Exam: Chapters 19–25 · Security+ SY0-701

Chapters 19–25 Practice Exam

📝 20 scored questions ⏱️ 25-minute target 🎯 Pass threshold: 80% (16/20)

Time remaining

25:00

Part A — Multiple Choice (Questions 1–20)

Ch 19 · Threat Actors

Question 1 of 20

A threat intelligence team attributes a series of intrusions to a group that has maintained undetected access to a defense contractor's network for 14 months, exfiltrating engineering documents. The group uses custom-built malware and appears to operate during business hours in a specific time zone aligned with a foreign government. Which threat actor category BEST describes this group?

A. Hacktivist — the group is motivated by ideological opposition to defense spending B. Nation-state APT — state-sponsored, highly sophisticated, long-dwell persistence focused on intelligence gathering C. Organized crime — motivated by financial gain through data resale D. Unskilled attacker — using pre-built exploit kits downloaded from public forums

✅ B — Nation-state APT. The defining markers are all present: 14-month dwell time (APT = Advanced Persistent Threat), custom malware (high sophistication requiring significant resources), targeting of national-security-relevant intellectual property (espionage motivation), and business-hours operation in a foreign time zone (state-employed actors). Hacktivists (A) are motivated by ideology and prefer visible disruption, not quiet 14-month espionage. Organized crime (C) monetizes data quickly; this pattern indicates intelligence gathering. Unskilled attackers (D) lack the capability to develop custom malware or maintain undetected long-term access.

Ch 19 · Threat Actors

Question 2 of 20

A long-tenured IT administrator, frustrated after being passed over for promotion, begins copying proprietary source code to personal cloud storage over several weeks. Meanwhile, a junior developer accidentally emails a spreadsheet containing customer PII to the wrong recipient. Which classification correctly describes each actor?

A. Both are malicious insiders — any data loss caused by an employee is considered malicious B. The administrator is a malicious insider; the developer is a negligent insider — intent distinguishes the two categories C. The administrator is a negligent insider; the developer is a malicious insider D. Both are negligent insiders — neither intended to cause serious harm to the organization

✅ B. The critical distinction is intent. The administrator deliberately and repeatedly exfiltrates proprietary data — this is a malicious insider acting with intent to harm or benefit from the organization's assets. The developer made an error with no intent to cause harm — this is a negligent insider, also called an accidental insider. Both represent serious data loss incidents, but the risk profile, detection approach, and organizational response differ significantly. Negligent incidents are addressed through training and process controls; malicious insider incidents require investigation, legal action, and behavioral monitoring programs.

Ch 19 · Threat Actors

Question 3 of 20

During a red team engagement, analysts observe that after initial compromise the attacker uses only built-in Windows tools — PowerShell, WMI, PsExec, and certutil — to move laterally and exfiltrate data, with no custom malware deployed. What technique does this describe, and why do sophisticated attackers prefer it?

A. Shadow IT — the attacker uses unsanctioned tools that bypass corporate policy B. Living Off the Land (LOTL) — using legitimate built-in OS tools to blend in with normal activity, evading signature-based detection that looks for known malicious binaries C. A supply chain attack — the attacker compromised the Windows OS update mechanism D. A zero-day exploit — custom tools are unnecessary because a zero-day provides unrestricted access

✅ B — Living Off the Land (LOTL). LOTL attacks use the tools already present on the system — PowerShell, WMI, certutil, PsExec are all legitimate Windows administration tools. Antivirus and EDR products that rely on signature matching look for known-malicious binaries. When the attacker uses only trusted Windows components, those signatures don't trigger. The attacker's activity blends in with legitimate administrative traffic. This is why endpoint detection increasingly uses behavioral analytics rather than purely signature-based detection — to catch LOTL attacks by identifying patterns of tool use (e.g., PowerShell downloading encoded scripts to unusual locations) rather than specific file hashes.

Ch 20 · Social Engineering

Question 4 of 20

An attacker calls an employee claiming to be the CIO and says: "We have a critical board meeting in 20 minutes and I need you to process an emergency wire transfer of $180,000 right now. Legal has already approved it but they're unreachable — I need you to act immediately or we'll lose the contract." Which two social engineering psychological principles is the attacker primarily exploiting?

