Attackers or insiders create a backdoor into a trusted network by installing an unsecured access point inside a firewall. They then use any software or hardware access point to perform an attack. Which of the following is this type of attack?
After a web application attack, HealthFirst traced the breach to an insecure Direct Object Reference (IDOR) vulnerability. They want to patch it and fortify the app. What should be their primary action?
Allan performed a reconnaissance attack on his corporate network as part of a red-team activity. He scanned the IP range to find live host IP addresses. What type of technique did he use to exploit the network?
Following a spear-phishing campaign targeting executive-level employees, a mid-sized financial firm experienced unauthorized access to internal systems, leading to widespread disruption of customer-facing applications. Although the technical issues were resolved within days, the breach triggered legal scrutiny and negative press coverage. Several major customers expressed concern about the firm ' s risk posture and began transitioning to competitors. Investor confidence was impacted as the stock value dipped, and senior leadership initiated a damage control campaign. Which of the following best categorizes the broader consequences experienced by the organization?
Which of the following techniques prevent or mislead incident-handling process and may also affect the collection, preservation, and identification phases of the forensic
investigation process?
Jake, a senior incident responder in a financial institution ' s SOC, receives a high-severity alert from the intrusion detection system (IDS). The alert indicates a flood of SYN packets targeting the internal web server, which has now become sluggish and unresponsive to legitimate client requests. The sudden surge in half-open connections is causing resource exhaustion on the server. Suspecting a SYN flood attack—a type of denial-of-service (DoS) attack—Jake needs to verify the source and nature of the traffic to determine the appropriate containment and mitigation strategy while preserving system integrity and uptime. What step should Jake take first in response to this suspected DoS incident?
Which of the following port scanning techniques involves resetting the TCP connection
between client and server abruptly before completion of the three-way handshake
signals, making the connection half-open?
WebMega, a leading e-commerce giant with over a billion users, suffered a massive data breach, compromising sensitive user data, including financials. During the containment phase, IH & R teams discovered a meticulous attack pattern that bypassed multiple security layers, hinting at an insider ' s involvement. Investigations revealed that three recently fired employees, with ties to a rival company, had possible motives and means. How should WebMega proceed?
After deploying a new application on Google Cloud Platform (GCP), a security engineer discovers that an unauthorized entity has been accessing the application ' s backend services. Which of the following measures should the engineer take first to address this security incident?
DeltaCorp, a global e-commerce company, received an email sent to the financial department claiming to be from the CEO, requesting an urgent transfer of funds. To determine the legitimacy of this potentially deceptive email, which of the following should be the primary focus of the investigation?
