Exam: Chapters 36–39 · Security+ SY0-701

Chapters 36–39 Practice Exam

📝 20 scored questions ⏱️ 25-minute target 🎯 Pass threshold: 80% (16/20)

Time remaining

25:00

Part A — Multiple Choice (Questions 1–20)

Ch 36 · Supply Chain

Question 1 of 20

In the November 2013 Target Corporation breach, 40 million payment card numbers were stolen from 1,800 stores. Attackers did not initially compromise Target's systems directly. Who was the actual initial target, and why?

A. A major software vendor that supplied Target's POS system, because its code contained a zero-day vulnerability B. Fazio Mechanical Services, an HVAC contractor with VPN credentials for remote refrigeration monitoring of Target stores — a smaller, less-secured vendor whose access became the path into Target's network C. Target's managed service provider for IT helpdesk operations, which had administrator credentials to Target's Active Directory D. A bank that processed Target's credit card transactions and shared a network integration with Target's POS infrastructure

✅ B. Fazio Mechanical Services was the initial target. The HVAC contractor had VPN credentials to access Target's network for remote refrigeration monitoring — a legitimate business relationship. Attackers phished Fazio employees, stole the VPN credentials, and used them to log into Target's internal network. Because Target's network was not properly segmented, that vendor access path reached POS management infrastructure across 1,800 stores. The attack illustrates island hopping: compromise the weaker partner (HVAC contractor) to reach the stronger target (major retailer). The HVAC company was not the prize — it was the path.

Ch 36 · Supply Chain

Question 2 of 20

Which of the following BEST defines island hopping as a supply chain attack technique?

A. An attacker repeatedly attempts the same exploit against multiple IP addresses in a target's network range until one succeeds B. An attacker first compromises a third-party vendor or partner with weaker security, then uses that trusted relationship and access to reach the intended high-value target that would otherwise be harder to attack directly C. An attacker hops between multiple cloud regions to obscure the origin of an attack from forensic investigators D. An attacker compromises multiple organizations sequentially and uses data from each breach to facilitate the next

✅ B. Island hopping uses a less-defended supplier or partner as a stepping stone to reach a hardened target. The name comes from WWII island-hopping campaigns that used smaller bases as staging points to reach larger objectives. From a security standpoint: the attacker's goal from the start is the final target; the supplier is only valued for its trusted access to that target. The weaker security posture of a small vendor (like an HVAC contractor) makes it a much easier entry point than attacking a major retailer's hardened perimeter directly.

Ch 36 · Supply Chain

Question 3 of 20

In the SolarWinds SUNBURST attack, the malicious Orion update was code-signed with SolarWinds' legitimate certificate and every signature verification check passed. Approximately 18,000 customers installed the signed update, and the backdoor was not detected for nine months. Why did code signing fail to protect customers?

A. The SolarWinds certificate had expired, so signature verification checks were ignored by customer systems B. Attackers compromised SolarWinds' build pipeline before the signing step — the malicious code was inserted into the update before it was compiled and signed; the signature was completely genuine, but it only proved the package came from SolarWinds, not that the code inside was safe C. Customers had disabled code signing verification to allow faster update deployment in their environments D. Code signing cannot verify updates distributed through vendor-controlled update servers, only third-party downloads

✅ B. Code signing proves provenance — who signed the package — not safety. The SUNBURST attackers compromised SolarWinds' build pipeline before the signing step, so the malicious code was compiled into the update and then signed with SolarWinds' own legitimate certificate. "Signed by SolarWinds" was entirely true. What the signature could not say was that SolarWinds' build server had been compromised and that the code being signed was not the code SolarWinds intended to ship. This is the central lesson: code signing protects against tampering after signing, but is powerless against compromise that occurs before or during the build process.

Ch 36 · Supply Chain

Question 4 of 20

A critical vulnerability is disclosed in a widely-used open-source logging library. An organization with a Software Bill of Materials (SBOM) for all its applications takes 20 minutes to identify every affected application. A similar organization without SBOMs requires three weeks of manual investigation to reach the same answer. What does this scenario demonstrate about the primary security value of an SBOM?