A. Familiarity and consensus — the attacker is using a name the employee recognizes and implying others have approved B. Authority and urgency — impersonating a senior executive (authority) combined with a time pressure that prevents verification (urgency) C. Scarcity and intimidation — claiming the opportunity will disappear and using threatening language D. Trust and reciprocity — the attacker is offering a benefit in exchange for compliance

✅ B — Authority and Urgency. Authority: the attacker impersonates the CIO — a figure with organizational power the employee is conditioned to obey. Employees are reluctant to challenge or verify requests from senior leadership. Urgency: "20 minutes" and "right now" create artificial time pressure that prevents the target from following verification procedures (calling back on a known number, checking with colleagues). The "legal has already approved it" adds a false consensus element, but authority + urgency are the primary drivers. This is a classic Business Email Compromise (BEC) / vishing pattern. The defense: establish out-of-band verification procedures for all financial transactions regardless of who requests them.

Ch 20 · Social Engineering

Question 5 of 20

A social engineering auditor tests physical security by standing outside a secure door while holding two large boxes of supplies. When an authorized employee badged in and held the door open out of politeness, the auditor walked in. What technique did the auditor use, and what defense specifically addresses it?

A. Shoulder surfing — the auditor was observing credentials; defense is privacy screens B. Dumpster diving — the auditor found access information in discarded materials; defense is document shredding C. Tailgating (piggybacking) — following an authorized person through a secure door; defense is a mantrap (airlock vestibule) and security awareness training that empowers employees to challenge unknown individuals D. Pretexting — the auditor fabricated a scenario to gain trust; defense is identity verification procedures

✅ C — Tailgating / Piggybacking. Tailgating exploits politeness and social norms — people instinctively hold doors for those carrying items or appearing to belong. The authorized employee did nothing wrong by their normal social instincts; the attack exploits those instincts. The boxes are a classic prop — they make the attacker look like a delivery person and provide a justification the target feels awkward challenging. Defenses: (1) Mantrap / airlock — requires each person to badge independently; physically prevents following. (2) Security awareness training — explicitly telling employees it is expected and required to challenge unknown individuals, even those with their hands full. The norm must be: politeness does not override access control.

Ch 20 · Social Engineering

Question 6 of 20

An attacker spends three weeks monitoring a company's email traffic after compromising a mailbox, learning the names, relationships, writing styles, and ongoing projects of key personnel. They then craft a perfectly contextual request to accounts payable, appearing to come from the CFO, redirecting vendor payments to an attacker-controlled account. What attack is this, and what makes it distinct from generic phishing?

A. Smishing — the attacker used SMS messages to reach accounts payable B. Business Email Compromise (BEC) — a targeted attack using insider knowledge of real relationships, projects, and writing styles to make fraudulent requests appear entirely legitimate; generic phishing uses mass targeting with little customization C. Whaling — the attacker targeted only C-suite executives D. Clone phishing — the attacker duplicated a previous legitimate email

✅ B — Business Email Compromise (BEC). BEC is distinguished by the attacker's investment in reconnaissance before the attack. The 3-week email monitoring period is specifically to learn enough about the organization's internal communication patterns to craft an indistinguishable message. Generic phishing sends millions of identical messages and relies on volume. BEC sends one or a few highly customized messages to specific targets whose roles make them capable of executing financial transactions. BEC is the costliest social engineering attack type — the FBI's Internet Crime Report consistently lists BEC as the highest-dollar cybercrime category, with losses exceeding $2.7 billion in a single year.

Ch 21 · Threat Vectors

Question 7 of 20

An attacker leaves several USB drives in the parking lot of a target organization. The drives contain a file named "Q3_Salary_Review.xlsx" which, when opened, executes a macro that installs a backdoor. Which threat vector is being exploited, and which human behavior does it depend on?

