CAS-001 · Question #102
The root cause analysis of a recent security incident reveals that an attacker accessed a printer from the Internet. The attacker then accessed the print server, using the printer as a launch pad…
The correct answer is D. Privilege escalation. The attack chain described is a classic privilege escalation sequence: the attacker started with access to a low-privilege device (a printer), pivoted to the print server, compromised multiple accounts along the way, and ultimately reached the highest-value target (the domain…
Question
The root cause analysis of a recent security incident reveals that an attacker accessed a printer from the Internet. The attacker then accessed the print server, using the printer as a launch pad for a shell exploit. The print server logs show that the attacker was able to exploit multiple accounts, ultimately launching a successful DoS attack on the domain controller. Defending against which of the following attacks should form the basis of the incident mitigation plan?
Options
- ADDoS
- BSYN flood
- CBuffer overflow
- DPrivilege escalation
How the community answered
(21 responses)- A19% (4)
- B33% (7)
- C5% (1)
- D43% (9)
Explanation
The attack chain described is a classic privilege escalation sequence: the attacker started with access to a low-privilege device (a printer), pivoted to the print server, compromised multiple accounts along the way, and ultimately reached the highest-value target (the domain controller). Each hop in the chain represents the attacker gaining higher levels of access and trust. Privilege escalation is the root vulnerability that made the entire attack possible - without the ability to move laterally and escalate, the attacker could not have reached the domain controller. Option A (DDoS) is incorrect because the attack originated from a single point, making it a DoS not a Distributed DoS. Option B (SYN flood) is a specific type of DoS and was not described in the chain. Option C (buffer overflow) may describe the mechanism of the shell exploit on the print server, but addressing only that single step would not prevent the broader escalation pattern.
Topics
Community Discussion
No community discussion yet for this question.