Hotspot Question Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation. INSTRUCTIONS Not all attacks and remediation actions…

Question

Exhibits

Answer Area

• An attacker sends multiple SYN packets from multiple sources.Botnet
  BotnetRATLogic BombBackdoorVirusSpywareWormAdwareRansomwareKeyloggerPhishing
• An attacker sends multiple SYN packets from multiple sources.Enable DDoS protection
  Enable DDoS protectionPatch vulnerable systemsDisable vulnerable servicesChange the default system passwordUpdate the cryptographic algorithmsChange the default application passwordImplement 2FA using push notificationConduct a code reviewImplement application fuzzingImplement a host-based IPSDisable remote access services
• The attack establishes a connection, which allows remote commands to be executed.RAT
  BotnetRATLogic BombBackdoorVirusSpywareWormAdwareRansomwareKeyloggerPhishing
• The attack establishes a connection, which allows remote commands to be executed.Implement a host-based IPS
  Enable DDoS protectionPatch vulnerable systemsDisable vulnerable servicesChange the default system passwordUpdate the cryptographic algorithmsChange the default application passwordImplement 2FA using push notificationConduct a code reviewImplement application fuzzingImplement a host-based IPSDisable remote access services
• The attack is self propagating and compromises a SQL database using well-known credentials as it moves through the network.Worm
  BotnetRATLogic BombBackdoorVirusSpywareWormAdwareRansomwareKeyloggerPhishing
• The attack is self propagating and compromises a SQL database using well-known credentials as it moves through the network.Change the default system password
  Enable DDoS protectionPatch vulnerable systemsDisable vulnerable servicesChange the default system passwordUpdate the cryptographic algorithmsChange the default application passwordImplement 2FA using push notificationConduct a code reviewImplement application fuzzingImplement a host-based IPSDisable remote access services
• The attacker uses hardware to remotely monitor a user's input activity to harvest credentials.Keylogger
  BotnetRATLogic BombBackdoorVirusSpywareWormAdwareRansomwareKeyloggerPhishing
• The attacker uses hardware to remotely monitor a user's input activity to harvest credentials.Implement 2FA using push notification
  Enable DDoS protectionPatch vulnerable systemsDisable vulnerable servicesChange the default system passwordUpdate the cryptographic algorithmsChange the default application passwordImplement 2FA using push notificationConduct a code reviewImplement application fuzzingImplement a host-based IPSDisable remote access services
• The attacker embeds hidden access in an internally developed application that bypasses account login.Backdoor
  BotnetRATLogic BombBackdoorVirusSpywareWormAdwareRansomwareKeyloggerPhishing
• The attacker embeds hidden access in an internally developed application that bypasses account login.Conduct a code review
  Enable DDoS protectionPatch vulnerable systemsDisable vulnerable servicesChange the default system passwordUpdate the cryptographic algorithmsChange the default application passwordImplement 2FA using push notificationConduct a code reviewImplement application fuzzingImplement a host-based IPSDisable remote access services

Explanation

This question assesses the ability to correctly identify various cyberattack types based on their descriptions and match them with the most effective preventative or remediation actions.

Approach. The correct approach involves carefully reading each attack description and target, then selecting the most accurate attack type and its corresponding best preventative or remediation action from the provided dropdown lists.

1. Attack Description: 'An attacker sends multiple SYN packets from multiple sources.' Target: 'Web server.'

   • Attack Identified: Botnet. Multiple sources sending SYN packets to flood a server is characteristic of a Distributed Denial of Service (DDoS) attack, often executed by a botnet.
   • Remediation: Enable DDoS protection. This is the direct and most effective measure against SYN flood DDoS attacks.

2. Attack Description: 'The attack establishes a connection, which allows remote commands to be executed.' Target: 'User.'

   • Attack Identified: RAT (Remote Access Trojan). RATs are specifically designed to provide persistent remote control and command execution on a compromised system.
   • Remediation: Implement a host-based IPS. A Host-based Intrusion Prevention System can detect and block the unauthorized activities and remote command execution attempts by a RAT.

3. Attack Description: 'The attack is self propagating and compromises a SQL database using well-known credentials as it moves through the network.' Target: 'Database server.'

   • Attack Identified: Worm. The key characteristic 'self propagating' immediately identifies this as a worm.
   • Remediation: Change the default application password. The attack explicitly states it uses 'well-known credentials' to compromise the database. Changing these vulnerable (often default or weak) application-level passwords is a crucial remediation.

4. Attack Description: 'The attacker uses hardware to remotely monitor a user's input activity to harvest credentials.' Target: 'Executive.'

   • Attack Identified: Keylogger. 'Hardware to remotely monitor a user's input activity to harvest credentials' is the definition of a hardware keylogger.
   • Remediation: Implement 2FA using push notification. Even if a keylogger captures a password, Multi-Factor Authentication (MFA) like 2FA makes the stolen password useless without the second factor, significantly mitigating the risk of credential harvesting.

5. Attack Description: 'The attacker embeds hidden access in an internally developed application that bypasses account login.' Target: 'Application.'

   • Attack Identified: Backdoor. 'Hidden access' that 'bypasses account login' in an application is the definition of a backdoor.
   • Remediation: Conduct a code review. Since the backdoor is 'embedded in an internally developed application,' a thorough code review is the most effective method to discover and remove such hidden access points.

Common mistakes.

• common_mistake. Common mistakes include misidentifying similar attack types (e.g., confusing a generic backdoor with a specific RAT or vice versa without careful consideration of the context provided). Another common error is selecting a general or less impactful remediation when a more specific and effective action is available (e.g., choosing 'Patch vulnerable systems' for a DDoS attack instead of 'Enable DDoS protection'). Test-takers might also overlook crucial keywords in the attack description, such as 'self propagating' (worm), 'multiple SYN packets from multiple sources' (botnet/DDoS), or 'hardware to remotely monitor a user's input activity' (keylogger), leading to incorrect selections. Finally, for internally developed applications, choosing a remediation like 'Implement application fuzzing' (which primarily tests for vulnerabilities by providing invalid inputs) over 'Conduct a code review' (which directly inspects the source code for intentionally embedded malicious logic like backdoors) would be incorrect given the specific scenario.

Concept tested. The core concept tested is the ability to identify common cyberattack vectors and types, understand their characteristics and impacts, and correctly associate them with appropriate and effective preventative, detection, or remediation strategies within a cybersecurity context.

No community discussion yet for this question.