A. Network vector — the attacker is exploiting the organization's unencrypted Wi-Fi B. Removable media / USB drop attack — exploiting human curiosity and the instinct to plug in found items, combined with lure file names designed to trigger emotional interest (salary data) C. Supply chain vector — the attacker compromised the USB drive manufacturer D. Phishing vector — the attacker sent a link to the malicious Excel file via email

✅ B — Removable media / USB drop attack. The USB drop is a purely physical threat vector — malware delivery through a physical medium left in a public area rather than sent over a network. It exploits curiosity (what's on this?) and the lure file name "Q3_Salary_Review.xlsx" triggers additional motivation (financial interest affects everyone). Studies have shown that 45–90% of found USB drives are plugged in. The defense: disable AutoRun/AutoPlay on all endpoints; configure Group Policy to prevent unauthorized USB devices; train employees to report found drives to IT rather than plugging them in; use endpoint security that detects macro execution from removable media.

Ch 21 · Threat Vectors

Question 8 of 20

An attacker compromises a managed service provider (MSP) that administers networks for 200 small businesses. Through the MSP's remote management tools, the attacker deploys malware across all 200 client environments simultaneously. Why is an MSP an especially high-value supply chain target?

A. MSPs are high-value because they store large amounts of credit card data on behalf of clients B. MSPs typically have privileged administrative access to all of their clients' networks — compromising one MSP grants access to all its clients through trusted, already-authenticated channels C. MSPs are high-value because they develop proprietary software that many organizations use D. MSPs are only high-value targets for ransomware, not for espionage or data exfiltration

✅ B. An MSP is a force multiplier for an attacker. MSPs maintain privileged remote access (RMM tools, domain admin credentials, VPN tunnels) to all their clients simultaneously. These connections are trusted — client security controls are often configured to whitelist MSP traffic. Compromising one organization (the MSP) instantly provides authenticated, privileged access to all 200 clients with no need to phish, exploit, or authenticate into each one individually. This is the island-hopping / supply chain attack model: attack the trusted intermediary to reach all its downstream clients. This is why vendor risk management and MSP security standards are critical components of organizational security programs.

Ch 21 · Threat Vectors

Question 9 of 20

A penetration tester scans an organization's network and discovers an IP camera accessible from the internet with the login credentials admin/admin. The camera has never been configured beyond factory defaults. What threat vector does this represent, and what single action would eliminate this specific vulnerability?

A. Phishing vector — the attacker tricked the camera administrator into revealing credentials B. Default credentials — factory username/password combinations that were never changed; eliminated by changing credentials to unique, strong values during initial deployment C. Zero-day exploit — the attacker discovered an undocumented camera vulnerability D. Man-in-the-middle attack — the attacker intercepted the camera's authentication traffic

✅ B — Default credentials. Factory default credentials (admin/admin, admin/password, root/root) are published publicly for all devices. Tools like Shodan scan the internet for devices accepting known default credentials. This is one of the most preventable attack vectors — it requires no exploitation skill, just looking up the model's default password. The fix is a single configuration change: change the default credentials during initial deployment. Organizations should include "change all default credentials" as a mandatory step in every device provisioning checklist. Shodan searches reveal millions of internet-exposed devices still running factory defaults.

Ch 22 · Phishing

Question 10 of 20

A security engineer configures three email authentication records for a domain: (1) an SPF record listing authorized mail servers, (2) DKIM keys added to DNS for cryptographic signing, and (3) a DMARC policy set to "reject." How does DMARC use SPF and DKIM, and what does the "reject" policy enforce?

A. DMARC replaces SPF and DKIM — only one of the three needs to be configured B. DMARC uses SPF and DKIM as its verification inputs — if a message fails both SPF alignment and DKIM signature verification, DMARC with "reject" instructs the receiving mail server to discard the message outright rather than deliver it C. DMARC only applies to inbound email — it has no effect on emails sent from the domain to other organizations D. A "reject" DMARC policy encrypts suspicious emails and delivers them to a quarantine folder for manual review

✅ B. SPF publishes which servers may send email from the domain. DKIM cryptographically signs outbound messages so recipients can verify authenticity. DMARC is the policy layer: it tells receiving mail servers what to DO when SPF and/or DKIM fail, and it requires alignment (the From: domain must match the authenticated domain). "p=reject" is the strongest DMARC policy — receiving servers must discard non-authenticating messages claiming to be from your domain. This makes it nearly impossible to spoof your domain in email. The three work together: SPF and DKIM are the verification mechanisms; DMARC is the enforcement policy that acts on their results.

