Question 341
In Miami, Florida, cybersecurity analyst Laura Bennett is investigating unauthorized access incidents affecting Sunshine Credit Union's online banking platform. Audit logs reveal that compromised accounts consistently involve users who accessed the portal through specially crafted links sent via email.
The links direct victims to the legitimate website, where they proceed to authenticate successfully.
Shortly afterward, unauthorized access to the same accounts is observed without any additional credential guessing or brute-force activity.
Further examination shows that a value associated with the user's interaction with the application remains unchanged throughout the authentication process and can be introduced before the user completes sign-in.
Which countermeasure should Laura implement to prevent this type of account takeover?
The links direct victims to the legitimate website, where they proceed to authenticate successfully.
Shortly afterward, unauthorized access to the same accounts is observed without any additional credential guessing or brute-force activity.
Further examination shows that a value associated with the user's interaction with the application remains unchanged throughout the authentication process and can be introduced before the user completes sign-in.
Which countermeasure should Laura implement to prevent this type of account takeover?
Question 342
During a forensic log review at a satellite communications provider in Denver, Colorado, cybersecurity analyst Kevin Morales identified subtle timestamp irregularities in archived telemetry records. Although the discrepancies were minor, regulatory reporting standards required confirmation that the system clock was synchronizing correctly with its configured time sources.
Kevin needed to interact directly with the host's running time service to review its current associations and operational state. He was not attempting to reset the clock or trace the hierarchy of upstream time authorities, but rather to query the active service for detailed status information from the target machine.
Identify the command Kevin should execute to obtain this information.
Kevin needed to interact directly with the host's running time service to review its current associations and operational state. He was not attempting to reset the clock or trace the hierarchy of upstream time authorities, but rather to query the active service for detailed status information from the target machine.
Identify the command Kevin should execute to obtain this information.
Question 343
During a red team exercise, an attacker dresses as a network technician and gains unchallenged access to a restricted area. Once inside, he roams freely, observing employees and reviewing sensitive documents left unattended. Which of the following tactics best represents this scenario?
Question 344
A security consultant is conducting an authorized assessment for a healthcare billing provider in Phoenix, Arizona. While monitoring internal traffic, he observes an authenticated employee interacting with a sensitive web-based management portal over TCP.
During the session, the consultant carefully crafts and injects packets into the ongoing communication stream.
Shortly afterward, the legitimate user experiences irregular responses from the application, and the server begins processing commands originating from the consultant's injected traffic as though they were part of the established session.
The technique does not involve credential guessing or forcing the user to reauthenticate. Instead, it targets the communication channel already in progress.
From a network-level perspective, what type of session hijacking technique is being demonstrated?
During the session, the consultant carefully crafts and injects packets into the ongoing communication stream.
Shortly afterward, the legitimate user experiences irregular responses from the application, and the server begins processing commands originating from the consultant's injected traffic as though they were part of the established session.
The technique does not involve credential guessing or forcing the user to reauthenticate. Instead, it targets the communication channel already in progress.
From a network-level perspective, what type of session hijacking technique is being demonstrated?
Question 345
Annie, a cloud security engineer, uses the Docker architecture to employ a client/server model in the application she is working on. She utilizes a component that can process API requests and handle various Docker objects, such as containers, volumes. Images, and networks. What is the component of the Docker architecture used by Annie in the above scenario?
