037_Misconfiguration Vulnerabilities – CompTIA Security+

What common cloud service was involved in the 2017 Verizon data leak?

• Amazon S3

• Google Cloud Storage

• Dropbox

• Azure Blob Storage

• iCloud

Why are administrator accounts high-value targets for attackers?

• They provide elevated access to critical system functions

• They are always online

• They are immune to brute-force attacks

• They use two-factor authentication by default

• They contain no sensitive information

What password is considered weak and commonly exploited?

• 123456

• Pa$$w0rd!

• L0g1nS3cur3

• QwErTyUiOp

• S3cur3Adm1n

What is the best practice regarding the root account in Linux?

• Disable direct login and use sudo instead

• Allow full-time access for convenience

• Rename the root account

• Store the root password in a shared document

• Enable root login over Telnet

What is a major risk of using Telnet over SSH?

• Telnet sends data in plaintext

• Telnet encrypts traffic but not credentials

• Telnet compresses traffic, making it unreadable

• SSH cannot be used for administrative tasks

• Telnet is limited to wireless networks only

What tool is commonly used to capture network packets?

• Wireshark

• Nmap

• Nessus

• Metasploit

• SNORT

What type of data can Wireshark capture from unsecured protocols?

• Passwords and cookies

• Encrypted VPN traffic

• Binary executable code

• MAC addresses only

• Voice call data

What is the purpose of DEFCON's “Wall of Sheep”?

• To raise awareness of insecure network behavior

• To simulate DDoS attacks

• To advertise secure cloud vendors

• To promote default password usage

• To demonstrate firewall evasion

What is one risk of using default credentials on IoT devices?

• They can be easily exploited by botnets

• They guarantee secure updates

• They encrypt all network traffic

• They restrict remote access

• They disable Wi-Fi access

What is the Mirai botnet known for?

• Exploiting default credentials on IoT devices

• Performing social engineering attacks

• Phishing through SMS campaigns

• Hijacking browser cookies

• Mining cryptocurrency