Common Attack Scenarios CT-STE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat modeling team is analyzing a new IoT device that collects health data from patients and transmits it to a cloud backend. The team identifies that the device uses unencrypted communication protocols. Which attack path should be prioritized in the threat model?

   • AAn attacker physically stealing the IoT device
   • BAn attacker intercepting the data in transit between the device and the cloud backend
   • CAn attacker brute-forcing the cloud backend's admin password
   • DAn attacker performing a denial-of-service attack on the cloud backend
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is considered an entry point for an attack on a software system?

   • AA backup tape stored offsite
   • BAn exposed API endpoint
   • CA secure coding standard
   • DA well-documented user manual
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A tester is reviewing a recent breach where attackers exploited a vulnerability in a third-party library used by the company's web application. The attackers then used the initial foothold to install a backdoor and maintain persistent access. Which defense strategy would have been MOST effective in preventing the initial compromise?

   • AEnforcing strong password policies for all users
   • BImplementing a Web Application Firewall (WAF) with custom rules
   • CDeploying an intrusion detection system (IDS) to monitor network traffic
   • DConducting regular vulnerability scans and applying patches promptly
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is deploying a new web application that will be accessible from the internet. The security team wants to implement a defense-in-depth strategy. Which combination of controls provides the MOST comprehensive defense?

   • AAn IPS and regular vulnerability scans
   • BA firewall, an intrusion prevention system (IPS), and a web application firewall (WAF)
   • CA WAF and security awareness training
   • DA firewall and strong password policies
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of input validation as a defense strategy?

   • ATo ensure that only properly formatted data is accepted by the application
   • BTo encrypt all data stored in the database
   • CTo monitor network traffic for suspicious activity
   • DTo provide a backup of all user data
   Reveal Solution Discussion Select an answer first