Ch 22 · Phishing

Question 11 of 20

An attacker sends a carefully crafted phishing email to the CEO of a Fortune 500 company, referencing the CEO's recent keynote speech, the company's latest acquisition deal, and the CEO's executive assistant by name, in an attempt to steal wire transfer authorization credentials. What is this attack called, and what distinguishes it from standard spear phishing?

A. Clone phishing — the attacker duplicated a legitimate email the CEO previously received B. Whaling — spear phishing specifically targeting senior executives; distinguished from standard spear phishing by the target's organizational authority to authorize large financial transactions or access highly sensitive systems C. Vishing — the attacker used voice communication to reach the CEO D. Pharming — the attacker redirected the CEO's DNS queries to a malicious site

✅ B — Whaling. All phishing that is personally targeted is spear phishing. Whaling is a specific subset of spear phishing where the target is a senior executive (C-suite: CEO, CFO, CTO, COO). The distinction matters because: (1) executives have authority to authorize transactions and access that regular employees don't, making them higher-value targets; (2) executives are often less subject to standard security procedures (they can override approval workflows); (3) the potential financial impact of a successful whaling attack is much higher. The level of personal detail in the attack (keynote reference, acquisition deal, assistant's name) confirms the attacker invested significant OSINT research — characteristic of whaling against a high-value executive target.

Ch 22 · Phishing

Question 12 of 20

Users at an organization begin reporting that when they type their bank's legitimate URL directly into their browser (not from a link), they are redirected to a convincing fake banking site that harvests their credentials. No phishing email was involved. What attack type is this, and what has likely been compromised?

A. Clone phishing — the attacker cloned the bank's website and sent a link B. Smishing — the attacker sent SMS messages with malicious links that redirect to the fake site C. Pharming — DNS has been poisoned (either the local hosts file, the organization's DNS resolver, or a DNS server upstream), redirecting the legitimate domain name to the attacker's IP address without user involvement D. Typosquatting — users are mistyping the URL and landing on a registered lookalike domain

✅ C — Pharming. The key distinguishing fact is that users typed the legitimate URL directly — no phishing link was involved. Despite entering the correct address, they land on a malicious site. This is only possible if the DNS resolution process has been corrupted: the domain name resolves to the wrong IP address. Attack vectors: (1) poisoned local hosts file (malware modified C:\Windows\System32\drivers\etc\hosts), (2) DNS cache poisoning of the organization's recursive resolver, or (3) compromise of the DNS server itself. Pharming is more dangerous than phishing because even security-aware users who never click links are vulnerable — their correct behavior (typing URLs manually) does not protect them.

Ch 23 · Impersonation

Question 13 of 20

An attacker on the same network as a target injects forged ARP responses, associating their own MAC address with the IP address of the default gateway. All traffic from the target machine destined for the internet now flows through the attacker's machine first. What attack is this, and what network-level control prevents it?

A. DNS spoofing — the attacker poisoned the target's DNS cache; prevented by DNSSEC B. IP spoofing — the attacker forged source IP addresses; prevented by ingress filtering C. ARP spoofing — the attacker poisoned the target's ARP cache by claiming ownership of the gateway's IP; prevented by Dynamic ARP Inspection (DAI) on the network switch D. SIM swapping — the attacker redirected the target's cellular data traffic

✅ C — ARP Spoofing, prevented by Dynamic ARP Inspection (DAI). ARP (Address Resolution Protocol) maps IP addresses to MAC addresses on a local network. It has no authentication — any machine can claim any IP. An attacker who broadcasts "I am 192.168.1.1 (the gateway), my MAC is AA:BB:CC:DD:EE:FF" poisons the ARP caches of all hosts on the segment. All their traffic is then forwarded to the attacker (man-in-the-middle). Dynamic ARP Inspection (DAI) is a switch-level control that validates ARP responses against a trusted DHCP snooping binding table — if an ARP response claims a MAC/IP binding not in the table, DAI drops it. This prevents ARP poisoning at the network infrastructure level.

