Chapter 37 · Quiz

Misconfiguration Vulnerabilities Quiz

Seven questions covering open permissions, admin accounts, insecure protocols, default settings, and open ports.

Q1. A security analyst discovers that a cloud storage bucket containing customer data is accessible to anyone on the internet without authentication. No credentials were stolen and no vulnerability in any application was exploited. Which misconfiguration category does this represent?

A. Insecure protocol B. Open permissions C. Default settings D. Open ports and services

Q2. Which of the following BEST describes the Verizon S3 data exposure incident in 2017?

A. An attacker exploited a SQL injection vulnerability in Verizon's web application to access customer data B. A third-party contractor configured an S3 bucket containing 14 million customer records with public read access, making the data accessible without authentication C. An insider threat at Verizon intentionally made a storage bucket public to exfiltrate data D. Attackers intercepted Verizon employee credentials over an unencrypted network connection and used them to access cloud storage

Q3. A Linux system administrator wants to allow specific senior engineers to perform administrative tasks without sharing the root password or logging in directly as root. Which approach BEST implements this requirement?

A. Create a shared "admin" account with the root password stored in a password manager accessible to senior engineers B. Enable root SSH login and provide the root password only to senior engineers C. Grant specific named accounts sudo privileges for the commands they need, with their own individual authentication D. Create a group called "admins," add senior engineers to it, and configure all files to be owned by the admins group

Q4. A network engineer runs a packet capture on an internal management network and is able to read administrator usernames and passwords in cleartext. Which protocol is MOST likely responsible for this exposure?

A. SSH B. HTTPS C. Telnet D. SFTP

Q5. The Mirai botnet primarily exploited which misconfiguration to compromise hundreds of thousands of IoT devices?

A. Open S3 bucket permissions on device management portals B. Unpatched firmware vulnerabilities in camera management interfaces C. Unchanged default credentials on IoT devices accessed over Telnet D. SQL injection vulnerabilities in device web interfaces

Q6. A security team conducts a firewall audit and discovers rules permitting inbound connections from an IP address range that was used by an acquired company, but the acquisition was unwound three years ago and those IP ranges are no longer in use. What risk does this create, and what is the correct action?

A. No risk — if the IP range is not in use, no traffic will come from it; the rules are harmless B. The IP range may have been reassigned; a new owner of those addresses would have unintended network access; remove the stale rules C. The risk is reputational — document the stale rules but leave them in place to avoid disrupting existing configurations D. Block the IP range with a deny rule above the allow rule, but leave the original allow rule in place for documentation

Q7. Match each misconfiguration to the security control that directly addresses it.

Select the answer that correctly pairs ALL four misconfigurations with their controls.

Match each item on the left with its correct control on the right:

Open S3 bucket

Telnet used for device management

IoT device with admin/admin credentials

Unrestricted direct root SSH login

A. Enable Block Public Access at account level; audit bucket ACLs

B. Disable PermitRootLogin in sshd_config; require sudo for elevation

C. Replace with SSH; block port 23 at the firewall

D. Change default credentials before deployment; never deploy with factory defaults

Click choices on the right to assign them to the items above.