Threats, Vulnerabilities, and Attacks

SY0-801 · 72 questions

• A security operations center wants lists of known malicious IP addresses and domains to be ingested automatically into its SIEM and firewall block lists as they are updated. What should the SOC subscribe to?
• A security analyst at a regional hospital wants threat intelligence that is specific to healthcare, contributed by peer organizations that have faced the same attackers, and exchanged under agreed handling rules. Which intelligence source BEST fits these requirements?
• A risk analyst compares two threats. Phishing attempts land several times a month, and each costs about an hour of help-desk time. A regional flood is expected roughly once in 20 years, but it would shut down the primary data center for weeks. The analyst marks the flood as negligible because it is rare. What is wrong with that ranking?
• An analyst reviews an intrusion timeline. Weeks of port scans and scraping of staff profiles were followed by a phishing email that exploited a document-reader flaw. The newest event is a scheduled task that relaunches the attacker's beacon every time the host reboots. Which threat life cycle stage does the scheduled task represent?
• A vulnerability scan reports a flaw with a CVSS base score of 9.8 on a test web server and a flaw scored 5.3 on the payroll database. A manager concludes that the test web server must be the more valuable asset. What does the CVSS base score actually express?
• A team can patch only one finding this week. One is a CVSS 6.5 flaw on an internet-facing customer payment portal. The other is a CVSS 9.1 flaw on a lab host with no network connection that is scheduled for decommissioning next month. Which finding should be remediated first?
• A vulnerability scanner's report tags each finding with an identifier in the CVE-year-number format. A new analyst asks what that identifier provides. What is the best answer?
• A review produces two findings. First, a web server's settings still allow a deprecated TLS version even though the software fully supports current versions. Second, a parsing library has a buffer overflow that only a vendor code update can fix. How should the first finding be classified?
• In a briefing, a manager says one finding must be more dangerous than another because its CVE number is higher. How should the analyst correct this?
• A risk register's Threat column lists four entries: an unpatched VPN appliance, a ransomware crew, no MFA on administrator accounts, and severe storms. A reviewer says two entries belong in a Vulnerability column instead. Which two?
• A SOC sees attacks that use an unmodified public exploit kit with its default signatures, scan random address ranges rather than chosen targets, and stop as soon as the first attempt fails. Which threat actor best fits these attributes?
• A defense contractor finds intruders who used custom-built implants and several fallback command channels, stayed undetected for 18 months, and copied only weapons research data. There was no ransom demand and nothing was sold or leaked publicly. Which actor and motivation are most likely?
• Shortly after a company announces a drilling project in a protected wilderness area, its public website is defaced with slogans opposing the project. A group claims credit on social media, and no data was stolen or encrypted. Which actor and motivation best fit?
• A ransomware operation leases its encryption tool to affiliates, splits each payment with them, and runs a leak site threatening to publish stolen files if victims do not pay. Which actor type and motivation does this describe?
• A database administrator was demoted last week after a heated HR meeting. Logs now show his still-valid credentials deleting backup jobs and storage snapshots after hours from his own workstation. No ticket requested the deletions and there are no external connections. Which threat actor and motivation best fit?
• To share files quickly with a supplier, an engineer sets a cloud storage container to allow anonymous public access. Weeks later the files appear in search results. There is no evidence of intent, and the engineer reported the problem as soon as she noticed it. How should this threat be classified?
• A rival manufacturer hires away two engineers and approaches others, offering signing bonuses to anyone who brings CAD drawings of an unreleased product. Which threat actor and motivation does this describe?
• A bank's threat model compares a lone attacker with a nation-state group. Which actor attribute most directly explains why the nation-state can develop custom zero-day exploits and sustain a campaign for years?
• An attack on a municipal water utility's operational technology attempts to change chemical dosing levels. There is no ransom demand and no data theft. The group's statement threatens more attacks and urges residents to fear their tap water. Which actor and motivation best fit?
• Incident responders find that an attacker held access for nine months, maintained several backdoors, rotated command infrastructure, exfiltrated data slowly, and regained access after a partial cleanup. Which term best describes this threat?
• Employees receive text messages on their company phones saying a parcel is being held and linking to a site that asks for a redelivery fee. The courier named in the message has no relationship with the company. Which threat vector is being used?
• An external guest added to a shared channel in the company's team chat workspace posts a project brief file that installs malware when opened. The chat platform itself was not compromised. Which threat vector is this?
• Staff notice stickers with QR codes placed over the official payment codes on parking meters outside the office. Scanning one opens a look-alike payment page. Which threat vector category does this represent?
• A user receives an invoice document from an unknown sender. When opened, it shows a banner saying the content cannot be displayed until the user clicks Enable Content. What is the vector, and what is the correct user response?
• After several users install a coupon-finder browser extension that is not on the approved list, their webmail sessions are accessed from foreign IP addresses without any password or MFA prompt. What best explains the compromise?
