network share, not local drives
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a man-in-the-middle (MITM) attack?

   • AAn attack where the attacker secretly intercepts and possibly alters communication between two parties.
   • BAn attack that uses a botnet to distribute malware to multiple systems.
   • CAn attack that floods a target with traffic to make it unavailable.
   • DAn attack that exploits physical characteristics of a device to extract data.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary role of an Intrusion Detection System (IDS)?

   • ATo scan systems for known vulnerabilities and report them.
   • BTo filter traffic based on security rules to prevent unauthorized access.
   • CTo actively block malicious traffic in real time.
   • DTo monitor network traffic or system activity for signs of malicious behavior and alert administrators.
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   A security researcher is analyzing a smartcard used for building access. The researcher notices that the card's cryptographic operations take slightly longer when processing certain inputs. By measuring these timing variations, the researcher is able to extract the card's secret key. This is an example of which type of attack?

   • ATrojan horse, because the researcher disguised the measurement as a legitimate operation
   • BSide-channel attack, because it exploits the physical implementation of the cryptographic algorithm
   • CDDoS attack, because the researcher overwhelmed the card with requests
   • DMan-in-the-middle attack, because the researcher intercepted the communication between the card and the reader
   Reveal Solution Discussion Select an answer first