SY0-701 practice questions: Threats, Vulnerabilities, and Mitigations

Answer: A. Objective 2.3 lists firmware alongside end-of-life and legacy under hardware vulnerabilities. NIST SP 800-193 describes platform firmware as highly privileged, necessary for the system to operate and persistent across power cycles because it is held in non-volatile memory, and warns that sophisticated attacks may inject persistent malware into that firmware to modify low-level services, exfiltrate data or otherwise affect the security posture of the system. The practical consequence is the one this item turns on: wiping, repartitioning, reinstalling and rotating credentials all operate above the layer where such an implant lives, so the only signal a responder gets is behaviour that begins before the operating system does. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 2: Threats, Vulnerabilities, and Mitigations

Answer: B. Objective 2.3 lists virtual machine escape and resource reuse as the two virtualization vulnerabilities. NIST SP 800-53 Rev. 5 control SC-4, Information in Shared System Resources, states the principle the platform has broken: the system prevents unauthorized and unintended information transfer via shared system resources, so that information produced by the actions of prior users or roles is not available to any current user or role that obtains access to a shared system resource after that resource has been released back to the system. That is why the leak shows up at provisioning time and concerns data rather than control of the host. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 2: Threats, Vulnerabilities, and Mitigations

Answer: C. Objective 2.4 lists forgery among application attacks, and the indicators here are its signature: requests that are fully authenticated, come from the victim's own browser and address, and follow a visit to another site. OWASP's page on cross-site request forgery explains why: "For most sites, browser requests automatically include any credentials associated with the site, such as the user's session cookie, IP address, Windows domain credentials, and so forth." Under prevention measures that do not work it lists POST-only endpoints ("The misconception is that since the attacker cannot construct a malicious link, a CSRF attack cannot be executed."), multi-step flows ("Multi-Step transactions are not an adequate prevention of CSRF. As long as an attacker can predict or deduce each step of the completed transaction, then CSRF is possible.") and "HTTPS by itself does nothing to defend against CSRF." The OWASP CSRF Prevention Cheat Sheet gives the primary defence: "If the framework does not have built-in CSRF protection, add CSRF tokens to all state-changing requests (requests that cause actions on the site) and validate them on the backend." Source: https://community.owasp.org/attacks/csrf

Answer: A. NIST SP 800-12 describes two kinds of ransomware. Encryptors encrypt files and demand payment to decrypt them. Lockers lock users out of the operating system, and the files remain accessible. Readable documents behind a payment screen point to a locker. A virus and a Trojan horse are different categories of malicious code. Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security (2017), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-12r1.pdf, 4.1.4 Malicious Code (SP80012r1-p34), p. 34 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations

Answer: D. An advanced persistent threat is a long-term intrusion attempting to gain access to specific data. Instead of trying to cause damage, APT attacks are designed to harvest information. The attacker may evade detection, create a back door once enough is known about the network, and use an external command and control system to extract information. Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security (2017), SP80012r1-p31, p. 31 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations