ISAC Cyber Threats and Vulnerabilities 3 — Questions and Answers
Question 1: What is the primary goal of an Advanced Persistent Threat (APT)?
- Rapidly encrypt as many files as possible for ransom
- Gain long-term unauthorized access to a target network for espionage or data theft (Correct answer)
- Crash a target system within seconds
- Automatically exploit every vulnerability found on a network
Correct answer: Gain long-term unauthorized access to a target network for espionage or data theft
APTs are stealthy, prolonged attacks typically sponsored by nation-states or organized groups, focused on maintaining persistent access for espionage or data exfiltration.
Question 2: Which of the following describes a 'watering hole' attack?
- Flooding a target server with water-themed phishing emails
- Compromising a website frequently visited by the intended victims (Correct answer)
- Attacking the water supply infrastructure of a city
- Intercepting data at a public Wi-Fi access point
Correct answer: Compromising a website frequently visited by the intended victims
A watering hole attack compromises a legitimate website that the target group frequently visits, waiting for victims to come to the attacker.
Question 3: What is 'DNS poisoning' (DNS cache poisoning)?
- Flooding a DNS server with excessive queries to cause downtime
- Corrupting a DNS resolver's cache to redirect users to malicious IP addresses (Correct answer)
- Encrypting DNS records to prevent legitimate lookups
- Deleting DNS entries to make websites unreachable
Correct answer: Corrupting a DNS resolver's cache to redirect users to malicious IP addresses
DNS cache poisoning inserts fraudulent DNS records into a resolver's cache, causing users to be redirected to attacker-controlled servers.
Question 4: In cybersecurity, what is a 'logic bomb'?
- Malware that detonates only when a specific condition or trigger is met (Correct answer)
- A hardware device that physically destroys a computer
- A type of DDoS attack using logical network packets
- An exploit kit targeting logical vulnerabilities in operating systems
Correct answer: Malware that detonates only when a specific condition or trigger is met
A logic bomb is malicious code that remains dormant until a specific condition (date, user action, or event) triggers it to execute.
Question 5: What distinguishes a 'worm' from a traditional virus?
- Worms require a host file to spread; viruses do not
- Worms self-replicate and spread across networks without needing a host file (Correct answer)
- Worms only target mobile devices; viruses target desktops
- Worms encrypt files; viruses only delete them
Correct answer: Worms self-replicate and spread across networks without needing a host file
Unlike viruses that attach to host files, worms are self-contained programs that replicate and spread autonomously across networks.
Question 6: What is 'privilege escalation' in the context of a cyber attack?
- Increasing the cost of a ransom demand over time
- Gaining higher-level permissions than originally granted to access restricted resources (Correct answer)
- Social engineering an executive to grant admin access
- Upgrading malware to a more sophisticated version mid-attack
Correct answer: Gaining higher-level permissions than originally granted to access restricted resources
Privilege escalation allows an attacker with limited access to gain elevated permissions (e.g., root or admin), enabling deeper control over the system.
Question 7: Which threat involves an attacker exploiting trust relationships between systems or organizations?
- Insider threat
- Supply chain attack (Correct answer)
- Cross-site scripting
- Brute force attack
Correct answer: Supply chain attack
Supply chain attacks compromise a trusted third-party vendor, software update, or hardware component to gain access to the ultimate target organization.
ISAC Cyber Threats and Vulnerabilities 3
What is the primary goal of an Advanced Persistent Threat (APT)?