A. SBOMs prevent vulnerabilities from being introduced into third-party libraries B. SBOMs are only valuable for open-source software; commercial software vulnerabilities do not require SBOM tracking C. An SBOM provides a machine-readable inventory of all software components and dependencies, enabling rapid identification of which applications are affected by a newly disclosed vulnerability — compressing response time from weeks to minutes and allowing prioritized patching before attackers can exploit the window D. SBOMs automatically patch vulnerable dependencies when new CVEs are published

✅ C. An SBOM is essentially a machine-readable ingredient list for software — it records every library, component, and dependency that an application uses. When a vulnerability like Log4Shell is disclosed, an organization with SBOMs can query: "which of our applications include this library at this version?" in seconds. Without SBOMs, answering the same question requires manually examining every application's code, build files, and dependency trees. The three-week vs. twenty-minute gap in this scenario represents real-world attacker dwell time — organizations that cannot quickly identify affected systems cannot quickly prioritize and patch them.

Ch 36 · Supply Chain

Question 5 of 20

A CISO argues that small vendors — cleaning services, office supply companies, building maintenance contractors — do not represent meaningful supply chain security risks because they have no IT security function and do not handle sensitive data. Which of the following BEST challenges this reasoning?

A. Small vendors are actually more secure than large vendors because they have fewer systems for attackers to compromise B. Supply chain risk is determined by access, not by business function — a cleaning company with after-hours physical access to unattended workstations, or an HVAC contractor with VPN credentials, represents a risk determined by that access regardless of their IT security maturity; weaker security + meaningful access = high effective risk C. The CISO is correct — supply chain risk assessments should focus exclusively on software and IT service vendors D. Small vendors are covered under the organization's own cyber insurance policy, shifting the risk responsibility

✅ B. The risk equation for supply chain attacks is: (vendor access) × (vendor security weakness). A highly capable IT vendor with strong security may represent lower effective risk than a small contractor with weak security but meaningful network or physical access. The Target breach demonstrated this precisely — the HVAC contractor had no IT security team, but they had VPN credentials. That access, combined with weak security, produced the largest retail data breach of its era. Supply chain risk assessment must account for every vendor's access, not just vendors whose primary function is IT-related.

Ch 37 · Misconfiguration

Question 6 of 20

In June 2017, a security researcher discovered that approximately 14 million Verizon customer records were accessible on the public internet without any authentication. No credentials were stolen, no application vulnerability was exploited, and no malware was involved. A third-party contractor had configured an Amazon S3 bucket with public read access. What misconfiguration category does this represent?

A. Insecure protocol — the contractor used HTTP instead of HTTPS for the bucket connection B. Open permissions — the access control was set to allow public access, meaning anyone with the URL could read the data without authentication; no exploit was needed because the permission itself granted access C. Default settings — the contractor used AWS's default bucket configuration which is public by default D. Open ports — AWS exposed the bucket on an unfiltered port that bypassed Verizon's perimeter firewall

✅ B. Open permissions is the defining characteristic of this incident. The S3 bucket's access control policy was configured to allow public read, meaning the permission itself granted anyone access — no exploitation, no credential theft, no technical attack required. AWS S3 buckets are private by default; the misconfiguration was the deliberate act of setting the bucket to public. This also illustrates third-party risk: Verizon's data was exposed by a contractor's configuration decision on Verizon's (contracted) infrastructure. The "attack" was simply navigating to the bucket URL in a browser.

Ch 37 · Misconfiguration

Question 7 of 20

A network analyst runs a packet capture on an internal management network and observes that all network device management sessions — including login credentials and commands — are transmitted in plaintext and fully readable in the capture. Which protocol is MOST likely responsible, and what is its secure replacement?

A. FTP on port 21 — replace with HTTPS B. IMAP on port 143 — replace with IMAPS on port 993 C. Telnet on port 23 — replace with SSH on port 22 D. HTTP on port 80 — replace with SFTP on port 22

✅ C. Telnet (port 23) is the legacy remote terminal protocol that transmits all session data — including login credentials and every command typed — in plaintext. It is the standard protocol for managing older network devices (switches, routers) that have not been updated to support SSH. Any network observer with packet capture access can read every character in a Telnet session. SSH (port 22) encrypts the entire session. Replacing Telnet with SSH is a fundamental network device hardening step. The DEFCON "wall of sheep" demonstration shows that cleartext protocols like Telnet expose credentials to any observer on the same network segment.

Ch 37 · Misconfiguration

Question 8 of 20

The 2016 Mirai botnet compromised hundreds of thousands of IoT devices and used them to launch record-breaking DDoS attacks. Mirai's infection mechanism used a hardcoded list of approximately 60 credential combinations. Which misconfiguration category did Mirai exploit, and why was this technique so effective at scale?

