SEC+ Ch.6 Review Test

A tech company recently discovered an attack on its organization, resulting in a significant data breach of customer data. After investigating the attack, they realized it was very sophisticated and likely originated from a foreign country. Which of the following identifies the MOST likely threat actor in this attack?

• Hacktivist

• APT

• Competitors

• Insiders

Answer explanation

B is correct. This was most likely an advanced persistent threat (APT) because it was a sophisticated attack and originated from a foreign country. A hacktivist launches attacks to further a cause, but the scenario didn’t mention any cause. Competitors might launch attacks, but they would typically focus on proprietary data rather than customer data. An insider would not launch attacks from a foreign country.

An attacker purchased an exploit on the Internet. He then used it to modify an item’s price in an online shopping cart during checkout. Which of the following BEST describes this attacker?

• Insider

• Script Kiddie

• Competitor

• Hacktivist

• APT

Answer explanation

B is correct. A script kiddie will typically obtain a ready-made exploit rather than code it himself. An insider would cause damage from within the network or use inside knowledge when attacking. A competitor is unlikely to purchase a single item at a lower price but would be more interested in gaining proprietary data. Hacktivists launch attacks as part of an activist movement, not to get a better price on an item. An advanced persistent threat (APT) is typically a state actor sponsored by a nation-state and will use advanced tools to launch sophisticated attacks, rather than just lowering a price for an item.

Lisa is a database administrator. She received a phone call from someone identifying himself as a representative from a known hardware vendor. He said he’s calling customers to inform them of a problem with database servers they’ve sold, but he said the problem only affects servers running a specific operating system version. He asks Lisa what operating system versions the company is running on their database servers. Which of the following BEST describes the tactic used by the caller in this scenario?

• Pretexting

• Tailgating

• Pharming

• Smishing

Answer explanation

A is correct. The caller is using the social engineering tactic of pretexting by setting up a scenario that has a better chance of getting someone to give him information. If he just asked for the operating system versions on the servers without a prepended scenario, his chance of success would be diminished. Tailgating is the practice of one person following closely behind another without showing credentials. A pharming attack attempts to manipulate the DNS name resolution process. Smishing is a form of phishing using text messages.

An attacker recently attacked a web server hosted by your company.

After investigating the attack, security professionals determined that the attacker used a previously unknown application exploit. Which of the following BEST identifies this attack?

• Buffer overflow

• Zero-day Attack

• Man-in-the-browser

• Integer overflow

Answer explanation

B is correct. A zero-day attack takes advantage of an undocumented exploit or an exploit that is unknown to the public. A buffer overflow attack sends unexpected data to a system to access system memory or cause it to crash. Although some buffer overflow attacks are unknown, others are known. If the server isn’t kept up to date with patches, it can be attacked with a known buffer overflow attack. A man-in-the-browser attack is a type of proxy Trojan horse that takes advantage of vulnerabilities in web browsers, not web servers. An integer overflow attack attempts to use or create a numeric value that is too big for an application to handle.

After Bart logged on to his computer, he was unable to access any data. Instead, his screen displayed a message indicating that unless he made a payment, his hard drive would be formatted, and he’d permanently lose access to his data. What does this indicate?

• Keylogger

• Ransomware

• Backdoor

• Trojan

Answer explanation

B is correct. Ransomware attempts to take control of user’s system or data and then demands payment (ransom) to return control. Keyloggers capture a user’s keystrokes and store them in a file. This file can be automatically sent to an attacker or manually retrieved depending on the keylogger. It’s possible that Bart’s computer was infected with a Trojan, which created a backdoor. However, not all Trojans or backdoor accounts demand payment as ransom.

Recently, malware on a computer at the Monty Burns Casino destroyed several important files after it detected that Homer was no longer employed at the casino. Which of the following BEST identifies this malware?

• Logic Bomb

• Rootkit

• Backdoor

• Spyware

Answer explanation

A is correct. A logic bomb executes in response to an event. In this scenario, the logic bomb is delivering its payload when it detects that Homer is no longer employed at the company. A rootkit doesn’t respond to an event. A backdoor provides another method of accessing a system, but it does not delete files. Spyware is software installed on user systems without their awareness or consent.

Maggie was on the programming team that developed an application used by your Human Resources department. Personnel use this application to store and manage employee data. Maggie programmed in the ability to access this application with a username and password that only she knows to perform remote maintenance on the application if necessary. Which of the following does this describe?

• Virus

• Worm

• Backdoor

• Trojan

Answer explanation

C is correct. A backdoor provides someone an alternative way of accessing a system or application, which is what Maggie created in this scenario. It might seem as though she’s doing so with good intentions, but if attackers discover a backdoor, they can exploit it. A virus is malicious code that attaches itself to an application and executes when the application runs, not code that is purposely written into the application. A worm is selfreplicating malware that travels throughout a network without the assistance of a host application or user interaction. A Trojan is software that looks like it has a beneficial purpose but includes a malicious component.

Homer complained of abnormal activity on his workstation. After investigating, an administrator discovered his workstation connects to systems outside the organization’s internal network using uncommon ports. The administrator discovered the workstation is also running several hidden processes. Which of the following choices BEST describes this activity?

• Rootkit

• Backdoor

• Spam

• Trojan

Answer explanation

A is correct. A rootkit typically runs hidden processes and it commonly attempts to connect to computers via the Internet. The scenario doesn’t address the initial infection. Although an attacker might have used a backdoor to access the user’s computer and install the rootkit, backdoors don’t run hidden processes. A Trojan is malware that looks like it’s beneficial, but it is malicious. Spam is unwanted email and is unrelated to this question.

Bart downloaded and installed the nmap security scanner fromhttps://passsecurityplus.com. After completing the install, he noticed that his browser’s home page and default search engine was changed. What is the MOST likely cause of the activity?

• PUP

• Fileless virus

• Worm

• Rootkit

Answer explanation

A is correct. A potentially unwanted program (PUP) is installed along with a desired program, and many PUPs hijack browsers by changing the home page and/or changing the default search engine. Because the user downloaded nmap from a site other than nmap.org, it is conceivable that the alternative site added PUPs to the nmap program. A fileless virus is a type of malicious software that runs in memory, often within a PowerShell script, instead of being a file that is written to disk. A worm is selfreplicating malware that travels throughout a network without the assistance of a host application or user interaction. A rootkit is a program or group of programs that provide root-level access to a system

Your SIEM system alerted on potential malicious activity from a systemin your network. After investigating the alert, you determine it was generated after it detected suspicious activity generated through a PowerShell script. Additionally, you verified that the system is sending traffic to and from an unknown IP address in the Internet. Which of the following is the BEST description of this threat?

• Ransonware

• Fileless virus

• Command and control

• Rootkit

Answer explanation

B is correct. This describes a fileless virus, which commonly injects PowerShell commands into existing scripts. Security information and event management (SIEM) systems can be configured to send alerts when PowerShell commands are detected. Ransomware typically encrypts data and the attacker then demands payment as ransom, but there isn’t any indication that a ransom is requested in this scenario. The fileless virus may have joined the computer to a botnet and the traffic to and from the unknown IP address may be a connection to a command and control server. However, there isn’t enough information to make this conclusion. A rootkit is a program or group of programs that provide root-level access to a system and hides itself to evade detection.