Ch 23 · Impersonation

Question 14 of 20

An attacker calls a mobile carrier's customer support, impersonates a victim using OSINT-gathered personal information (name, address, last 4 of SSN found in data breaches), and convinces the representative to transfer the victim's phone number to a SIM card the attacker controls. What attack is this, and which authentication method does it compromise?

A. Caller ID spoofing — the attacker faked their phone number to reach customer support B. SIM swapping — a social engineering attack against the mobile carrier that transfers the victim's phone number to the attacker; this compromises SMS-based MFA because the attacker now receives all SMS codes sent to that number C. Credential stuffing — the attacker used breached credentials to access the carrier account directly online D. Vishing — the attacker impersonated the carrier, not the victim

✅ B — SIM Swapping. SIM swapping is a social engineering attack against the mobile carrier, not the victim directly. Once successful, the attacker receives all calls and SMS messages to the victim's number — including SMS-based two-factor authentication codes. This is why SMS MFA is considered the weakest form of MFA and why phishing-resistant MFA (hardware tokens, FIDO2 passkeys) is recommended for high-value accounts. High-profile SIM swap victims have included Twitter CEO Jack Dorsey and numerous cryptocurrency holders who lost funds when attackers swapped their SIM to intercept 2FA codes and take over exchange accounts.

Ch 23 · Impersonation

Question 15 of 20

A finance employee receives a video call from what appears to be their company's CFO and three other executives, all of whom instruct her to transfer $25 million to a new vendor account. The call is convincing — she recognizes the faces and voices. She makes the transfer. Later, she learns the CFO and executives were all AI-generated deepfakes in real time. What is the primary defense an organization should implement to prevent this attack?

A. Deploy facial recognition software to detect AI-generated faces on video calls B. Implement out-of-band verification: establish a policy that all wire transfers above a threshold require a callback to the requesting executive on a known, pre-registered phone number, independent of the channel used to make the request C. Require all video meetings to use end-to-end encryption D. Ban video calls for financial authorization requests and require all requests to come via email

✅ B — Out-of-band verification. The employee verified identity using the same channel as the request (the video call itself). A deepfake can perfectly spoof that channel. Out-of-band verification uses a completely separate, pre-established channel to confirm the request — calling the CFO's known mobile number, or using a pre-shared code word. This attack cannot be defeated by technology alone (deepfake detection improves but so do deepfakes), and email (D) is also spoofable. The defense is procedural: no financial transaction above a defined threshold is executed based solely on any single communication channel, regardless of how convincing the identity appears. This is the same principle as dual authorization for large transactions.

Ch 24 · Watering Hole

Question 16 of 20

A threat actor targeting aerospace companies compromises an industry-specific job board and conference website frequently visited by aerospace engineers. They inject a browser exploit into the site. When engineers visit the legitimate site during their normal workflow, the exploit silently installs a backdoor. No phishing email was sent. What attack type is this, and why is it effective against security-aware targets?

A. Spear phishing — the attacker customized attack emails for aerospace engineers B. Watering hole attack — the attacker compromised a trusted site the target group naturally visits, exploiting their trust in a legitimate resource they use in their normal professional workflow C. Malvertising — the attacker placed malicious ads on the job board D. DNS spoofing — the attacker redirected the job board domain to their malicious server

✅ B — Watering Hole Attack. Named after the predator tactic of waiting at a watering hole for prey to come to you rather than hunting them. The attacker doesn't send anything to the targets — the targets come to the compromised site themselves, as part of normal behavior they trust and repeat. This is what makes it effective against security-aware users: they didn't click a suspicious link, didn't receive a phishing email, didn't do anything wrong by their training. They visited a legitimate site. The attack exploits trust in familiar, professional resources rather than exploiting gullibility. Defense: browser isolation / Remote Browser Isolation (RBI), keep browsers and plugins updated to eliminate the exploitable vulnerabilities, DNS filtering to block known compromised sites.

