Sophia, a security analyst, notices that a sensitive folder on a file server was accessed during off-hours by an intern using authorized credentials. The access was not flagged because the intern ' s permissions had not been reviewed in months after their project ended. What process should have been enforced to avoid this insider threat?
An attacker traced out and found the kind of websites a target company/individual is
frequently surfing and tested those particular websites to identify any possible
vulnerabilities. When the attacker detected vulnerabilities in the website, the attacker
started injecting malicious script/code into the web application that can redirect the
webpage and download the malware onto the victim’s machine. After infecting the
vulnerable web application, the attacker waited for the victim to access the infected web
application.
Identify the type of attack performed by the attacker.
Eric works as a system administrator in ABC organization. He granted privileged users with unlimited permissions to access the systems. These privileged users can misuse
their rights unintentionally or maliciously or attackers can trick them to perform malicious activities.
Which of the following guidelines helps incident handlers to eradicate insider attacks by privileged users?
A national research agency was recently subjected to a comprehensive cybersecurity compliance audit. During the audit, reviewers evaluated how the agency ' s incident response unit manages harmful code samples during investigations. The assessment revealed that team members often interacted with dangerous file payloads directly on enterprise-connected systems used for general operations. Furthermore, no precautionary renaming was applied to prevent accidental triggering, and sensitive materials were placed in areas accessible by non-specialized personnel. The auditors flagged these practices as severely noncompliant with safe sample processing protocols and recommended urgent changes to prevent operational fallout or accidental outbreaks. Which best practice for secure handling of malicious code was most clearly disregarded in this case?
In which of the following phases of incident handling and response (IH & R) process the identified security incidents are analyzed, validated, categorized, and prioritized?
Which of the following tools helps incident handlers to view the file system, retrieve deleted data, perform timeline analysis, web artifacts, etc., during an incident response process?
SafePay, an online payment portal, recently introduced an advanced search feature allowing users to search for their transaction history. A week later, an alarming number of users reported unauthorized transactions. Investigation showed that attackers were using advanced search strings, exploiting a previously unidentified vulnerability. What is SafePay ' s best immediate action?
Jason, a cybersecurity analyst in the incident response team, begins investigating several complaints from employees who received emails urgently requesting wire transfers to an overseas account. The emails appeared to come from the company ' s CEO, using a tone of authority and pressure to bypass standard procedures. Upon closer inspection, Jason identifies that the sender ' s email address includes a minor alteration in the domain name—a form of domain spoofing. He examines the email headers, confirms the falsified sender identity, and cross-checks with the actual CEO ' s activity logs to ensure there was no internal compromise. Immediately, Jason blocks the sender ' s IP address at the firewall level, alerts the finance department to prevent any unauthorized transactions, and issues a company-wide advisory about the impersonation attempt. What type of phishing is Jason handling?
A global manufacturing company detected unauthorized privilege escalation on an OT workstation connected to production systems. The attacker’s persistence and data exfiltration are not fully identified. The CISO wants to limit lateral movement without alerting the attacker. Which containment action best aligns with this objective?
