Mixed Deck — All CVA Topics Flashcards

Which device connects multiple networks together?

Answer: Router

A router is a network device that forwards data packets between different computer networks. It operates at Layer 3 (the network layer) of the OSI model, using IP addresses to determine the best path for data transmission. Routers are essential for connecting local area networks (LANs) to wide area networks (WANs), such as the internet, enabling communication across disparate network segments.

Which Kubernetes misconfiguration exposes the cluster API server to unauthenticated access?

Answer: Leaving the API server accessible on port 6443 without authentication (anonymous-auth=true)

Enabling anonymous authentication on the Kubernetes API server allows unauthenticated users to interact with the cluster, potentially executing privileged operations.

Which cloud vulnerability involves functions or services that trigger other services in an uncontrolled chain, potentially leading to infinite loops or cost exhaustion?

Answer: Resource exhaustion / event-driven attack

Serverless resource exhaustion attacks exploit event-driven architectures to trigger cascading function invocations, causing denial of service or unexpected cost escalation.

Which scanning plugin or check type in Nessus specifically verifies whether installed software versions match vendor-released patches?

Answer: Local security checks (LSC)

Local security checks (LSC) use credentials to log into a system and compare installed software versions against the latest vendor patches to identify missing updates.

During a vulnerability assessment, you identify a cross-site scripting vulnerability. What is the most impactful proof-of-concept to demonstrate to stakeholders?

Answer: Demonstrate session hijacking by stealing and using a session cookie via the XSS payload

Demonstrating actual session hijacking via XSS — stealing a session cookie and using it to authenticate as the victim — proves the real-world impact far more effectively than a simple alert popup.

Which type of scan involves simulating an attack to find vulnerabilities?

Answer: Penetration testing

Penetration testing, often called 'pen testing,' is a simulated cyberattack against a computer system, network, or web application to check for exploitable vulnerabilities. Unlike vulnerability scanning, it actively attempts to exploit identified weaknesses to demonstrate the potential impact of a real attack. This provides a deeper understanding of an organization's security posture from an attacker's perspective.

Which tool is specifically designed to identify web application vulnerabilities such as SQL injection and XSS through automated crawling?

Answer: Nikto

Nikto is an open-source web server scanner that tests for dangerous files, misconfigurations, and common web vulnerabilities including SQL injection and XSS.

Which technique involves sending packets with unusual flag combinations (e.g., all flags set) to elicit responses that reveal firewall or OS behavior?

Answer: Xmas scan

An Xmas scan sets FIN, PSH, and URG flags simultaneously; RFC-compliant closed ports respond with RST while open ports remain silent, helping map firewall rules.

What is 'fuzzing' in the context of vulnerability assessment tools?

Answer: Sending malformed or unexpected input to an application to discover crashes or vulnerabilities

Fuzzing involves sending invalid, unexpected, or random data to an application's inputs to trigger errors, crashes, or unexpected behaviors that reveal vulnerabilities.

Which standard provides a structured vulnerability disclosure process used by vendors and researchers to coordinate patching before public release?

Answer: ISO/IEC 29147

ISO/IEC 29147 provides international guidance on vulnerability disclosure, defining roles and processes for coordinated disclosure between researchers and vendors.

Which physical security control is specifically designed to prevent tailgating by allowing only one person to enter per authentication event?

Answer: Mantrap (airlock)

A mantrap (airlock) uses two interlocking doors where only one can open at a time, ensuring that only the authenticated individual can enter the secured area.

What does the term 'network perimeter erosion' describe in modern vulnerability assessments?

Answer: The blurring of traditional boundaries due to cloud services, mobile devices, and remote work

Network perimeter erosion describes how cloud adoption, BYOD, and remote work have dissolved the clear inside/outside network boundary that traditional security models assumed.

Which attack technique involves embedding malicious SQL code in input fields to manipulate database queries?

Answer: SQL Injection

SQL Injection involves inserting or 'injecting' malicious SQL statements into an entry field to manipulate the backend database.

An assessor finds that an organization uses telnet for out-of-band management of network devices. What is the critical weakness?

Answer: All management credentials and commands are transmitted in cleartext

Telnet transmits all data including usernames, passwords, and configuration commands in plaintext, making credentials trivially capturable by any network sniffer.

Which Metasploit module type is used for post-exploitation activities such as credential dumping and privilege escalation?

Answer: Post modules

Post modules in Metasploit perform post-exploitation tasks on an already-compromised session, including credential harvesting, privilege escalation, and persistence establishment.

Which Qualys feature enables continuous monitoring of an organization's internet-facing assets for vulnerabilities?

Answer: Qualys VMDR (Vulnerability Management, Detection and Response)

Qualys VMDR provides continuous discovery, assessment, prioritization, and remediation tracking for vulnerabilities across an organization's entire asset inventory.

Which compliance regulation focuses on healthcare information?

Answer: HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. federal law specifically designed to protect sensitive patient health information. It sets national standards for the privacy and security of protected health information (PHI). This ensures that healthcare providers and related entities safeguard patient data against unauthorized disclosure.

What is the primary purpose of testing for Server-Side Request Forgery (SSRF) in a web application?

Answer: To make the server perform requests to internal or external resources on behalf of the attacker

SSRF allows attackers to coerce a server into making HTTP requests to internal services or external URLs, potentially exposing cloud metadata endpoints or internal networks.

Which social engineering technique involves impersonating a trusted authority figure via phone to extract sensitive information from an employee?

Answer: Vishing

Vishing (voice phishing) uses phone calls where attackers impersonate IT support, executives, or other authorities to manipulate employees into revealing credentials or sensitive data.

Which Windows security feature marks memory regions as non-executable to help prevent code injection attacks?

Answer: Data Execution Prevention (DEP)

Data Execution Prevention (DEP) marks certain memory regions as non-executable, preventing attackers from running malicious code injected into data areas like the stack or heap.