Cyberattack Techniques

Which of the following most appropriately describes a watering hole attack?

1. The attacker exchanges harmless emails disguised as routine business inquiries several times to lower the recipient's guard, then sends an attachment containing malware.
2. The attacker tampers in advance with a website the target organization frequently visits, so that visiting the site alone infects the target with malware.
3. The attacker sends email impersonating an executive or a business partner's contact person to deceive an accounting staff member into transferring money to an account the attacker prepared.
4. The attacker sends an SMS disguised as a delivery company's missed-delivery notice, leading the recipient through a shortened URL to a fake site where they enter their ID and password.

Among targeted attacks, which technique is called an “exchange-type” (interactive) attack?

1. Sending a flood of traffic all at once from many compromised hosts infected with malware, driving the target service into a state where it cannot respond.
2. Exchanging a few rounds of initially harmless inquiry emails to lower the recipient's guard, then sending an attachment containing malware.
3. Investigating a target's affiliation, business partners, and ongoing projects from information posted on public social media.
4. Having a user view a tampered website so that malware is downloaded onto the device without the user noticing, infecting it.

An email arrived under the name of a contact person at a business partner stating, “We have changed our bank account for transfers.” Which response is most appropriate for preventing business email compromise (BEC)?

1. Immediately call the phone number written in the email and confirm the change with the contact person directly.
2. If the sender's email address visually matches the one already registered, proceed to transfer money to the new account as instructed.
3. Call the business partner's phone number that has been registered with the company for some time to confirm the change, and also route the process through approval by multiple people.
4. Scan the attachment and email body with antivirus software, and proceed as normal if no malware is detected.

Which of the following correctly describes smishing?

1. Posing as a staff member of a financial institution or public agency over a voice call and asking the victim to reveal a PIN or card number.
2. Using SMS (short message service) to lead a victim to a fake site and get them to enter an ID, password, or card number.
3. Rummaging through documents or storage media thrown away in the trash to gather internal company information.
4. Displaying a fake virus infection warning while browsing the web and getting the victim to call the listed number and hand over money or remote access.

While browsing a website, a warning sound plays and a screen appears saying, “You have been infected with a virus. Please call the number shown immediately.” Which response is most appropriate for the user to take?

1. Pay the support fee as instructed on the screen and have the infection cleared.
2. Download antivirus software from the link shown on the screen and run it right away.
3. Do not call or pay anything; close the browser and report the incident to the information systems department.
4. Call the phone number shown on the spot and install the recovery software as instructed.

Which of the following is an act of social engineering?

1. Sending a flood of traffic all at once from many malware-infected devices to make a server unable to respond.
2. Sending a string that rewrites a database query into an input field to extract member information.
3. Calling a user while posing as a staff member of the information systems department to get them to reveal their password.
4. Exploiting an OS vulnerability to run arbitrary commands on a server.

Which mechanism is effective for the receiving side to detect and block spoofed email in which the sender's address has been forged?

1. Sender domain authentication such as SPF, DKIM, and DMARC
2. Placeholders (a bind mechanism) used when assembling SQL statements
3. Escaping symbols contained in strings before outputting them to a web page
4. Locking an account after a certain number of consecutive failed logins

A targeted-attack email drill was carried out. Which evaluation criterion should the information security leader emphasize?

1. Measure how many people who noticed a suspicious email actually reported it, and how long it took them to report it after noticing.
2. Keep the drill email's wording and the time it is sent exactly the same every time, and compare only the trend in open rate over the long term.
3. Simply tally, by department, how many people opened the drill email and publish an internal ranking ordered from lowest open rate to highest.
4. Identify the employees who opened the drill email and reflect it in their personnel evaluations, repeating the drill until the open rate falls.

Which of the following most appropriately describes the information security risk of employees' social media use?

1. Social media users fall outside the scope of social engineering.
2. Information posted on social media, such as affiliation, job title, and clients visited, is gathered and used as material to make targeted-attack emails look like they concern a real ongoing project.
3. Using social media inevitably rewrites the cache of DNS servers along the route, redirecting the user to a fake site.
4. Because text posted to social media is sent over an encrypted connection, posting work-related information does not count as an information leak.

An employee realizes they opened an attachment from a targeted-attack email. Which initial procedure should the organization have established for this situation?

1. Let the employee decide on their own to delete the suspicious file and email, and if nothing seems wrong afterward, skip reporting it altogether.
2. Immediately power off the PC, restart it, run a full antivirus scan, and report to the information systems department only if a problem is found.
3. Continue working as normal for a while to preserve evidence, then report afterward.
4. Immediately disconnect the device from the network (unplug a wired connection or turn off Wi-Fi), leave the power on, and contact the information systems department.

Which of the following correctly describes a credential stuffing attack (password list attack)?