A. Open permissions — Mirai exploited publicly accessible device management APIs with no access control B. Insecure protocols — Mirai captured credentials from cleartext Telnet sessions and used them to log in C. Default settings — IoT devices (cameras, routers, doorbells, DVRs) were deployed with unchanged factory-default credentials that are publicly documented in vendor manuals; Mirai needed no brute force — the first or second credential from its list succeeded on any device with unchanged defaults D. Open ports — Mirai exploited open management ports with buffer overflow vulnerabilities in vendor firmware

✅ C. Mirai exploited default credentials — the misconfiguration of deploying devices without changing factory-set usernames and passwords. The 60 credential combinations in Mirai's list came from manufacturer documentation for dozens of device types. Devices with unchanged defaults logged in immediately without any brute-forcing. The technique's effectiveness at scale came from the sheer number of IoT devices deployed with defaults unchanged: cameras, routers, doorbells, and DVRs by the tens of millions. Mirai then published its source code, making the technique available to any attacker. The lesson: change all credentials before deployment — never connect a device to a network with factory defaults intact.

Ch 37 · Misconfiguration

Question 9 of 20

A security audit finds that direct SSH login is enabled for the root account on all Linux servers with a password of "Admin2023!" and that 28 of 35 IT staff members have full administrator rights in Active Directory. Which misconfiguration category do these findings represent, and what is the correct remediation for the SSH root login finding specifically?

A. Default settings — "Admin2023!" is a factory-default password that was never changed after server deployment B. Open ports — SSH port 22 is open and should be closed to prevent root login attempts C. Unsecured admin accounts — the root account's universally known username makes it a brute-force target regardless of password strength; correct remediation: set PermitRootLogin to "no" in sshd_config, disable direct root SSH access, and require administrators to log in with named accounts and use sudo for elevated commands D. Firewall rule creep — too many firewall rules permit access to the root account from unauthorized IP ranges

✅ C. Unsecured admin accounts covers both findings: direct root login with a guessable password, and excessive privilege proliferation (28 of 35 IT staff with full AD admin). The root account's username is universally known — attackers always try it — making it inherently higher-risk than a named account, regardless of password complexity. The correct fix for SSH root login is not just a stronger password but disabling the capability entirely: set PermitRootLogin no in /etc/ssh/sshd_config. Administrators must then log in with individual named accounts (creating audit trails) and use sudo to elevate only when needed. This also limits the blast radius — a compromised sudo user has less persistent access than a session logged in as root.

Ch 37 · Misconfiguration

Question 10 of 20

A security audit of a firewall reveals 412 rules, of which 140 were created for a system migration project completed four years ago, 60 are marked "temporary — review in 6 months" but are 2–3 years old, and 45 have no listed business owner. Which misconfiguration category and response BEST addresses this situation?

A. Insecure protocols — the old rules may be permitting cleartext protocol traffic that should be blocked; update each rule to require encrypted protocols B. Open ports and services / firewall rule creep — rules accumulate without cleanup, leaving open access paths with no current business justification; remediation requires a formal audit to identify rules that are stale, undocumented, or no longer necessary, and remove them after verifying no active business requirement exists C. The firewall configuration is compliant because all rules were originally created for legitimate business purposes and have not been actively abused D. Open permissions — the firewall's management console is accessible without authentication, allowing rule creation without authorization

✅ B. Firewall rule creep is the accumulation of access rules without corresponding cleanup. The 140 migration rules from a completed project, the 60 "temporary" rules that have been live for years, and the 45 ownerless rules are all examples of open access paths whose original justification no longer exists. A rule that no longer has a business owner or purpose still permits the traffic it was written for — potentially including traffic to systems that now serve different functions or belong to different IP owners. Remediation: assign a business owner to every rule, remove or expire rules for completed projects, and implement a policy requiring all rules to have expiration review dates. Default-deny is the correct baseline; every permitted path must be justified.

Ch 38 · Mobile Devices

Question 11 of 20

An IT administrator is reviewing a mobile device security policy and needs to explicitly address both major mobile platforms. Which statement CORRECTLY pairs each mobile platform with the term for installing custom firmware to gain root-level OS access?

A. Android = jailbreaking; Apple iOS = rooting B. Android = rooting; Apple iOS = jailbreaking C. Both platforms use the term jailbreaking; "rooting" refers to gaining administrator access on Windows servers D. Both platforms use the term rooting; the distinction between iOS and Android is only in the tools used, not the terminology

✅ B. Android uses "rooting"; Apple iOS uses "jailbreaking." The terminology is platform-specific and is explicitly tested on Security+. Both processes achieve the same result — installing custom firmware or modifying the OS to gain root-level administrative access that the manufacturer restricts by design — but the terms are not interchangeable. The security consequences are identical regardless of platform: sandboxing is compromised, secure boot is bypassed, MDM enforcement becomes unreliable, and sideloading becomes unrestricted. "Rooting" refers to gaining root (superuser) access on Android; "jailbreaking" refers to breaking out of iOS's software restrictions.