Ch 24 · Watering Hole

Question 17 of 20

In the SolarWinds SUNBURST attack, a nation-state threat actor inserted malicious code into the build process of the SolarWinds Orion software update. The malicious update was cryptographically signed by SolarWinds and delivered to approximately 18,000 organizations through the normal software update mechanism. What makes this attack particularly difficult to detect and prevent using standard security controls?

A. The attack exploited a zero-day vulnerability in Windows Defender that blocked all antivirus detection B. The malicious update arrived through the legitimate, trusted software update channel, bearing a valid cryptographic signature from SolarWinds — the exact channel and verification mechanism organizations rely on to confirm trustworthiness C. The attack succeeded because SolarWinds Orion was unpatched software that had known public CVEs D. The attackers used a watering hole to compromise each victim's browser before installing SUNBURST

✅ B. The SUNBURST attack targeted the build pipeline — the process that compiles and packages software before distribution. By the time victims received the update, it was indistinguishable from a legitimate SolarWinds update: it came from SolarWinds' own distribution servers, and the code signing certificate was SolarWinds' actual certificate. Standard defenses that organizations rely on — "only install signed updates from trusted vendors" — provided no protection because the trust chain itself was compromised. The code signing certificate was genuine. This attack demonstrates the limits of code signing as a security control: it verifies the code came from the signer, but if the signer's build process is compromised, signing still occurs on malicious code. SBOM and reproducible builds are proposed mitigations.

Ch 24 · Watering Hole

Question 18 of 20

An attacker purchases advertising space through a legitimate ad network and embeds a browser exploit in the ad creative. The exploit executes when a user's browser renders the ad — even on reputable, high-traffic websites. No user interaction beyond page load is required. What is this attack called, and which defense specifically addresses it?

A. Watering hole — the attacker compromised the websites directly B. Spear phishing — the attacker targeted specific users who visit those websites C. Malvertising — malicious code delivered through legitimate ad networks; defended by ad blockers, browser patching to eliminate exploitable vulnerabilities, and content security policies that restrict what third-party scripts can execute D. Drive-by download initiated from a phishing email link

✅ C — Malvertising. Malvertising uses legitimate ad infrastructure as the delivery mechanism. The website operator may be entirely unaware — they contracted with a legitimate ad network that was itself compromised or tricked. Even major, trusted websites (news sites, tech sites) have served malvertising. The attack doesn't require the user to click anything — the exploit executes when the browser parses and renders the malicious ad content. This is a drive-by download enabled through advertising. Defense: ad blockers prevent the malicious ad code from loading; browser updates patch the vulnerabilities the exploit targets; Content Security Policies (CSP) can restrict which domains may deliver executable content to a site.

Ch 25 · Other Social Attacks

Question 19 of 20

At a security conference, a researcher demonstrates a technique where she approaches a network engineer at a social event, mentions she works for a competing firm, and through what appears to be casual professional conversation — asking about interesting technical challenges, new technologies they're evaluating, and "war stories" about outages — gathers detailed information about the target company's network architecture, upcoming system changes, and a critical vulnerability that has not yet been patched. No deception was used; the engineer volunteered all information willingly. What technique is this?

A. Pretexting — the researcher fabricated a false identity to gain information B. Vishing — the researcher used voice communication to extract information C. Elicitation — gathering sensitive information through seemingly normal conversation without direct questioning, exploiting the human tendency to share professionally and appear knowledgeable among peers D. OSINT — the researcher gathered publicly available information about the company

✅ C — Elicitation. Elicitation is the art of extracting information through natural conversation rather than direct questioning. The target doesn't realize they're being exploited — they believe they're having a peer-to-peer professional discussion. The researcher uses conversation techniques: flattery ("that sounds like a really complex challenge"), deliberate false statements the target feels compelled to correct, or open-ended questions about "war stories." The engineer volunteered sensitive internal information (unpatched vulnerabilities, architecture details) that would never have been approved for disclosure, simply because the conversation felt normal and collegial. Defense: security awareness training must specifically cover information handling at conferences and social events — the risk of oversharing in informal settings is consistently underestimated.

