2.0 · 22% of the exam

Threats, Vulnerabilities, and Mitigations

Who attacks, how they get in, which weakness they use, and the mitigation that actually stops the spread. This is the highest-search domain on the public index.

• 2.1 · ScenarioA systems administrator who was passed over for promotion uses a still-valid admin account to export the customer table the night before their last day. No exploit is involved. Which actor label fits best?
• 2.2 · ScenarioAttackers compromise the agenda site of an industry conference because the target company’s engineers all visit it the week before they travel. The engineers’ own mail is never touched. What is this vector called?
• 2.3 · AppliedA support forum saves comments and later renders them as HTML for every reader. An attacker posts a comment that runs script in other users’ browsers. Which vulnerability is this?
• 2.3 · FoundationalA scanner reports a missing patch that the vendor published 40 days ago. A manager calls it a zero-day in the status meeting. Why is that the wrong word?
• 2.4 · ScenarioA build server’s CPU stays near 100% after hours. Fans are loud. Firewall logs show steady outbound connections to a known mining pool. Files on the server open normally, and nobody has found a ransom note. What is the most likely activity?
• 2.5 · ScenarioLateral movement is confirmed inside one server VLAN. Incident response is starting. Which action best limits further spread while preserving evidence?
• 2.4 · AppliedThe same account authenticates to the VPN from Lisbon and, four minutes later, from Singapore. The user is on a train in Lisbon and does not hold a second phone. What should this alert be called?