Ch 38 · Mobile Devices

Question 12 of 20

A mobile device enrolled in an MDM is jailbroken. The MDM agent continues to run and reports the device as online. An administrator attempts to verify that encryption is enabled and push a configuration profile update. Both operations return success codes in the MDM console. Why should the administrator NOT trust these success indicators?

A. The MDM console has a known bug where it reports success for operations targeting jailbroken devices regardless of actual result B. Jailbreaking physically damages the device's hardware encryption chip, making encryption verification always return false positives C. The MDM enforces policies by calling operating system APIs; on a jailbroken device, the custom firmware that replaced the original OS controls those APIs and can return any response it chooses — "success" means the API call completed, not that the OS actually enforced the policy D. The MDM's SSL certificate has been invalidated by the jailbreak, causing it to accept spoofed responses from the device

✅ C. MDM policy enforcement works through OS APIs. "Verify encryption is enabled" means calling the OS encryption status API and reading the response. "Push configuration profile" means calling the OS API that applies configuration settings. On a jailbroken device, those APIs sit inside modified firmware that the attacker controls. That firmware can respond "encryption: enabled" and "profile applied: success" while doing nothing that was requested. The MDM agent is still running and communicating — but the OS layer it depends on for enforcement has been replaced with untrusted firmware. This is why jailbroken devices cannot be treated as MDM-managed: you cannot verify the OS is actually honoring any policy call.

Ch 38 · Mobile Devices

Question 13 of 20

An employee enables "Install Unknown Apps" in Android settings and installs a productivity app downloaded from a developer's website because it is not available in the Google Play Store. A month later, the security team identifies that this app has been exfiltrating corporate email credentials to an external server since installation. What security risk category does this represent, and what was the critical security failure?

A. Jailbreaking — enabling "Install Unknown Apps" is equivalent to rooting the Android device B. Sideloading — installing apps from outside the official Play Store bypasses Google's vetting process; the app was a Trojan horse whose code was never reviewed for malicious functionality; the credential-stealing behavior was present from installation but invisible because the app appeared legitimate C. Open permissions — the app was granted excessive Android permissions by the MDM administrator rather than by the user D. Default settings — the app used default Android credential storage, which is not encrypted and accessible to any installed app

✅ B. Sideloading — installing apps outside the official store — bypasses the entire vetting process. Google Play requires developer account verification, automated malware scanning, and policy review. A sideloaded app skips all of these. The developer's website provides no independent security assurance. The app was a Trojan horse: presented as a legitimate productivity tool while secretly harvesting credentials. "Install Unknown Apps" does not root the device (rooting requires deeper OS modification), but it does remove the Play Store gatekeeping requirement. This is why organizational MDM policies prohibit enabling unknown source installation — and why the "unknown sources" setting can be blocked via MDM on managed Android devices.

Ch 38 · Mobile Devices

Question 14 of 20

An organization's MDM is technically capable of detecting jailbroken devices and blocking their access to corporate resources. An employee argues that the Acceptable Use Policy (AUP) prohibition on jailbreaking is therefore redundant — "the technology handles it, the policy is just paperwork." What is wrong with this reasoning?

A. The employee is correct — effective technical controls eliminate the need for corresponding policy controls B. AUP and MDM controls are complementary, not redundant — the MDM is the technical control; the AUP provides the organizational standing to take disciplinary action when violations occur, establishes clear expectations, and addresses jailbreak methods that may evade MDM detection; sophisticated jailbreaks can hide from MDM integrity checks, making policy the backstop when technology fails C. AUP is only needed for BYOD devices; company-issued devices are covered entirely by MDM enforcement D. The MDM cannot detect jailbreaks on iOS devices; AUP is required because iOS detection is technically impossible

✅ B. Technical and administrative controls are complementary layers, not substitutes. The MDM is the technical control: it detects and blocks access. The AUP is the administrative control: it establishes what is permitted, creates individual accountability, defines consequences, and provides the standing to take disciplinary or legal action when violations occur. Additionally, sophisticated jailbreaks are specifically designed to evade MDM integrity detection — if a device passes MDM checks despite being jailbroken, the AUP violation still occurred and provides the basis for action when discovered through other means. Technical controls can fail; policy is the backstop.

