1. Which cloud deployment model offers the ability to simply contract for utility computing as needed (don’t need to run your own physical server room or data center)

1. Which cloud deployment model offers the ability to simply contract for utility computing as needed (don’t need to run your own physical server room or data center), but still requires staff to manage installing, patching, updating, deploying, and more on those cloud-based servers?

Which cloud deployment model offers the ability to simply contract for utility computing as needed (don’t need to run your own physical server room or data center), but still requires staff to manage installing, patching, updating, deploying, and more on those cloud-based servers?

IaaS

 

PaaS

 

XaaS

 

SaaS

2. You want to protect your organization’s network from a certain malware that you know always reaches out to attacker.tld for command & control traffic. You push an updated hosts file to all devices in your organization so that “attacker.tld” will now only resolve to a certain IP address that you designate. This is an example of what technique?

You want to protect your organization’s network from a certain malware that you know always reaches out to attacker.tld for command & control traffic. You push an updated hosts file to all devices in your organization so that “attacker.tld” will now only resolve to a certain IP address that you designate. This is an example of what technique?

DNS Sinkhole

 

Fake telemetry

 

Honeypot

 

Hashing

3. What is NOT typically the target of a vulnerability scan?

What is NOT typically the target of a vulnerability scan?

Applications

 

Networks

 

Web applications

 

End users

4. Which of the following social engineering attacks are most complex and are typically conducted by nation-state threat actors or other groups with lots of resources?

Which of the following social engineering attacks are most complex and are typically conducted by nation-state threat actors or other groups with lots of resources?

Invoice scams

 

Typosquatting

 

Watering hole attack

 

Phishing

5. Your friend asked you about the certificate warnings that display in Firefox whenever they visit Google. Looking at the network traffic, you see all HTTP and HTTPS requests from that system are being routed to the same IP regardless of destination URL. Which of the following attack types are you seeing in this case?

Your friend asked you about the certificate warnings that display in Firefox whenever they visit Google. Looking at the network traffic, you see all HTTP and HTTPS requests from that system are being routed to the same IP regardless of destination URL. Which of the following attack types are you seeing in this case?

Phishing

 

HSTS hijack

 

DDoS

 

Man-in-the-middle

6. A co-worker has been urging you to download the new Tic-Tac app for Windows to watch & funny cat videos. While they are showing you the app, the cursor on their screen moves on its own and a command prompt window opens and quickly closes. You can’t tell what, if anything, was displayed in that command prompt window. Your co-worker says it’s been doing that for a while, but it’s no big deal. Based on what you’ve seen, you suspect the new Tic-Tac app for Windows app is really what type of malware?

A co-worker has been urging you to download the new Tic-Tac app for Windows to watch & funny cat videos. While they are showing you the app, the cursor on their screen moves on its own and a command prompt window opens and quickly closes. You can’t tell what, if anything, was displayed in that command prompt window. Your co-worker says it’s been doing that for a while, but it’s no big deal. Based on what you’ve seen, you suspect the new Tic-Tac app for Windows app is really what type of malware?

A rootkit

 

A Trojan

 

A fileless virus

 

A worm

7. A threat actor has obtained a list of all usernames at an organization. There are over ten thousand usernames in the list since it is a very large organization. The threat actor then writes a script to attempt to login to each account one time using the password “Fall2022!”. What type of an attack does this best describe?

A threat actor has obtained a list of all usernames at an organization. There are over ten thousand usernames in the list since it is a very large organization. The threat actor then writes a script to attempt to login to each account one time using the password “Fall2022!”. What type of an attack does this best describe?

Rainbow table

 

Spraying

 

Brute force guessing (Online)

 

Dictionary

 

Brute force cracking (Offline)

8. Why is an attack against Near Field Communication (NFC) more difficult to accomplish than against Bluetooth?

Why is an attack against Near Field Communication (NFC) more difficult to accomplish than against Bluetooth?

NFC is typically used over very short distances of 10cm or less, compared to the longer range of Bluetooth

 

NFC requires a physical USB cable whereas Bluetooth uses radio waves that can be sniffed and replayed

 

NFC uses TLS encryption whereas Bluetooth still only supports SSL encryption

 

NFC supports the Diffie Hellman key exchange, but Bluetooth does not

9. Which of the following statements is TRUE about Crypto-malware?

Which of the following statements is TRUE about Crypto-malware?

Crypto-malware affects the availability of a victim system

 

Crypto-malware affects the integrity of a victim system

 

Crypto-malware affects the confidentiality of a victim system

 

Crypto-malware notifies victims with a ransom demand on screen

10. Which kind of attack sometimes uses a tautology such as “42 = 42” as part of the attack code?

Which kind of attack sometimes uses a tautology such as “42 = 42” as part of the attack code?

Cross-site scripting (XSS)

 

Command injection

 

DLL injection

 

SQL injection (SQLi)