ICT Cybersecurity Threats and Mitigation 4 — Questions and Answers
Question 1: Which type of threat actor is typically motivated by financial gain and operates as an organized criminal enterprise?
- Hacktivist
- Cybercriminal group (Correct answer)
- Nation-state actor
- Script kiddie
Correct answer: Cybercriminal group
Cybercriminal groups are primarily financially motivated, running ransomware-as-a-service, fraud schemes, and data theft for profit.
Question 2: What is DNS poisoning (cache poisoning)?
- Overloading a DNS server with requests
- Inserting false DNS records to redirect users to malicious sites (Correct answer)
- Stealing DNS server credentials
- Encrypting DNS traffic to prevent snooping
Correct answer: Inserting false DNS records to redirect users to malicious sites
DNS cache poisoning corrupts a DNS resolver's cache with fraudulent entries, causing users to be redirected to attacker-controlled IP addresses instead of legitimate sites.
Question 3: A penetration tester has no prior knowledge of the target system before the test begins. Which type of test is this?
- White-box testing
- Gray-box testing
- Black-box testing (Correct answer)
- Red team exercise
Correct answer: Black-box testing
Black-box penetration testing simulates an external attacker with no insider knowledge, testing defenses from the perspective of an uninformed adversary.
Question 4: Which of the following is an example of a supply chain attack?
- Hacking a company's public website
- Compromising a trusted software vendor to distribute malware via legitimate updates (Correct answer)
- Sending phishing emails to company employees
- Exploiting an unpatched server vulnerability
Correct answer: Compromising a trusted software vendor to distribute malware via legitimate updates
Supply chain attacks target less-secure vendors or software providers to reach the actual target, as demonstrated by the SolarWinds attack where malicious code was inserted into software updates.
Question 5: What is the purpose of a Security Information and Event Management (SIEM) system?
- To patch vulnerabilities automatically
- To aggregate, correlate, and analyze security logs from multiple sources for threat detection (Correct answer)
- To encrypt sensitive data at rest
- To manage employee access permissions
Correct answer: To aggregate, correlate, and analyze security logs from multiple sources for threat detection
A SIEM collects log data from across an organization's infrastructure, correlates events, and generates alerts to help security teams detect and respond to threats.
Question 6: Which attack technique involves sending malformed packets to crash or exploit a service by exceeding its input buffer capacity?
- SQL injection
- Buffer overflow attack (Correct answer)
- Replay attack
- Session hijacking
Correct answer: Buffer overflow attack
A buffer overflow attack sends more data than a program's buffer can hold, overwriting adjacent memory and potentially allowing attackers to execute arbitrary code.
Question 7: What does the term 'attack surface' refer to in cybersecurity?
- The geographical spread of an attack
- The total set of points where an attacker could try to enter or extract data from a system (Correct answer)
- The severity rating of a cyberattack
- The number of attackers involved in a campaign
Correct answer: The total set of points where an attacker could try to enter or extract data from a system
The attack surface encompasses all possible entry points and vulnerabilities in a system that an attacker could exploit, including software, hardware, network interfaces, and human factors.
ICT Cybersecurity Threats and Mitigation 4
Which type of threat actor is typically motivated by financial gain and operates as an organized criminal enterprise?