At a power distribution facility in Phoenix, Arizona, ethical hacker Sameer Das is performing an OT security assessment. He demonstrates that a programmable controller accepts modifications delivered over the network without checking the origin or cryptographic validity of the package. By uploading altered instructions, he changes how the controller processes commands during operations. Which IoT/OT threat best represents this technique?
Correct Answer: B
Modifying and uploading altered instructions to a programmable controller without authentication or cryptographic verification represents a firmware update attack, where malicious or unauthorized firmware changes the device's operational behavior.
Question 332
As a cybersecurity analyst for SecureNet, you are performing a security assessment of a new mobile payment application. One of your primary concerns is the secure storage of customer data on the device. The application stores sensitive information such as credit card details and personal identification numbers (PINs) on the device. Which of the following measures would best ensure the security of this data?
Correct Answer: B
Encrypting all sensitive data stored on the device is the best measure to ensure the security of this data, because it protects the data from unauthorized access or disclosure, even if the device is lost, stolen, or compromised. Encryption is a process of transforming data into an unreadable format using a secret key or algorithm. Only authorized parties who have the correct key or algorithm can decrypt and access the data. Encryption can be applied to data at rest, such as files or databases, or data in transit, such as network traffic or messages. Encryption can prevent attackers from stealing or tampering with the customer data stored on the device, such as credit card details and PINs, which can cause financial or identity fraud. The other options are not as effective or sufficient as encryption for securing the customer data stored on the device. Implementing biometric authentication for app access may provide an additional layer of security, but it does not protect the data from being accessed by other means, such as malware, physical access, or backup extraction. Enabling GPS tracking for all devices using the app may help locate the device in case of loss or theft, but it does not prevent the data from being accessed by unauthorized parties, and it may also pose privacy risks. Regularly updating the app to the latest version may help fix bugs or vulnerabilities, but it does not guarantee the security of the data, especially if the app does not use encryption or other security features. References: * Securely Storing Data | Security.org * Data Storage Security: 5 Best Practices to Secure Your Data * M9: Insecure Data Storage | OWASP Foundation
Question 333
An incident investigator asks to receive a copy of the event logs from all firewalls, proxy servers, and Intrusion Detection Systems (IDS) on the network of an organization that has experienced a possible breach of security. When the investigator attempts to correlate the information in all of the logs, the sequence of many of the logged events do not match up. What is the most likely cause?
Correct Answer: A
Many network and system administrators don't pay enough attention to system clock accuracy and time synchronization. Computer clocks can run faster or slower over time, batteries and power sources die, or daylight-saving time changes are forgotten. Sure, there are many more pressing security issues to deal with, but not ensuring that the time on network devices is synchronized can cause problems. And these problems often only come to light after a security incident. If you suspect a hacker is accessing your network, for example, you will want to analyze your log files to look for any suspicious activity. If your network's security devices do not have synchronized times, the timestamps' inaccuracy makes it impossible to correlate log files from different sources. Not only will you have difficulty in tracking events, but you will also find it difficult to use such evidence in court; you won't be able to illustrate a smooth progression of events as they occurred throughout your network.
Question 334
At a multinational manufacturing company in Stuttgart, Germany, security architect Elena Schmidt was reviewing the configuration of the perimeter defense system during a network segmentation project. The system was responsible for controlling all inbound and outbound traffic between the corporate network and external partners. She observed that the firewall first ensured a valid connection had been successfully established between endpoints before permitting further communication. Once this validation was complete, traffic flowed freely in both directions without continued inspection at the packet level. However, any attempt to transmit data without completing this initial connection process was immediately rejected. Determine the type of firewall being described.
Correct Answer: B
A circuit-level gateway validates the establishment of a transport-layer session before permitting traffic to pass through the protected boundary. For TCP connections, it observes the handshake and creates a logical circuit or proxy connection between the endpoints. Packets that do not belong to a properly established session can therefore be rejected. After establishing the circuit, this type of gateway generally forwards traffic without examining application commands or content in depth. That characteristic matches the statement that communication subsequently flows in both directions without continuing packet-level or payload inspection. Circuit-level gateways are useful for concealing internal addressing and enforcing valid session establishment, but they cannot independently determine whether application data transported through an approved circuit is malicious. A packet-filtering firewall applies rules to individual packet headers, such as source and destination addresses, ports, protocols, and TCP flags. "Host-based" and "network-based" describe where a firewall is deployed rather than the specific connection-validation behavior described in the question. A host-based firewall operates on an endpoint, while a network firewall protects traffic crossing a network boundary. The connection-oriented behavior is therefore the decisive clue for a circuit-level gateway. NIST's Guidelines on Firewalls and Firewall Policy explains the distinctions between packet filtering, stateful inspection, application gateways, and other firewall technologies.
Question 335
An authorized penetration tester is assessing an organization's external attack surface. The objective is to discover publicly accessible subdomains without directly interacting with the target's infrastructure whenever possible. Which reconnaissance technique BEST satisfies this requirement?
Correct Answer: B
Certificate Transparency logs, search engines, passive DNS databases, and other OSINT sources allow testers to identify subdomains with little or no interaction with the target's infrastructure. Passive reconnaissance minimizes detection while providing valuable information. Active scanning generates traffic and is unnecessary during the initial discovery phase.