Ch 38 · Mobile Devices

Question 15 of 20

An organization implements a BYOD (Bring Your Own Device) program requiring employees to enroll personal smartphones in the MDM to access corporate email. An employee who jailbroke their personal iPhone for personal customization reasons two years ago enrolls the device. The MDM's jailbreak detection does not flag the device. What risk has been created?

A. No additional risk — if the MDM's jailbreak detection did not flag the device, the device is compliant and poses no greater risk than a non-jailbroken device B. A pre-compromised device with an untrustworthy OS has been brought inside the corporate perimeter — MDM policies are enforced against firmware that cannot be trusted, sideloaded apps may already be present, and corporate email data is now on a device whose security state the organization cannot verify; the fact that jailbreak detection did not flag it does not mean the device is secure C. The risk is limited to the employee's personal data — BYOD programs have containerization that isolates corporate email from the jailbroken OS D. The risk is only present if the employee actively sideloads additional apps after enrollment; the pre-existing jailbreak without new apps is harmless

✅ B. Jailbreak detection evasion does not equal device security. Sophisticated jailbreak tools are specifically designed to hide their presence from integrity checks — if an MDM's detection is fooled, the jailbreak still exists and the OS is still modified. Corporate email data is now on a device running untrusted firmware where MDM policies cannot be verified, and where any sideloaded app that may have been installed two years ago (or installed by the jailbreak process itself as a companion app) may have pre-existing access to everything on the device. This is a core BYOD risk: the organization has less control over device history and configuration than with corporate-issued hardware.

Ch 39 · Zero-Day

Question 16 of 20

Which of the following MOST accurately defines a zero-day vulnerability?

A. A vulnerability that was introduced into software zero days ago — present only in code released today B. A vulnerability that is unknown to the software vendor, meaning they have had zero days to develop a patch or prepare a mitigation — it may have existed in the code for years C. A vulnerability that requires zero technical skill to exploit because no authentication barrier exists D. A vulnerability for which a CVE entry has been published but for which zero patches are available within the current patch cycle

✅ B. "Zero-day" refers to the vendor's preparation time: zero days. Because the vendor does not know the vulnerability exists, they have had zero days to research it, zero days to develop a fix, and zero days to prepare mitigation guidance. The "zero" does not describe the vulnerability's age — it may have existed in the code for years, decades, or since the first line of the program was written. The defining characteristic is vendor ignorance, not recency. A zero-day can remain a zero-day for months or years if the flaw goes undiscovered by anyone except the attacker exploiting it.

Ch 39 · Zero-Day

Question 17 of 20

A security analyst is investigating a fully patched endpoint whose antivirus shows a clean bill of health. The analyst observes a browser process spawning unexpected child processes and making outbound connections to unknown IP addresses. Why does a clean antivirus result NOT rule out an active compromise in this scenario?

A. The antivirus engine needs to be restarted — it only detects new threats after a daily restart cycle B. Antivirus definitions were not downloaded in the last 24 hours, so the latest signatures are not yet present C. Antivirus relies on signature-based detection — matching observed activity against a database of known attack patterns; a zero-day exploit has never been seen before and has no signature, so antivirus has no pattern to match and reports clean even on an actively compromised system D. The browser's sandbox is preventing the antivirus from scanning inside the browser process space

✅ C. Signature-based detection is fundamentally ineffective against zero-day attacks. An antivirus signature is created by analyzing a known piece of malware or exploit code and extracting a unique identifying pattern. For a zero-day exploit — one that has never been captured, analyzed, or documented — no signature exists, regardless of how current the antivirus definitions are. The antivirus will report "clean" because there is simply nothing in its database to match against. This is the defining weakness of signature-based security for zero-days. The anomalous behavioral indicators the analyst observed — unexpected process spawning, unknown outbound connections — are exactly what behavioral detection tools (EDR) are designed to flag when signatures cannot.

Ch 39 · Zero-Day

Question 18 of 20

In April 2023, Google released an emergency patch for a zero-day vulnerability in Chrome that was being actively exploited. The flaw involved two technical elements working together. Which combination CORRECTLY describes the April 2023 Chrome zero-day?