• Attackers exploit a known flaw in the web management interface of an edge router that is reachable from the internet, then alter its routing table. Which vector category applies, and which control most directly addresses it?
• Logs show thousands of failed logins per hour against a remote desktop service exposed directly to the internet so a few administrators can work remotely. Which change most directly removes this attack vector?
• On a compromised server, an attacker uses only the operating system's built-in scripting shell, scheduled task utility and remote management tools. No custom malware is dropped, and antivirus raises no alerts. Which technique is the attacker relying on?
• A managed service provider's remote monitoring platform is breached, and the attacker uses it to push a malicious script to every client endpoint the provider manages, including the company's laptops. Which threat vector does this represent?
• Several USB flash drives labeled Salaries 2026 are found in the office lobby and parking lot. One employee plugged a drive into a workstation, and the endpoint agent then detected a keyboard-emulation device. Which threat vector was used?
• Attackers compromise an industry forum that engineers at several target firms visit daily and inject a script that exploits visitors' browsers. Only visitors coming from the target firms' address ranges receive the payload. Which attack is this?
• An assessment finds badge readers that accept unencrypted NFC credentials that can be cloned from a short distance, and IP cameras with Bluetooth maintenance pairing enabled and no PIN. Which threat vector categories does this assessment highlight?
• A manufacturing plant's control workstation runs an operating system that no longer receives vendor patches. The control software will not run on a newer release, and replacement is 18 months away. Which approach best manages the risk in the meantime?
• A network discovery scan finds a small device with its own cellular modem plugged into a conference room network port. It is not in the asset inventory and no department claims it. How is this device best described?
• A hardening review finds that a file server is listening for FTP and Telnet, although nobody uses either service; administrators connect with SSH and users access shares over SMB. Which action most effectively reduces the server's attack surface?
• A privileged program checks whether the calling user may write to a file path and, a moment later, opens that path to write. Between those two steps, an attacker replaces the file with a symbolic link to a protected system file. Which vulnerability is being exploited?
• Attackers breach a software vendor's build environment and insert a backdoor into the next release. Customers receive the properly signed update through the product's normal automatic update channel and install it as usual. Which vulnerability does this describe?
• A developer commits a configuration file containing a cloud API key to a public code repository. The security team discovers it two days later. What is the best remediation?
• Sending a malformed request to a customer web application returns a page showing a full stack trace with the database server name, table names and the framework version. Which vulnerability does this reveal?
• In a shared virtualization cluster, an attacker controlling one guest VM runs code that executes on the underlying hypervisor host and then reads memory belonging to other tenants' VMs. Which vulnerability does this describe?
• Attackers are exploiting a flaw in a widely used email server that the vendor did not know about until today. No patch exists, and signature-based tools have no rule for it. Which defense is most likely to detect or contain the attack right now?
• A contractor's engagement ended six months ago, but the contractor's VPN account is still active and was used last night from an unfamiliar address. Which vulnerability does this illustrate, and which control addresses it?
• A marketing department uses corporate cards to sign up for an unapproved file-sharing SaaS service and stores customer contact lists there. IT and security are unaware of the service until an employee mentions it. Which vulnerability does this represent?
• A security researcher reports that a company's cloud object storage bucket holding customer invoices can be listed and downloaded anonymously. The provider's service is working as designed, and the bucket policy grants public read access. Which vulnerability type is this?
• A company connects an internal LLM assistant to its HR, finance and email systems so staff can ask questions across them. All of its applications also rely on a single identity provider for SSO. Which statement best describes how these choices affect the attack surface?
• On a shared drive, thousands of files suddenly have a new extension and cannot be opened. A text file with payment instructions appears in every folder, and the file server shows a spike in disk writes from one workstation's account. Which malware is indicated?
• An EDR tool flags a scripting shell launched by a word processor, running an encoded command that loads code directly into memory. A full disk scan finds no malicious executable, and persistence is a registry value that stores a script. Which malware type is indicated?
• A developer left the company in March. On June 30, a script hidden inside a routine maintenance job deleted payroll records. Code review shows it checks the date and whether the developer's account still exists before running. Which malware type does this describe?
• Within an hour, malware appears on dozens of servers. No user opened an attachment or ran a file. Each infected host scans its subnet and exploits an unpatched file-sharing service on other hosts to copy itself. Which malware type is this?
• During an inspection at a fuel station, technicians find thin overlay devices fitted over the card readers at several pumps. The overlays read the magnetic stripe of each card inserted. Which physical attack is this?
• Users on the office wireless network see certificate warnings on well-known sites. A traceroute shows an extra hop through an unfamiliar internal host, and the ARP table maps the default gateway's IP address to a workstation's MAC address. Which attack is indicated?
• Users on the corporate network report that their bank's domain resolves to an unfamiliar IP address. The same name resolves correctly from public resolvers and other networks, local hosts files are clean, and the internal resolver's cache holds the bogus record with an unusually long TTL. Which attack is indicated?
