Chapter 1
Threats, Attacks, and Vulnerabilities

THE COMPTIA SECURITY+ EXAM SY0-601 TOPICS COVERED IN THIS CHAPTER INCLUDE THE FOLLOWING:

• 1.1 Compare and contrast different types of social engineering techniques
• 1.2 Given a scenario, analyze potential indicators to determine the type of attack
• 1.3 Given a scenario, analyze potential indicators associated with application attacks
• 1.4 Given a scenario, analyze potential indicators associated with network attacks
• 1.5 Explain different threat actors, vectors, and intelligence sources
• 1.6 Explain the security concerns associated with various types of vulnerabilities
• 1.7 Summarize the techniques used in security assessments
• 1.8 Explain the techniques used in penetration testing

1. Ahmed is a sales manager with a major insurance company. He has received an email that is encouraging him to click on a link and fill out a survey. He is suspicious of the email, but it does mention a major insurance association, and that makes him think it might be legitimate. Which of the following best describes this attack?
   1. Phishing
   2. Social engineering
   3. Spear phishing
   4. Trojan horse
2. You are a security administrator for a medium-sized bank. You have discovered a piece of software on your bank's database server that is not supposed to be there. It appears that the software will begin deleting database files if a specific employee is terminated. What best describes this?
   1. Worm
   2. Logic bomb
   3. Trojan horse
   4. Rootkit
3. You are responsible for incident response at Acme Bank. The Acme Bank website has been attacked. The attacker used the login screen, but rather than enter login credentials, they entered some odd text: ' or '1' = '1 . What is the best description for this attack?
   1. Cross-site scripting
   2. Cross-site request forgery
   3. SQL injection
   4. ARP poisoning
4. Users are complaining that they cannot connect to the wireless network. You discover that the WAPs are being subjected to a wireless attack designed to block their Wi-Fi signals. Which of the following is the best label for this attack?
   1. IV attack
   2. Jamming
   3. WPS attack
   4. Botnet
5. Frank is deeply concerned about attacks to his company's e-commerce server. He is particularly worried about cross-site scripting and SQL injection. Which of the following would best defend against these two specific attacks?
   1. Encrypted web traffic
   2. Input validation
   3. A firewall
   4. An IDS
6. You are responsible for network security at Acme Company. Users have been reporting that personal data is being stolen when using the wireless network. They all insist they only connect to the corporate wireless access point (AP). However, logs for the AP show that these users have not connected to it. Which of the following could best explain this situation?
   1. Session hijacking
   2. Clickjacking
   3. Rogue access point
   4. Bluejacking
7. What type of attack depends on the attacker entering JavaScript into a text area that is intended for users to enter text that will be viewed by other users?
   1. SQL injection
   2. Clickjacking
   3. Cross-site scripting
   4. Bluejacking
8. Rick wants to make offline brute-force attacks against his password file very difficult for attackers. Which of the following is not a common technique to make passwords harder to crack?
   1. Use of a salt
   2. Use of a pepper
   3. Use of a purpose-built password hashing algorithm
   4. Encrypting password plain text using symmetric encryption
9. What term is used to describe spam over Internet messaging services?
   1. SPIM
   2. SMSPAM
   3. IMSPAM
   4. TwoFaceTiming
10. Susan is analyzing the source code for an application and discovers a pointer de-reference and returns NULL. This causes the program to attempt to read from the NULL pointer and results in a segmentation fault. What impact could this have for the application?
    1. A data breach
    2. A denial-of-service condition
    3. Permissions creep
    4. Privilege escalation
11. Teresa is the security manager for a mid-sized insurance company. She receives a call from law enforcement, telling her that some computers on her network participated in a massive denial-of-service (DoS) attack. Teresa is certain that none of the employees at her company would be involved in a cybercrime. What would best explain this scenario?
    1. It is a result of social engineering.
    2. The machines all have backdoors.
    3. The machines are bots.
    4. The machines are infected with crypto-viruses.
12. Unusual outbound network traffic, geographical irregularities, and increases in database read volumes are all examples of what key element of threat intelligence?
    1. Predictive analysis
    2. OSINT
    3. Indicators of compromise
    4. Threat maps
13. Chris needs visibility into connection attempts through a firewall because he believes that a TCP handshake is not properly occurring. What security information and event management (SIEM) capability is best suited to troubleshooting this issue?
    1. Reviewing reports
    2. Packet capture
    3. Sentiment analysis
    4. Log collection and analysis
14. Chris wants to detect a potential insider threat using his security information and event management (SIEM) system. What capability best matches his needs?
    1. Sentiment analysis
    2. Log aggregation
    3. Security monitoring
    4. User behavior analysis
15. Chris has hundreds of systems spread across multiple locations and wants to better handle the amount of data that they create. What two technologies can help with this?
    1. Log aggregation and log collectors
    2. Packet capture and log aggregation
    3. Security monitoring and log collectors
    4. Sentiment analysis and user behavior analysis
16. What type of security team establishes the rules of engagement for a cybersecurity exercise?
    1. Blue team
    2. White team
    3. Purple team
    4. Red team
17. Cynthia is concerned about attacks against an application programming interface (API) that her company provides for its customers. What should she recommend to ensure that the API is only used by customers who have paid for the service?
    1. Require authentication.
    2. Install and configure a firewall.
    3. Filter by IP address.
    4. Install and use an IPS.
18. What type of attack is based on sending more data to a target variable than the data can actually hold?
    1. Bluesnarfing
    2. Buffer overflow
    3. Bluejacking
    4. Cross-site scripting
19. An email arrives telling Gurvinder that there is a limited time to act to get a software package for free and that the first 50 downloads will not have to be paid for. What social engineering principle is being used against him?
    1. Scarcity
    2. Intimidation
    3. Authority
    4. Consensus
20. You have been asked to test your company network for security issues. The specific test you are conducting involves primarily using automated and semiautomated tools to look for known vulnerabilities with the various systems on your network. Which of the following best describes this type of test?
    1. Vulnerability scan
    2. Penetration test
    3. Security audit
    4. Security test
21. Susan wants to reduce the likelihood of successful credential harvesting attacks via her organization's commercial websites. Which of the following is not a common prevention method aimed at stopping credential harvesting?
    1. Use of multifactor authentication
    2. User awareness training
    3. Use of complex usernames
    4. Limiting or preventing use of third-party web scripts and plugins
22. Greg wants to gain admission to a network which is protected by a network access control (NAC) system that recognized the hardware address of systems. How can he bypass this protection?
    1. Spoof a legitimate IP address.
    2. Conduct a denial-of-service attack against the NAC system.
    3. Use MAC cloning to clone a legitimate MAC address.
    4. None of the above
23. Coleen is the web security administrator for an online auction website. A small number of users are complaining that when they visit the website it does not appear to be the correct site. Coleen checks and she can visit the site without any problem, even from computers outside the network. She also checks the web server log and there is no record of those users ever connecting. Which of the following might best explain this?
    1. Typo squatting
    2. SQL injection
    3. Cross-site scripting
    4. Cross-site request forgery
24. The organization that Mike works in finds that one of their domains is directing traffic to a competitor's website. When Mike checks, the domain information has been changed, including the contact and other administrative details for the domain. If the domain had not expired, what has most likely occurred?
    1. DNS hijacking
    2. An on-path attack
    3. Domain...