A. Arbitrary code execution combined with a UEFI secure boot bypass B. Memory corruption in the V8 JavaScript engine combined with a sandbox escape — allowing an attacker to first gain code execution within Chrome's renderer and then break out of the browser's process isolation to execute code at the OS level C. SQL injection in Chrome's extension API combined with a privilege escalation in the Windows kernel D. A buffer overflow in Chrome's PDF renderer combined with sensitive information disclosure

✅ B. The April 2023 Chrome zero-day (CVE-2023-2033) combined memory corruption in the V8 JavaScript engine with a sandbox escape. Memory corruption in V8 allowed the attacker to gain code execution within the Chrome renderer process. However, Chrome runs web content in a sandbox — a restricted process that cannot directly access the OS. The sandbox escape component broke out of that containment, allowing attacker code to execute in the broader OS context with the permissions of the logged-in user. The two-step chain was necessary: without the sandbox escape, the attacker would be trapped inside the browser; without the memory corruption, there was nothing to escape from.

Ch 39 · Zero-Day

Question 19 of 20

The May 2023 Microsoft zero-day allowed an attacker to run self-signed code during the UEFI boot process, bypassing Secure Boot. Why is a vulnerability at this level considered more severe than a typical application or OS vulnerability?

A. UEFI vulnerabilities require physical access to the hardware, making them more difficult to exploit remotely B. Code executing at the UEFI level runs before the operating system loads, making it invisible to all OS-level security tools; malware installed at this level — a firmware rootkit — persists even after the OS is completely reinstalled, because reimaging only replaces the OS layer, not the underlying firmware C. UEFI vulnerabilities are more severe only on enterprise hardware; consumer-grade computers are protected by manufacturer warranty agreements D. The Secure Boot bypass prevents the device from ever starting again until the firmware is manually replaced

✅ B. UEFI firmware initializes hardware before the OS loads. Security tools — antivirus, EDR agents, endpoint protection platforms — all run after the OS. Malware installed at the UEFI level executes before any security tool starts, is invisible to them, and persists through OS reinstallation. A standard incident response procedure for a compromised system is to wipe and reimage it from a clean baseline. This completely fails for a firmware rootkit: the OS image changes, but the firmware layer beneath it is unchanged. The infected device boots again with a clean OS, and the firmware rootkit immediately runs again. Remediation of UEFI-level compromise requires firmware reflashing tools or hardware replacement — capabilities most organizations do not have.

Ch 39 · Zero-Day

Question 20 of 20

A security manager asks which single control provides the MOST effective detection capability for a zero-day attack that is actively in progress — specifically, one that can identify the attack without requiring a pre-existing signature for the exploit.

A. Keeping antivirus definitions updated daily to ensure the latest known signatures are present B. Applying all available patches on a 30-day cycle to reduce the window for known CVE exploitation C. Endpoint Detection and Response (EDR) with behavioral monitoring — instead of matching known signatures, EDR observes what processes actually do and flags anomalous behavior such as unexpected process chains, unusual memory writes, and anomalous network connections, enabling detection of novel exploits through behavioral deviation rather than known patterns D. Deploying a next-generation firewall with deep packet inspection tuned to block all unknown traffic patterns

✅ C. EDR behavioral monitoring is the primary detection tool for zero-day attacks in progress. It watches what processes do rather than matching what they look like — making it effective even when no signature exists. A zero-day exploit causes a known-good process to behave in unexpected ways: a browser spawns a process it never spawns normally, writes to memory locations it should not access, opens network connections to unknown destinations. These behavioral deviations trigger EDR alerts without needing a signature for the specific exploit. Antivirus (A) and patch management (B) are ineffective during the zero-day window — no signature exists and no patch is available. A firewall (D) cannot block exploit traffic it has never seen characterized.

Part B — Scenario Analysis (Unscored — for practice)

Ch 36–37 · Scenario

Scenario A — Third-Party Breach and Misconfiguration Discovery

A financial services organization discovers through a threat intelligence feed that one of its managed service providers (MSPs) was breached six weeks ago. The MSP had VPN access to the organization's internal network for remote system monitoring. Further investigation reveals that the MSP's VPN account had been used to access internal file shares that the MSP had no business reason to access. A separate audit triggered by this discovery also finds: (1) a cloud storage bucket containing quarterly financial reports with public read access enabled, (2) an internal mail relay still running SMTP without TLS, and (3) three servers whose root accounts accept direct SSH logins with passwords found in a leaked credential database. Describe the security significance of each finding, classify each by misconfiguration category, and design a prioritized remediation plan for all four issues.

