212.       B. Once this issue is remediated, Rick should investigate why the system was running a plug-in from 2007. In many cases, when you discover a vulnerable component like this it indicates a deeper issue that exists in the organization or processes for system and appli- cation maintenance. Installing a web application firewall (WAF) or reviewing intrusion prevention system (IPS) logs may be useful if Rick thinks there are ongoing attacks or that successful attacks have occurred, but the problem does not state anything about that. There is no indication of compromise, merely a completely outdated plug-in version in the problem. If you want a sample system with vulnerable plug-ins like this to test, you can download the 2015 release of the Open Web Application Security Project (OWASP) broken web applications virtual machine. It has a wide range of completely out-of-date applications and services to practice against.

207.       B. The Security+ exam outline lists seven major impact categories, including data loss, data breaches, and data exfiltration. Data modification is not listed, but it is a concern as part of the integrity leg of the CIA triad.

203.       C. Although it may seem strange at first, both SourceForge and GitHub are used to house sample exploit code as well as other information that threat intelligence analysts may find useful. They are not part of the dark web, nor are they an automated indicator sharing (AIS) source or a public information sharing center.

201.       A. SOAR tools, like security information and event management (SIEM) tools, are highly focused on security operations. They include threat and vulnerability management, security incident response, and security operations and automation tools, but they do not provide source code analysis and testing tools.

199.       D. Predictive analysis tools use large volumes of data, including information about security trends and threats, large security datasets from various security tools and other sources, and behavior patterns, to predict and identify malicious and suspicious behavior.

180.       B. Lighting and utility systems, as well as SCADA, PLCs, CNC, scientific equipment and similar devices are types of operational technology. Since this is a distributed attack that results in a denial of service, it is a distributed denial-of-service (DDoS) attack. OT systems are often isolated or otherwise protected from remote network connections to prevent this type of attack since many OT devices do not have strong security controls or frequent updates. A SCADA overflow is not a term used in the industry, but network and application DDoS attacks do appear on the Security+ exam outline, and you will need to be able to differentiate them from this type of OT DDoS.

168.       C. You may be familiar with the term war driving, but war flying is increasingly common as drones have entered wide use. Although penetration testers are somewhat unlikely to fly a helicopter or airplane over a target site, inexpensive drones can provide useful insight into both physical security and wireless network coverage if equipped with the right hardware. Droning and aerial snooping were made up for this question, and Air Snarf is an old tool for capturing usernames and passwords on vulnerable wireless networks.

162.       C. The penetration tester leveraged the principle of urgency and also used some elements of authority by claiming to be a senior member of the organization. They didn’t threaten or intimidate the help desk staff member and did not make something seem scarce, nor did they attempt to build trust with the staff member.

150.       C. Consumer wireless routers provide local administrative access via their default creden- tials. Although they recommend that you change the password (and sometimes the user- name for greater security), many installations result in an unsecured administrative account. The other answers are all common issues but not what is described in the question.

125.       A. In a man-in-the-browser attack, the malware intercepts calls from the browser to the system, such as system libraries. On-path attack involves having some process between the two ends of communication in order to compromise passwords or cryptography keys. In a buffer overflow attack, more data is put into a variable than the variable was intended to hold. Session hijacking involves taking over an authenticated session.

103.       B. Cross-site request forgery (XSRF or CSRF) sends forged requests to a website, suppos- edly from a trusted user. Cross-site scripting (XSS) is the injection of scripts into a website to exploit the users. A buffer overflow tries to put more data in a variable than the variable can hold. A remote-access Trojan (RAT) is malware that gives the attacker access to the system.

98.      C. DNS poisoning occurs when false DNS information is inserted into legitimate DNS servers, resulting in traffic being redirected to unwanted or malicious sites. A backdoor pro- vides access to the system by circumventing normal authentication. An APT is an advanced persistent threat. A Trojan horse ties a malicious program to a legitimate program.

95.      A. A zero-day exploit or attack occurs before the vendor has knowledge of it. The remainder of the answers don’t accurately describe a zero-day attack—just because it has not yet been breached does not make it a zero-day, nor is a zero-day necessarily quickly exploitable. Finally, a zero-day attack does not specify how long the attacker may have access.

84.      C. Using default settings is a form of weak configuration. Many vulnerability scanners and attack tools have default settings built-in to test with, and default settings are easily obtained for most devices with a quick search of the Internet. Configuring the accounts is not the issue; changing default passwords and settings is. Although training users is important, that’s not the issue in this scenario. Patching systems is important, but that won’t change default settings.

80.      B. The Security+ exam expects practitioners to be able to analyze scripts and code to deter- mine roughly what function they perform and to be able to identify multiple programming languages. Python relies on formatting like indenting to indicate blocks of code and does not use line end indicators as you would find in some languages. This code is a basic Python port scanner that will scan every port from 1 to 9999, checking to see if it allows a connection.

78.      A. A macro virus is a malicious script (macro) embedded into a file, typically a Microsoft Office file. They are typically written in Visual Basic for Applications (VBA) script. A boot sector virus infects the boot sector of the hard drive. A Trojan horse is malware that is tied to a legitimate program. In this scenario, the malware is actually embedded in an Office docu- ment. The two are similar, but not the same. A remote access Trojan (RAT) is a Trojan horse that gives the attacker remote access to the machine.

51.      C. This description does not include any risk to availability since there is no information about systems or services being down or offline. This scenario would likely result in reputa- tional, financial, and data loss impacts for Scott’s company.

47.      A. This is a remote-access Trojan (RAT), malware that opens access for someone to remotely access the system. A worm would have spread itself via a vulnerability, whereas a logic bomb runs when some logical condition is met. Finally, a rootkit provides root or administrative access to the system.

45.      A. Since Dennis is able to view the web traffic before it is sent to the actual server, he should be able to conduct a plain-text password attack by intercepting the password. Pass-the-hash attacks are typically used inside Windows environments, SQL injection would attack the server, and cross-site scripting is possible but not as likely as the plain-text password attack in this scenario.

35.      C. SOAR is a relatively new category as defined by Gartner. Security orchestration, automa- tion, and response includes threat and vulnerability management, security incident response, and security operations automation, but not automated malware analysis.

33.      D. A pivot occurs when you exploit one machine and use that as a basis to attack other systems. Pivoting can be done from internal or external tests. White- and black-box testing describes the amount of information the tester is given in advance, not how the tester per- forms the test.

28.      B. Systems and software that no longer have vendor support can be a significant security risk, and ensuring that a vendor will continue to exist and provide support is an important part of many procurement processes. Selah’s questions are intended to assess the longevity and viability of the company and whether buying from them will result in her organization having a usable product for the long term.

16.      B. White teams act as judges and observers during cybersecurity exercises. Blue teams act as defenders, red teams act as attackers, and purple teams are composed of both blue and red team members to combine attack and defense knowledge to improve organizational security.

11.      C. The machines in her network are being used as bots, and the users are not aware that they are part of a distributed denial-of-service (DDoS) attack. Social engineering is when someone tries to manipulate you into giving information. Techniques involved in social engineering attacks include consensus, scarcity, and familiarity. There is a slight chance that all computers could have a backdoor, but that is very unlikely, and attackers normally don’t manually log into each machine to do a DDoS—it would be automated, as through a bot.

5.          B. The best option listed to defend against the attacks mentioned is input validation. Encrypting the web traffic will not have any effect on these two attacks. A web application firewall (WAF) might mitigate these attacks, but it would be secondary to input validation, and an intrusion detection system (IDS) will simply detect the attack—it won’t stop it.