• A security analyst reviewing handshake logs for a payment portal sees that several client sessions normally negotiated with TLS 1.3 were instead completed with SSL 3.0 after the first handshake attempts were repeatedly interrupted. Both the clients and the server support current protocol versions. Which attack do these indicators MOST likely point to?
• The CFO receives an urgent phone call from someone who sounds like the CEO, insisting that a wire transfer to a new supplier be approved before the end of the day and kept confidential. The awareness team categorizes every reported social engineering incident by its delivery channel. How should this incident be categorized?
• During a video meeting, a finance employee sees and hears what appears to be the CIO asking for the employee's current MFA code to fix an urgent payroll issue. The meeting was started from an external account the employee has never seen before. What should the employee do FIRST?
• A SIEM alert shows that a single user account authenticated to the corporate SaaS suite from New York at 09:02 and from Singapore at 09:11. The New York session was logged off at 09:05, and the company does not use a VPN or proxy that would relay traffic through Asia. Which indicator of compromise does this activity represent?
• While investigating a suspected intrusion, an analyst finds that a server's security event log has no entries for a 40-minute window during which an administrator account was active elsewhere on the network, followed by an event recording that the audit log was cleared. Which indicator of compromise is MOST directly shown?
• A Linux web server has been running at 100% CPU for two days. An analyst finds an unfamiliar process launched from a temporary directory that maintains a persistent outbound connection to an external pool address. No files have been encrypted or renamed and users report no pop-ups. What is the MOST likely explanation?
• During a penetration test, the tester enters ' OR 1=1 -- into the username field of a web application's login form and leaves the password blank. The application logs the tester in and displays every user record stored in the backend database. Which attack has succeeded?
• A web application firewall logs repeated requests to an image-download endpoint in which the file parameter steps up four parent directories and names the system password file. One of the requests returned a response of the same size as the server's password file. Which attack is being attempted?
• A customer logged in to an online banking site opens a forum post in another browser tab. A hidden form on the forum page automatically submits a funds-transfer request to the bank, and the browser attaches the customer's valid session cookie. The bank's own pages were not modified, and the request was newly generated. Which attack occurred?
• Authentication logs show about 1,200 different employee usernames each receiving one or two failed sign-in attempts over six hours, all using the same seasonal password and originating from a small set of IP addresses. No accounts were locked out. Which credential attack is MOST likely underway?
• A company's AI assistant can browse the web to summarize pages for employees. After summarizing a vendor page, the assistant appended a link that sent the employee's earlier conversation to an external server. The page contained hidden text instructing the model to do this. The employee typed only a normal request. Which AI threat does this describe?
• An attacker with write access to a security vendor's labeled training repository adds thousands of samples from one malware family labeled as benign. After the next scheduled retraining, the vendor's classifier consistently misses that family, although the deployed model files were never directly altered. Which AI threat occurred?
• Over several sessions, an employee feeds an internal AI assistant elaborate role-play scenarios, such as asking it to pretend to be an unrestricted model with no policies, until it produces content its safety rules prohibit. No external documents, web pages, or files were involved. Which AI threat does this activity BEST represent?
• A security review finds that customer-service staff routinely paste full customer records, including names, account numbers, and support histories, into a free public AI chatbot to draft replies. The organization has no agreement with the chatbot provider. Which AI-related risk is MOST directly created by this practice?
• A compliance analyst used an AI assistant to draft an audit report. A reviewer discovers that the report cites a data-protection regulation section that does not exist, quoted in confident, authoritative language. No one tampered with the assistant or its inputs. Which risk does this represent, and what control BEST addresses it?
• An AI model used to screen job applicants was trained on ten years of the company's historical hiring decisions. An internal audit finds that it consistently scores applicants from one demographic group lower than equally qualified applicants from others. No one tampered with the training data. Which AI risk does this BEST illustrate?
• A regulator asks a bank to explain why its AI fraud-detection model blocked a specific customer's transaction. The data science team confirms the model is accurate overall, but they cannot identify which factors led to that particular decision or justify it to the customer. Which AI risk does this situation BEST illustrate?
• A threat actor repeatedly adds padding bytes and alters strings in a known malware sample, testing each variant against a vendor's machine-learning detection engine until one is classified as benign. The engine's model and training data were never accessed or changed. Which AI threat does this BEST describe?
• A developer's AI coding agent can run shell commands on a build server. While triaging a repository issue, the agent read text in the issue telling it to download and run a setup script from an external site, and it did so, installing a backdoor on the build server. Which AI-related risk materialized on the build server?
• Infostealer malware on an employee's laptop exfiltrates browser cookies. Hours later, an attacker opens the company's AI assistant web portal from another country and reads the employee's full conversation history without receiving any password or MFA prompt. Which attack BEST explains this access?