1.3 Identify and Describe Common Attack Types (e.g., Malware, Insider Threat, Command and Control [C2], Social Engineering, AI-powered) CYBERSECURITY-APPRENTICE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An employee accidentally sends a customer database to a personal email address instead of a colleague. Which type of insider threat does this represent?

   • AUnintentional insider
   • BSocial engineer
   • CExternal attacker
   • DMalicious insider
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An employee receives a phone call from someone claiming to be from the IT help desk. The caller says there is a critical security issue and asks the employee to verify their password to prevent account lockout. The employee provides their password. Which social engineering technique is being used?

   • APhishing, because the attacker uses email to deceive the victim
   • BBaiting, because the attacker offers something enticing to lure the victim
   • CPretexting, because the attacker creates a false scenario to obtain information
   • DTailgating, because the attacker follows the employee into a restricted area
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company's security team discovers that a critical server is infected with malware that encrypts files and demands a ransom. The team also finds that the malware communicates with an external C2 server. The company has backups, but they are also encrypted. Which of the following is the most likely reason the backups are encrypted?

   • AThe malware spread to the backup storage and encrypted the backups
   • BThe backups were already encrypted by the company for security
   • CThe C2 server encrypted the backups remotely
   • DThe backups were corrupted by a hardware failure
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During a security incident, a forensic analyst discovers that several compromised servers are periodically checking in with a domain that was registered just two weeks ago. The domain resolves to an IP address that also hosts a phishing page. Which of the following best describes the role of this domain in the attack?

   • AIt is the command-and-control server that coordinates the compromised servers
   • BIt is a malware dropper that delivered the initial payload
   • CIt is a data exfiltration server used to store stolen data
   • DIt is a phishing website that tricked users into downloading malware
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which type of malware is characterized by self-replication and spreading to other systems without requiring user interaction?

   • AVirus
   • BRansomware
   • CWorm
   • DTrojan
   Reveal Solution Discussion Select an answer first