1.3 Identify and Describe Common Attack Types (e.g., Malware, Insider Threat, Command and Control [C2], Social Engineering, AI-powered) CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is evaluating a new email security solution. They want to protect against AI-generated phishing emails that are highly personalized and evade traditional filters. Which of the following approaches would be most effective?

   • AUsing a signature-based antivirus to scan email attachments
   • BRequiring users to manually verify every email sender
   • CImplementing a solution that uses machine learning to analyze email content and sender behavior
   • DBlocking all emails from external domains
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following best describes a C2 channel?

   • AA secure VPN used by employees to access corporate resources
   • BA firewall rule that blocks malicious traffic
   • CA backup server for storing system logs
   • DA communication path between an attacker and compromised systems
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is investigating a series of compromised IoT devices in a smart building. The devices are sending small amounts of data to a domain that uses domain fronting to hide its true destination. The analyst suspects the devices are part of a botnet. Which of the following is the most likely purpose of the domain fronting?

   • ATo distribute malware updates to the compromised devices
   • BTo encrypt the data being exfiltrated from the devices
   • CTo hide the C2 server's true destination from network monitoring
   • DTo provide a legitimate service for the building's operations
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary role of command and control (C2) infrastructure in a botnet?

   • ATo coordinate and issue commands to compromised systems
   • BTo patch vulnerabilities on compromised systems
   • CTo encrypt the botnet's communication
   • DTo provide a backup for the attacker's data
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is investigating a data breach. The breach originated from a compromised employee account. The employee had access to sensitive data and had recently clicked a link in a phishing email. The security team finds that the employee's account was used to access the data at unusual times. Which of the following is the most likely cause of the breach?

   • AThe employee's credentials were stolen via phishing, and the attacker used them to access data
   • BThe employee's account was compromised by a malware infection
   • CThe employee intentionally exfiltrated the data
   • DThe employee's account was compromised by a C2 server
   Reveal Solution Discussion Select an answer first