Cybersecurity Practice

A threat actor sets up a rogue access point (AP) at a local cafe. The rogue AP captures traffic and then forwards the traffic to the cafe AP. Which type of attack does this scenario describe?

• Ransomware

• DDos

• Man-in-the Middle

• Reconnaissance

Answer explanation

This scenario describes a Man-in-the-Middle attack, where the rogue access point intercepts and relays traffic between the user and the legitimate access point, allowing the attacker to capture sensitive information.

You notice that a new CVE has been shared to an email group that you belong to. What should you do first with the CVE?

• Record the CVE as part of the disaster recovery plan

• Look up the details of the vulnerability to determine whether it applies to your network

• Add the CVE to the firewall rules for your organization

• Research measures to prevent the CVE from attacking the network

Answer explanation

The first step is to look up the details of the CVE to assess its relevance to your network. Understanding the vulnerability helps determine the appropriate response and mitigation measures.

Which password follows strong password policy guidelines?

• Snuffy#

• 1mpressive1

• Mar221984

• Wh@tareyouDo1ngtoday4

Answer explanation

The password 'Wh@tareyouDo1ngtoday4' is strong because it includes a mix of uppercase and lowercase letters, numbers, and special characters, making it complex. The other options lack sufficient complexity or length.

Your supervisor tells you that you will participate in a CVSS assessment. What will you be doing?

• Interviewing users to determine their level of cybersecurity awareness

• Analyzing host logs to identify abnormal activities

• Evaluating end system security and scoring vulverabilities

• Performing penetration tests on internal network devices and systems

Answer explanation

In a CVSS assessment, you will evaluate end system security and score vulnerabilities to determine their severity and impact, which is essential for prioritizing remediation efforts.

How do threat actors launch ransomware attacks on organizations?

• They implant malware to collect data from the corporation's financial system

• They deface an organization's public facing website

• They secretly spy on employees and collect their personal information

• They lock data and deny access until they receive money

Answer explanation

Ransomware attacks involve locking data and denying access until a ransom is paid. This method directly targets an organization's ability to operate, making it a primary tactic for threat actors.

The company web server collect information through a form. The form is accessed by using port 80. The form content is transferred to an encrypted database for storage. You are investigating a complaint that the form content has been compromised..

What is the cause of the security breach?

• The data was transferred to the database using a nonsecure protocol

• The database was compromised

• The content was accessed using HTTP, which is an unencrypted protocol

• The web browser used to access the site wasnot updated to the latest version

Answer explanation

The correct choice is that the content was accessed using HTTP, which is an unencrypted protocol. This means that data transmitted over port 80 is vulnerable to interception, leading to potential compromise.

Which Windows app is a command-line interface that includes a sophisticated scripting language used to automate Windows tasks?

• VMware

• Microsoft Management Console

• MS-DOS

• Powershell

Answer explanation

Powershell is a command-line interface specifically designed for Windows, featuring a powerful scripting language that allows users to automate various tasks efficiently, making it the correct choice.

How does sandboxing help with the analysis of malware?

• It specifies the applications that are authorized for use on the network

• It allows suspicious applications to run in a safe and isolated testing environment

• It defines the suspicious ormalicious applications that should be blocked

• It restricts traffic from passing from one network to another

Answer explanation

Sandboxing allows suspicious applications to run in a safe and isolated testing environment, enabling analysts to observe their behavior without risking the security of the main system or network.

Why is it necessary to update firmware to the latest version?

• To support the latest operating systems and applications

• To patch firmware in the kernel of the operating system

• To explore new hardware features

• To correct security holes and weaknesses

Answer explanation

Updating firmware is essential to support the latest operating systems and applications, ensuring compatibility and optimal performance. This helps devices function correctly with new software advancements.

You are going to perform a penetration test on a company LAN. As part of your preparation, you access the company's websites, view webpage source code, and run Internet searches to uncover domain information. You also use social media to gather details about the company and its employees.

Which type of reconnaissance activities are you performing

• Active

• Offline

• Inactive

• Passive

Answer explanation

You are performing passive reconnaissance by gathering information without directly interacting with the target systems. This includes viewing source code, searching online, and using social media to collect data.