1. Mechanically trying every conceivable character combination against a single ID, starting from the shortest and working through them one by one.
2. Taking ID-and-password pairs leaked from another service and trying them as-is against a different service.
3. Fixing the password to a single common string and trying it against a succession of different IDs.
4. Using a lookup table that maps hash values to their original strings to work out the original password from a stolen hash.

A company's member site experienced numerous unauthorized logins using correct ID-and-password pairs. Every user's password was sufficiently long and complex. Which countermeasure is most appropriate?

1. Have the development vendor modify the system so database queries are built using placeholders (a bind mechanism).
2. Notify users not to reuse the same password across other services, and also introduce multi-factor authentication.
3. Embed an unguessable token on pages that perform update operations, and verify that the submitted value matches it.
4. Apply escaping to strings output to the screen so that symbols are not interpreted as script.

Despite having account lockout in place, an unauthorized login occurred without the lockout ever triggering. Which attack was most likely carried out?

1. A DoS attack, which sends a flood of traffic to a server to make the service unable to respond
2. A brute-force attack, which tries every conceivable character combination against a single ID in rapid succession
3. A password spraying attack, which tries a few commonly used passwords against many IDs, spaced out over time
4. A dictionary attack, which tries words found in a dictionary or commonly used strings against a single ID in rapid succession

Which of the following correctly describes a reverse brute-force attack?

1. Using a precomputed lookup table to work out the original password from a hash value.
2. Inserting oneself between two communicating parties to eavesdrop on or alter the content.
3. Fixing the password to one value and trying a succession of different IDs against it.
4. Resending intercepted authentication data as-is so it passes authentication.

Which of the following correctly explains the difference between a dictionary attack and a brute-force attack?

1. A dictionary attack tries candidates such as words and commonly used strings, while a brute-force attack tries every conceivable character combination one after another.
2. A dictionary attack uses a precomputed lookup table to work out the original string from a hash value, while a brute-force attack varies the ID as it tries.
3. A dictionary attack hijacks an authenticated session, while a brute-force attack guesses at and tries passwords.
4. A dictionary attack tries leaked ID-and-password pairs as-is, while a brute-force attack tries dictionary words.

Which countermeasure is most appropriate against a rainbow table attack?

1. Design the system so it never takes a file name directly from the user, but instead has them specify a pre-defined identifier.
2. Add a different random string (a salt) to each password before hashing it, and repeat the hash computation multiple times (stretching).
3. Embed an unguessable token on pages that perform update operations, and have the server verify the submitted token every time.
4. Temporarily disable an account once consecutive login failures reach a set number, requiring an administrator to unlock it.

Which of the following correctly describes session hijacking?

1. Spoofing a packet's source IP address to slip past access restrictions and connect.
2. Sending a flood of traffic all at once from many compromised hosts infected with malware to make a target server unable to respond.
3. Making a DNS server's cache remember false address information, redirecting a user who typed the correct URL to a fake site.
4. Guessing or stealing the session ID of a logged-in user and operating the system while impersonating that user.

In a web application, which countermeasure is most appropriate for preventing session hijacking through cookie theft?

1. Set the HttpOnly and Secure attributes on cookies, encrypt the communication with TLS, and reissue the session ID upon successful login.
2. Require users to change their password periodically, ban reuse of past passwords, and send reminder notices to users who have not changed theirs.
3. Temporarily disable an account once consecutive login failures reach a set number, and automatically unlock it after a set time has passed.
4. Require users to set a password of a minimum length that mixes uppercase and lowercase letters, numbers, and symbols.

When using an in-house system from a public Wi-Fi network outside the office, which countermeasure is most appropriate against eavesdropping or tampering via a man-in-the-middle (MITM) attack?

1. Have users change to long, complex passwords and operate a policy of changing them at regular intervals.
2. Temporarily disable an account once consecutive login failures reach a set number, and notify the administrator.
3. Encrypt communications with TLS or a VPN, and abort the connection if a server certificate warning appears.
4. Modify the system so database queries are built using placeholders (a bind mechanism).

Which combination of a description of a replay attack and its countermeasure is correct?

1. An attack that tries words found in a dictionary in succession to break authentication; countermeasures are salting and stretching.
2. An attack that gets a logged-in user to click a crafted link, causing an unintended action to be executed; countermeasures are account lockout and periodic password changes.
3. An attack that sends a flood of connection requests to a server to stop the service; the countermeasure is multi-factor authentication.
4. An attack that resends intercepted authentication data as-is to pass authentication; countermeasures include one-time passwords, single-use random numbers, and timestamps.

A large amount of member information leaked from a company's member site. Investigation showed that a crafted string sent through an input field had rewritten a database query. Which fundamental fix should be requested from the development vendor?

