CyberVista Threats, Attacks, and Vulnerabilities Questions and Answers — Questions and Answers
Question 1: An attacker is using a technique to intercept and alter communication between two parties who believe they are directly communicating with each other. The attacker is situated between the two parties and is relaying messages, potentially manipulating the content without their knowledge. Which of the following attacks is being described?
- Phishing
- Man-in-the-Middle (MitM) (Correct answer)
- DDoS
- SQL Injection
Correct answer: Man-in-the-Middle (MitM)
A Man-in-the-Middle (MitM) attack is a form of eavesdropping where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. The other options are incorrect: Phishing involves tricking users into revealing sensitive information, a DDoS attack overwhelms a system with traffic to make it unavailable, and a SQL Injection attack targets databases by inserting malicious SQL code.
Question 2: A financial institution's web application has a vulnerability where an attacker can insert malicious commands into the application's database queries. This allows the attacker to view, modify, or delete sensitive customer data. What type of vulnerability is being exploited?
- Cross-Site Scripting (XSS)
- Server-Side Request Forgery (SSRF)
- SQL Injection (Correct answer)
- XML External Entity (XXE)
Correct answer: SQL Injection
This scenario describes a SQL Injection attack. SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It allows them to view data that they are not normally able to retrieve. XSS involves injecting malicious scripts into trusted websites, SSRF tricks a server into making requests to an unintended location, and XXE is an attack against applications that parse XML input.
Question 3: Which of the following is a form of social engineering where an attacker sends a fraudulent email that appears to be from a legitimate and reputable source to trick the recipient into revealing sensitive information, such as login credentials or credit card numbers?
- Spoofing
- Ransomware
- Phishing (Correct answer)
- Trojan Horse
Correct answer: Phishing
Phishing is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. Ransomware holds a system hostage for a fee, a Trojan horse is malware disguised as legitimate software, and Spoofing is a broader term for disguising communication from an unknown source as being from a known, trusted source.
Question 4: A security analyst notices that an organization's web server has become extremely slow and unresponsive. A network traffic analysis reveals that the server is being inundated with a massive volume of requests from thousands of different IP addresses simultaneously. This is characteristic of what type of attack?
- Brute Force Attack
- Denial-of-Service (DoS) Attack
- Spyware
- Distributed Denial-of-Service (DDoS) Attack (Correct answer)
Correct answer: Distributed Denial-of-Service (DDoS) Attack
A Distributed Denial-of-Service (DDoS) attack overwhelms a target system with traffic from multiple, distributed sources, making it unavailable to legitimate users. A regular DoS attack is similar but originates from a single source. A brute force attack is a method of guessing passwords, and spyware is a type of malware that secretly gathers information.
Question 5: An employee inadvertently downloads a malicious software program that was disguised as a free utility. Once executed, the software encrypts all the files on their computer and displays a message demanding payment in exchange for the decryption key. This is an example of what type of malware?
- Worm
- Virus
- Ransomware (Correct answer)
- Adware
Correct answer: Ransomware
Ransomware is a type of malicious software designed to block access to a computer system or encrypt its data until a sum of money is paid. A virus attaches itself to other programs to replicate, a worm is a standalone malware that replicates itself to spread to other computers, and adware is software that displays unwanted advertisements.
Question 6: What is the primary difference between a virus and a worm?
- A virus can self-replicate, while a worm cannot.
- A worm requires human interaction to spread, while a virus does not.
- A virus is designed to steal data, while a worm is designed to cause network disruption.
- A worm can self-replicate and spread independently across networks, while a virus requires a host file or program to spread. (Correct answer)
Correct answer: A worm can self-replicate and spread independently across networks, while a virus requires a host file or program to spread.
The primary distinction is that a worm is a standalone piece of malware that can replicate and spread on its own through a network. A virus, on the other hand, needs to attach itself to a legitimate program or file. Human action, like opening an infected file, is typically required to trigger the virus and allow it to spread.
CyberVista Threats, Attacks, and Vulnerabilities Questions and Answers
An attacker is using a technique to intercept and alter communication between two parties who believe they are directly communicating with each other.
The attacker is situated between the two parties and is relaying messages, potentially manipulating the content without their knowledge.
Which of the following attacks is being described?