Finding 1 — MSP Breach and Lateral Movement (Supply Chain / Service Provider Attack):
Classification: Supply chain / service provider attack — island hopping. An attacker compromised a weaker third party (the MSP) and used its trusted access to reach the organization. The VPN credentials gave the attacker an insider-equivalent network position. The access to file shares the MSP had no business need to access demonstrates the absence of least-privilege and network segmentation on the vendor access path.
Immediate remediation: (1) Revoke all MSP VPN credentials immediately and issue new credentials after the MSP demonstrates their environment is clean. (2) Conduct forensic analysis of all file share access logs for the six-week breach window to determine what data was accessed or exfiltrated. (3) Assess breach notification obligations — financial services firms have regulatory reporting requirements for data breaches. (4) Implement network segmentation: MSP access should reach only the specific systems the MSP needs to manage, on the specific ports required, not the general internal network. (5) Enable behavioral monitoring on all vendor service accounts: flag access outside normal patterns (hours, systems accessed, data volume).

Finding 2 — Public Financial Reports Bucket (Open Permissions):
Classification: Open permissions misconfiguration. Public read access on a bucket containing quarterly financial reports means any person on the internet can access material non-public financial information — a potential SEC violation and serious data exposure. The fix is immediate and straightforward.
Remediation: (1) Immediately disable public access on this bucket (enable Block Public Access at both bucket and account level). (2) Update the bucket policy to restrict access to specific authorized IAM roles only. (3) Enable AWS CloudTrail logging on the bucket to determine whether the public access was exploited — check access logs for the exposure period. (4) Conduct a full audit of all cloud storage buckets across all accounts for similar public access misconfigurations. (5) Implement organization-level Service Control Policy (SCP) preventing Block Public Access from being disabled on any bucket. Priority: this is the highest urgency finding — material financial data is currently publicly accessible.

Finding 3 — SMTP Without TLS (Insecure Protocol):
Classification: Insecure protocol. An internal mail relay sending SMTP without TLS transmits email content — potentially including internal financial communications, credentials in emails, and routing metadata — in plaintext on the internal network. Any attacker with network access (including the MSP attacker from Finding 1, if the lateral movement reached the relevant network segment) can passively read all mail relay traffic.
Remediation: (1) Configure the mail relay to require STARTTLS for all connections, blocking plaintext SMTP. (2) If the relay is internal-to-internal, configure both sending and receiving mail servers to require TLS negotiation. (3) Verify TLS is enforced end-to-end for external mail flows as well (MX record, TLS certificate on the mail gateway). (4) Conduct a packet capture verification after configuration to confirm all SMTP traffic is now encrypted. Priority: medium — internal mail relay exposure is lower urgency than the active public bucket, but should be remediated within one patch cycle.

Finding 4 — Root SSH with Leaked Credentials (Unsecured Admin Accounts):
Classification: Unsecured admin accounts. Three servers accept direct root SSH logins with passwords found in a leaked credential database — meaning any attacker who has downloaded that database can log in as root immediately. Root SSH access provides unrestricted control of the server.
Remediation: (1) Immediately change root passwords on all three servers to long, randomly generated credentials. (2) Disable PermitRootLogin in /etc/ssh/sshd_config on all three servers — eliminate direct root SSH login entirely. Restart the SSH daemon. (3) Require administrators to use named accounts with sudo for privileged operations. (4) Audit all servers organization-wide for the same issue. (5) Conduct a review of authentication logs on these three servers for unauthorized access during the period the credentials were exposed. (6) Check whether any of these servers were reachable from the MSP VPN access path — if the MSP attacker could have reached them, treat them as potentially compromised and investigate further. Priority: critical — immediate password change, disable root login same day.

Overall Prioritization:
Priority 1 (immediate): MSP credential revocation and public bucket remediation — active exposure and active threat. Priority 2 (same day): Root password change and disable root SSH — credentials are in a leaked database; attacks may be actively occurring. Priority 3 (within one week): SMTP TLS enforcement and full organization-wide audit for similar issues. Priority 4 (within one month): Implement MSP network segmentation, behavioral monitoring on vendor accounts, cloud SCP policy, and organization-wide hardening review.

Ch 38–39 · Scenario

Scenario B — Mobile Device Compromise and Zero-Day Detection

A threat intelligence analyst at a healthcare company notices at 11:30 PM that a tablet enrolled in the MDM — used by a physician to access the electronic health record (EHR) system — is exhibiting anomalous behavior: a legitimate EHR app process has spawned a child process that has not been seen before and is making outbound connections to an external IP address at 15-minute intervals. Antivirus on the device is clean. No threat intelligence feed flags the destination IP. An MDM integrity check returns a pass. A separate notification arrives 20 minutes later: the healthcare company's security team has received a tip that a new zero-day exploit targeting the EHR mobile app is being actively used to compromise tablets at healthcare organizations. Part 1: What steps should the analyst take immediately? Part 2: Assuming the two events are related and the device has been compromised via a zero-day, how does this scenario illustrate the limits of each traditional security control that failed to detect it — and what controls would have been more effective?