Ch 25 · Other Social Attacks

Question 20 of 20

A security analyst investigating a disinformation campaign finds a network of 3,000 social media accounts that amplify fabricated news stories about a publicly traded company, causing stock price manipulation. Some stories contain a kernel of factual information mixed with false claims designed to damage the company's reputation. What term describes information that is intentionally false and harmful, and how does it differ from misinformation?

A. Misinformation — false information spread regardless of intent; disinformation is false information spread with deliberate intent to harm or deceive B. The fabricated stories are disinformation — intentionally false content designed to deceive; this differs from misinformation, which is false information spread without harmful intent (often by people who believe it is true) C. Malinformation — accurate information used out of context to cause harm D. Hoax — a single false claim circulated for entertainment or notoriety rather than deliberate harm

✅ B — Disinformation. Three categories: Misinformation = false information spread without intent to deceive (the sharer believes it's true). Disinformation = false information spread with deliberate intent to deceive, manipulate, or harm. Malinformation = accurate or real information used out of context or with harmful framing to damage someone (e.g., publishing private communications to embarrass a public figure). The stock manipulation campaign described here is disinformation — deliberately fabricated content deployed through a coordinated account network with the specific intent to manipulate markets. The 3,000-account network is an "influence operation" — a coordinated, inauthentic campaign to amplify false narratives at scale.

Part B — Scenario Analysis (Unscored — for practice)

Ch 19–22 · Scenario

Scenario A — Multi-Vector Attack Campaign

A financial services firm is targeted in a sophisticated multi-week campaign. Week 1: Employees receive highly personalized phishing emails referencing their specific client accounts — indicating the attacker has internal knowledge. Week 2: Three executives receive deepfake video calls requesting urgent wire authorizations. Week 3: A security researcher reports that the firm's external financial reporting portal has been seeded with a browser exploit targeting visitors. Analyze the likely threat actor profile, identify which attack types are being used, and design a unified defensive response that addresses all three attack vectors simultaneously.

Threat Actor Profile:
The sophistication level, multi-week planning, use of deepfake technology, and apparent access to internal client account data suggests an organized, well-resourced threat actor — likely organized crime with financial motivation (wire fraud / BEC) or a nation-state conducting financial espionage. The internal knowledge in Week 1 emails indicates either: (a) a prior compromise providing internal data, (b) a malicious or negligent insider leak, or (c) extensive OSINT from prior data breaches. The watering hole targeting the financial reporting portal suggests prior reconnaissance to identify which sites the firm's clients and partners visit.

Attack Type Identification:
Week 1 — Spear phishing / BEC: Highly personalized emails referencing internal account data. The personalization level suggests the attacker has already accessed some internal data. This is spear phishing at minimum; if targeting executives for financial fraud it escalates to BEC/whaling.
Week 2 — Deepfake-assisted vishing / impersonation: Real-time deepfake video used to impersonate executives to authorize wire transfers. This is voice/video impersonation combined with BEC financial fraud tactics.
Week 3 — Watering hole attack: The financial reporting portal is a site clients and partners routinely visit. Seeding it with an exploit targets the firm's network of counterparties, not just internal employees.

Unified Defensive Response:
Immediate containment: (1) Identify and quarantine the browser exploit on the financial reporting portal immediately — take it offline if necessary, notify all users who accessed it in the past 30 days. (2) Issue an internal alert to all employees about the active campaign; suspend processing of all wire transfer requests received in the past week pending re-verification. (3) Reset credentials for any accounts that interacted with the phishing emails.

Email defenses (Week 1): Enforce DMARC p=reject to prevent domain spoofing. Deploy email security scanning with attachment/link sandboxing. Implement security awareness training specific to BEC — especially for finance and accounts payable staff. Establish out-of-band callback procedures for ANY payment request modification regardless of source.