1. Require users to use multi-factor authentication, prompting for a verification code at login.
2. Embed an unguessable token on pages that perform update operations, and add a mechanism that checks that value when it is submitted.
3. Add a mechanism that temporarily disables an account once consecutive login failures reach a set number, and notify the administrator.
4. Build SQL statements using placeholders (a bind mechanism) so that input values are never interpreted as commands.

On a message board that displays whatever a user types exactly as entered, a vulnerability was found that lets a malicious script run in the browser of other users who view the page. Which countermeasure is most appropriate?

1. Hash user passwords with a salt, apply stretching, and then store them in the database.
2. Apply escaping when outputting to the screen, so symbols are not interpreted as script.
3. Build SQL statements using placeholders (a bind mechanism) so that input values are never interpreted as commands.
4. Embed an unguessable token on pages that perform update operations, and check the submitted value on the server side.

A logged-in user merely opened a link in an email, and an unintended account-cancellation process was carried out without the user meaning to do so. Which countermeasure is most appropriate against this attack?

1. Stop accepting a file name directly from the user, and redesign the system so the target is specified with a pre-defined identifier instead.
2. Temporarily disable an account once consecutive login failures reach a set number, and unlock it after a set time has passed.
3. Apply escaping to strings output to the screen so that entered symbols are not interpreted as script.
4. Embed an unguessable token on the page that accepts the request, and confirm that the submitted token is correct.

Which of the following correctly describes directory traversal?

1. Mixing a relative path into a parameter that specifies a file name to read a file from a parent directory that was never meant to be exposed.
2. Sending data longer than the memory area a program has allocated, to hijack the program's behavior.
3. Putting a crafted string into an input field to rewrite a database query and extract information that is not meant to be public.
4. Overlaying a transparent page on top of a genuine screen so the user clicks somewhere they did not intend to.

Which of the following is the most appropriate example of damage that can result from OS command injection?

1. A malicious script runs in a viewer's browser, stealing cookies or a session ID.
2. An unintended settings change or account cancellation is carried out under a logged-in user's own authority.
3. A command chosen by the attacker runs on the web server, taking over the server itself.
4. A DNS server's cache is rewritten so a user who types the correct URL is redirected to a fake site.

Which combination of an attack that exploits a buffer overflow and its countermeasure is correct?

1. An attack that displays a string entered by a user exactly as typed, running a malicious script in the browser of other viewers; the countermeasure is introducing account lockout.
2. An attack that tries leaked ID-and-password pairs from another service as-is; the countermeasure is using placeholders.
3. An attack that sends a flood of traffic from many compromised hosts infected with malware; the countermeasure is escaping at output time.
4. An attack that sends data longer than the memory area a program has allocated to hijack its behavior; checking input data length and applying patches are the countermeasures.

Which of the following correctly describes clickjacking?

1. Merely viewing a tampered website triggers an exploit of a browser vulnerability, causing malware to be downloaded without the user noticing.
2. On a page that displays a string entered by a user exactly as typed, running a script in the browser of other viewers.
3. Sending queries with a spoofed source IP address to many DNS servers so that large responses are concentrated on the target.
4. Overlaying a transparent page on top of a genuine screen so a user clicks somewhere they never meant to press, triggering an action.

Which countermeasure can be expected to be most effective for a user to prevent infection via a drive-by download?

1. Delete the web browsing history and cache every day.
2. Review access rights to the internal shared folder and limit them to only those who need them.
3. Change passwords periodically and avoid reusing the same one across other services.
4. Always keep the OS, the browser, and the software used by the browser up to date.

Which of the following correctly explains the difference between cross-site scripting (XSS) and cross-site request forgery (CSRF)?

1. XSS is an attack that lures a user to a fake website to get them to enter an ID and password, countered by raising user awareness; CSRF is an attack that sends a flood of traffic to a server to make it unable to respond, countered by controlling traffic volume.
2. XSS is an attack that runs an arbitrary OS command on a web server, countered by input validation; CSRF is an attack that overflows a memory area to hijack behavior, countered by applying patches.
3. The countermeasure for XSS is checking a token, and the countermeasure for CSRF is escaping at output time.
4. XSS is an attack that runs a script in another user's browser, countered by escaping; CSRF is an attack that carries out an unintended action under a user's own authority, countered by checking a token.

In a web application, against which of the following attacks is validating input values (allowing through only permitted characters or names) one effective countermeasure?

1. Directory traversal and OS command injection
2. Replay attacks and session hijacking
3. DNS cache poisoning and DNS reflection attacks
4. Rainbow table attacks and credential stuffing

Which of the following correctly describes a DDoS attack?

1. Secretly planting a program on a user's PC that mines cryptocurrency, and continuing to use its computing power and electricity without permission for profit.
2. First compromising a lightly defended organization such as a business partner or subsidiary, then using it as a stepping stone to reach the real target's internal network and steal the intended information.
3. Secretly inserting oneself between two communicating parties, eavesdropping on the exchange, or relaying altered content to control the communication.
4. Sending a flood of traffic or processing requests all at once from many devices infected with malware, making the target service unusable.