Part 1 — Immediate Actions:

Step 1 — Isolate the device (first 5 minutes): Do not power off the tablet — volatile memory contains the exploit code in its running state, which is essential forensic evidence. Immediately revoke the device's access to the EHR system at the application/network layer. Block the outbound IP address at the perimeter firewall to cut the C2 channel — this applies to all devices in the fleet, not just this one, since other tablets may be compromised. Network-isolate the tablet (block it at the wireless controller or VLAN) while keeping it powered on for forensic capture.

Step 2 — Preserve evidence: Trigger an MDM backup of the device's app data and logs. Request a device memory capture through EDR tooling if available. Save the behavioral alert details — process chain, child process name, network connection details, timestamps — before anything is cleared. These are the IOCs that will be shared with the EHR vendor.

Step 3 — Escalate and notify: Notify the CISO and incident response team immediately — a potential zero-day affecting the EHR app used across the healthcare organization is a P0 incident. Notify the EHR app vendor's security team with the full behavioral details (the IOC you observed, the child process, the destination IP). In a healthcare setting, also contact legal/compliance to assess whether EHR data was accessed or exfiltrated (triggering HIPAA breach notification obligations).

Step 4 — Assess organization-wide scope: Query EDR and MDM logs across all tablets enrolled in the MDM for the same behavioral pattern (same process chain, same child process name, same destination IP). Identify any other devices that may be compromised. Apply the same isolation and C2-blocking steps to any additional affected devices immediately.

Step 5 — Communicate to the EHR vendor: The vendor tip and your independent behavioral observation together strongly suggest an active zero-day. Provide the vendor with full technical details — they need this to develop a patch. Request confirmation of the vulnerability, an estimated patch timeline, and any interim workarounds (such as blocking specific functionality, disabling an affected component, or switching to a browser-based EHR access until the app is patched).

Part 2 — Why Each Traditional Control Failed and What Would Have Helped:

Antivirus (clean result — failed): Antivirus uses signature-based detection. A zero-day exploit has never been seen before and has no signature. The antivirus correctly reported that no known malware matched — because no match exists in its database. Signature-based detection is fundamentally incapable of detecting a novel exploit. What would help: EDR behavioral monitoring was the only tool that actually saw the attack — the anomalous process chain and outbound connections to an unknown IP are behavioral signals that EDR can flag without a signature.

MDM integrity check (passed — failed for device trust): The MDM integrity check returned a pass, suggesting the device may not be jailbroken. However, the zero-day exploit did not require jailbreaking — it exploited a vulnerability in the EHR app itself. The MDM integrity check verifies OS integrity, not application-level exploit activity. The MDM is not equipped to detect in-application exploitation of the EHR app's code. What would help: application-level behavioral monitoring within the EHR app (such as runtime application self-protection) or mobile threat defense (MTD) integration with the MDM that monitors application behavior in addition to OS integrity.

Threat intelligence feed (no IP flagged — failed to pre-warn): The destination IP had not been previously observed or reported — this is typical of fresh attacker infrastructure specifically set up for this campaign. Threat intelligence feeds rely on historical observation; newly created C2 infrastructure has no history to flag. What would help: behavioral network monitoring that flags outbound connections from medical apps to unusual destinations (a healthcare EHR app should not be connecting to random external IPs on a 15-minute interval) regardless of whether the IP appears in threat feeds.

What actually worked: The behavioral anomaly detection in the analyst's routine telemetry review — the EHR app process spawning an unexpected child process with external C2 behavior — was the only signal that identified the attack. This is exactly the value of EDR behavioral monitoring for zero-days: watching what processes do, not what they look like. Combined with network segmentation (blocking the C2 IP and isolating the device immediately), the attack's impact was contained. The zero-day cannot be prevented by any of these controls before a patch exists — but detection through behavioral monitoring and containment through network controls limited the damage to one device during the detection window.

← Exam: Ch 33–34 All Chapters Exam: Ch 40–43 →

—

Pass threshold: 80% (16 / 20 correct)

← Ch 33–34 Exam All Chapters Ch 40–43 Exam →

Exam: Supply Chain, Misconfigurations, Mobile & Zero-Day