Deepfake / impersonation defenses (Week 2): Implement a firm-wide policy: no financial authorization based solely on a video or phone call. All wire transfers above a threshold require callback to pre-registered numbers AND dual approval from a second authorized officer. Establish pre-shared code words for executive authentication in sensitive transactions. Train executives and finance staff specifically on deepfake capabilities.

Watering hole defenses (Week 3): Deploy Remote Browser Isolation (RBI) for employees accessing external financial portals. Ensure all endpoint browsers are fully patched. Use DNS filtering to block newly flagged malicious domains. Notify all clients and partners who use the portal about the compromise.

Investigation: Engage incident response to determine how the attacker obtained internal client account data. Audit access logs for the CRM and account management systems. Look for signs of prior compromise, insider activity, or credential theft that gave the attacker the internal knowledge used in Week 1.

Ch 23–25 · Scenario

Scenario B — Supply Chain & Insider Threat Response

A healthcare organization's IT security team detects unusual outbound data transfers from a server managed by an external IT vendor with privileged admin access. Investigation reveals the vendor's management platform was compromised six weeks ago; the attacker used the vendor's credentials to access patient records and HR data. Concurrently, a departing senior network engineer was found to have copied network topology diagrams and firewall rule documentation to personal cloud storage in her final week of employment. Design the immediate incident response, the vendor risk remediation, and the insider threat controls to prevent recurrence of both situations.

Immediate Incident Response (Supply Chain / Vendor Compromise):
(1) Immediately revoke all credentials and access for the compromised vendor. Terminate all active sessions from vendor IP ranges. Disable all API keys and service accounts associated with the vendor. (2) Isolate the affected server from the network to prevent further data exfiltration. Preserve all logs and volatile memory for forensic analysis. (3) Identify the full scope of access: what data was accessed, for how long, and what was exfiltrated. Pull six weeks of access logs for all systems the vendor had privileges on. (4) Notify affected patients per HIPAA Breach Notification Rule (within 60 days of discovery; within 60 days requires HHS notification if >500 records). Document the timeline for regulatory reporting. (5) Engage external incident response to conduct forensics independently of the vendor.

Vendor Risk Remediation:
Short term: Before reinstating any vendor access, require the vendor to demonstrate remediation of the compromise — new credentials, MFA enforcement, endpoint security on the management platform. Implement just-in-time (JIT) access: vendor credentials are issued on-demand for specific maintenance windows rather than persistent standing access. Restrict vendor network access to only the specific systems they manage — no lateral movement capability.
Long term: Implement a vendor risk management program. Require annual security assessments of all vendors with privileged access. Include contractual requirements for breach notification within 24–72 hours. Evaluate whether this vendor's access model can be redesigned to eliminate persistent privileged credentials. Monitor all vendor activity via a PAM (Privileged Access Management) solution that records sessions and alerts on anomalous activity.

Insider Threat Response (Departing Engineer):
Immediate: Preserve evidence — logs of cloud storage upload activity, timestamps, file names, and destination account. Engage legal counsel before interviewing the employee; document the chain of custody. Assess the data stolen: network topology and firewall rules are sensitive — an attacker with this information has a map of the organization's defenses. Evaluate whether firewall rules need to be changed and whether network re-architecture is required.

Insider Threat Prevention Controls:
(1) Offboarding procedure: all access (including cloud accounts, VPN, remote tools) should be revoked on the last day of employment before the employee's final departure. DLP (Data Loss Prevention) monitoring should be triggered at notification of resignation to flag unusual data access or uploads. (2) DLP policy: classify sensitive documents (network diagrams, firewall configs, security architecture) and configure DLP to alert on upload to personal cloud storage or email to personal addresses. (3) Least privilege: network documentation should not be universally accessible — restrict access to those with current operational need. (4) Separation of duties: network diagrams and security documentation should require approval to access, creating an audit trail. (5) Exit procedures: structured exit interview with security team; physical media check of workstation before return.

← Exam: Ch 16–18 All Chapters

—

Pass threshold: 80% (16 / 20 correct)

← Ch 16–18 Exam All Chapters

Exam: Threats & Social Engineering