ISAC Cyber Threats and Vulnerabilities 2 — Questions and Answers
Question 1: Which type of malware encrypts a victim's files and demands payment for the decryption key?
- Spyware
- Ransomware (Correct answer)
- Adware
- Rootkit
Correct answer: Ransomware
Ransomware encrypts the victim's data and demands a ransom, typically in cryptocurrency, in exchange for the decryption key.
Question 2: What is a 'zero-day' vulnerability?
- A flaw that has been patched within 24 hours
- A vulnerability unknown to the vendor with no available patch (Correct answer)
- A bug that only affects systems for one day
- An exploit that requires zero technical skill to execute
Correct answer: A vulnerability unknown to the vendor with no available patch
A zero-day vulnerability is a software flaw that is unknown to the vendor and therefore has no patch, making it especially dangerous.
Question 3: In the context of network attacks, what is a 'man-in-the-middle' (MitM) attack?
- An attack where malware sits between CPU and RAM
- An attacker secretly intercepts and possibly alters communication between two parties (Correct answer)
- A denial-of-service attack from a central server
- A social engineering attack targeting middle management
Correct answer: An attacker secretly intercepts and possibly alters communication between two parties
In a MitM attack, the attacker secretly positions themselves between two communicating parties to intercept, read, or modify the data.
Question 4: What does 'SQL injection' allow an attacker to do?
- Inject malicious code into a CPU's instruction pipeline
- Manipulate a database by inserting malicious SQL commands into input fields (Correct answer)
- Install a SQL server on a victim machine remotely
- Encrypt database files with SQL-based ransomware
Correct answer: Manipulate a database by inserting malicious SQL commands into input fields
SQL injection exploits poorly sanitized input fields to insert malicious SQL statements that can read, modify, or delete database content.
Question 5: Which of the following best describes a 'botnet'?
- A network of security robots that monitor for intrusions
- A collection of compromised computers controlled remotely by an attacker (Correct answer)
- A private virtual network used by cybersecurity professionals
- An automated tool for patching software vulnerabilities
Correct answer: A collection of compromised computers controlled remotely by an attacker
A botnet is a network of infected devices (bots) that an attacker controls remotely, often used for DDoS attacks, spam, or credential theft.
Question 6: What is 'credential stuffing'?
- Manually guessing passwords using common word lists
- Using stolen username/password pairs from one breach to access other services (Correct answer)
- Embedding fake credentials inside malware
- Stuffing excessive login requests to lock out legitimate users
Correct answer: Using stolen username/password pairs from one breach to access other services
Credential stuffing exploits the practice of password reuse by testing breached credentials against other websites and services.
Question 7: Which vulnerability type occurs when an application writes data beyond the allocated memory buffer?
- Integer overflow
- Buffer overflow (Correct answer)
- Heap spray
- Use-after-free
Correct answer: Buffer overflow
A buffer overflow occurs when a program writes more data to a buffer than it can hold, potentially overwriting adjacent memory and enabling code execution.
ISAC Cyber Threats and Vulnerabilities 2
Which type of malware encrypts a victim's files and demands payment for the decryption key?