Common Attack Scenarios CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a typical attack lifecycle, which phase involves gathering information about the target system, such as open ports, software versions, and user accounts?

   • AExploitation
   • BDelivery
   • CReconnaissance
   • DPost-exploitation
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is deploying a new web application that will be accessible from the internet. The security team has a limited budget and must choose between implementing a Web Application Firewall (WAF) or conducting a thorough code review. The application is developed in-house and has not been tested for security. Which option is the BEST use of the limited budget?

   • AConducting a thorough code review, as it identifies and fixes vulnerabilities at the source
   • BImplementing a WAF, as it provides immediate protection against known attacks
   • CImplementing a WAF and conducting a code review, as both are necessary
   • DDeploying the application and monitoring for attacks, as this is the most cost-effective approach
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In scenario-based threat modeling, what is the purpose of creating attack scenarios?

   • ATo describe specific ways an attacker could exploit the system
   • BTo document the system architecture in detail
   • CTo provide a list of all security requirements for the system
   • DTo replace the need for penetration testing
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which phase of the attack lifecycle typically follows successful exploitation and involves actions such as privilege escalation, lateral movement, and data exfiltration?

   • APost-exploitation
   • BWeaponization
   • CReconnaissance
   • DExploitation
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security tester is assessing a web application that uses a third-party authentication service (e.g., OAuth). The tester discovers that the application does not validate the 'state' parameter in the OAuth flow. Which attack is MOST directly enabled by this weakness?

   • ACross-site scripting (XSS) in the login page
   • BDenial of service on the authentication service
   • CCross-site request forgery (CSRF) on the login flow
   • DSQL injection into the authentication database
   Reveal Solution Discussion Select an answer first