Which of the following correctly describes a DNS reflection attack (DNS amplification attack)?

1. Manually mashing the browser's reload button repeatedly to have the same page loaded over and over, placing a sustained load on the server.
2. Sending only connection requests in large numbers, never replying, building up a backlog of half-open connections until the server's resources are exhausted, stopping the service.
3. Sending many small queries, with the source IP address spoofed to the target's address, to numerous DNS servers so that large responses are concentrated on the target.
4. Making a DNS server's cache remember false address information, redirecting a user who typed the correct URL to the attacker's fake site.

Which of the following correctly describes a SYN flood attack?

1. Attacking by exploiting a vulnerability for which no patch has yet been made available.
2. Falsely announcing the correspondence between a source MAC address and IP address to pull traffic on the same LAN toward one's own device and eavesdrop on it.
3. Sending only connection requests in large numbers and never replying, building up a backlog of half-open connections until the server's resources are exhausted.
4. Sending a crafted string into a web application's input field to rewrite a database query and extract member information.

Even though a user typed the correct URL, they ended up connecting to a fake website. Which attack is the most likely cause of this?

1. SYN flood attack
2. Replay attack
3. Clickjacking
4. DNS cache poisoning

Which combination of explanations for ARP spoofing and IP spoofing is correct?

1. ARP spoofing falsifies an email sender's name to gain trust, while IP spoofing tampers with a web page to rewrite its display.
2. ARP spoofing falsifies the correspondence between MAC and IP addresses within the same LAN to pull traffic toward the attacker, while IP spoofing forges a packet's source IP address.
3. ARP spoofing forges a packet's source IP address, while IP spoofing forges the MAC-address correspondence within the same LAN.
4. ARP spoofing makes a DNS server's cache remember false information to redirect victims to a fake site, while IP spoofing steals a user's session ID to impersonate them.

Which of the following is the most appropriate preparation against a zero-day attack?

1. In addition to thoroughly applying updates, combine defense in depth with behavior-based detection, and build a detection and response system that assumes intrusion can happen.
2. Set all incoming email from outside the company to be rejected, and switch business communication to phone calls only.
3. Thoroughly enforce a policy of changing passwords periodically and tell everyone to stop reusing them.
4. Since applying a patch is guaranteed to prevent it, simply tell everyone in the company to keep systems updated and take no other precautions.

Which of the following correctly describes a supply chain attack?

1. Compromising a lightly defended business partner, subsidiary, or the provider of widely used software, then reaching the real target through it.
2. Calling by phone using an AI-synthesized voice of an executive, instructing an accounting staff member to make an urgent transfer into the attacker's account.
3. Sending a flood of traffic from many compromised hosts against a company's own public server, halting order intake and disrupting operations.
4. Secretly planting a cryptocurrency mining program on a company's own PCs and using their computing power and electricity without permission.

For business software a company had used for many years, the provider was compromised, and a malicious program had been mixed into an update published on the legitimate distribution site. Devices at the company that applied the update became infected. Which lesson should be drawn from this case?

1. Since applying updates itself has proven dangerous, the company should adopt a policy of never applying any patch distributed by the provider from now on and keep running the currently used version, notifying all departments accordingly.
2. Because even a legitimate acquisition channel can be compromised, continuously check information published by the provider, set up monitoring for suspicious communication or behavior after an update, and prepare a detection and response system that assumes intrusion can happen.
3. Changing users' passwords to long, complex ones and introducing multi-factor authentication would prevent the same kind of damage.
4. Since it was the provider that was compromised, and the update was obtained from the legitimate distribution site, there is no way for a user to have seen it coming, and so there is nothing the company itself can do to prepare or respond.

Which of the following is the most appropriate way cryptojacking damage tends to show up?

1. Customer information is posted on an outside message board, and inquiries and complaints from customers flood in, disrupting normal business as staff scramble to respond day after day.
2. A company's website stops responding and can no longer take orders, causing lost sales opportunities to keep accumulating until recovery is complete.
3. Even though the correct URL was typed, the user is connected to a fake site without noticing, and the ID, password, or card number entered there is stolen.
4. With no sign of any information leak, a device's performance suddenly becomes sluggish, or cloud usage fees or electricity bills increase unnaturally.

As misuse of generative AI and deepfakes spreads, which response should an organization take?

1. Tell employees that an email may be considered genuine if its Japanese wording is natural and free of errors.
2. If a caller's voice matches the person's own, allow a transfer or a change of payment destination based on the verbal instruction alone.
3. Do not let the naturalness of the wording or the voice alone determine authenticity; require a callback to a registered contact and approval from multiple people before any transfer or change of payment destination.
4. Banning the use of generative AI within the company entirely will eliminate phishing email damage.