A government IT security team discovered data has been slowly leaking from their storage servers over the last 12 months. After additional analysis, they unmask the threat actor and accurately label the type of threat in a report. Which of the following information can be expected in the report?

A company determines a relatively small but important software module used in an app exhibits an insecure design condition. What should the company do to mitigate this condition?

An unethical company is determined to exfiltrate data from a reputable company. The goal is to obtain information that will help them release a competing product with similar features. Which of the following represents the order and steps the unethical company is likely to take to meet their objectives?

A security specialist endeavors to prevent recent broken authentication-related events at a branch office. What should the security specialist do to successfully meet this objective? Select two.

What benefit do security professionals derive from understanding TTPs?

A group of threat actors want to disrupt the electric grid to induce disruption and panic among residents of a particular city. Which of the following best characterizes this statement?

A threat actor discovers a vulnerability in an app that has never been reported. However, instead of exploiting the weakness, the threat actor offers to sell the information. Why would the threat actor do this?

An insider threat actor has been engaging in unscrupulous cybersecurity activities for some time without being discovered. Which of the following best describes why it is so difficult to unmask an intentional insider threat?

A company sources products from a variety of vendors to create a complex security system. However, a year after releasing the product, it was recalled because one of its components allows unauthorized surveillance, and patches did not fix the problem. What type of malware is most likely affecting the security system?

An attacker successfully launches a buffer overflow attack. Which of the following best represents the resulting effect?

The number of container ships a port is capable of processing has been reduced by 70% due to serious cybersecurity incident. What type of attack was most likely launched and to what type of threat actor is this type of attack often attributed?

An attacker determines permission on a web server are not very secure and proceeds to access unauthorized data, thus, exploiting the vulnerability. What type of attack is the threat actor performing?

Which of the following describes true statements regarding CSRF and SSRF? Select two.

A malicious actor manages to modify data in RAM in an ecommerce platform to induce a credit in their account instead of a charge. What type of attack is most likely to produce this effect?

A senior hardware test technician at a company that designs computer hardware engages in shadow IT activities from time to time. Which of the following activities is the technician most likely to perform and/or why does the technician participate in such activities? Select three.

Which of following best describes the type of threat posed by an individual engaging in shadow IT?

A script kiddie finds a document online that includes detailed information on how to penetrate a network to determine if there are computers using older operating systems that can be compromised. What type of information is most likely to be contained in the document?

A rogue government employee steals a host of numeric attributes from a third-party storage facility that uniquely identifies the persons to whom they correspond. The employee's goal is to benefit financially. If successful, who or what entity will be the most likely victim?

An attacker crafts a URL that reads as follows: validdomain.com@3232235777
What is most likely to happen if the URL is entered in the address bar of a web browser? Select two.

A threat actor launches a zero-day attack against a popular social media app. Upon discovery, a security analyst is asked to categorize the attack using a Johari window. Under which category should this type of attack be placed?

An attacker manages to compromise a network and slowly injects data into the network to make it appear as innocuous data. What type of attack is the threat actor most likely performing?

An individual is probing for weaknesses and successfully finds one. The individual then proceeds to provide the information to the organization. Which of the following best describes this type of individual?

A developer is using an API to create an app that pulls data from an insurance portal. However, in the effort, a particular type of data that was readily available is suddenly no longer available. Which of the following statements most closely represents what could have happened?

A group of threat actors is planning to launch a denial-of-service attack against a state government website because they are opposed to a ruling issued by the state's supreme court. Which of the following is most likely to launch the attack?