INTRODUCTION – Threats to Asset Security

TEST YOUR KNOWLEDGE: SOCIAL ENGINEERING

1. Fill in the blank: _____ is the use of digital communications to trick people into revealing sensitive data or deploying malicious software.

2. What type of phishing uses electronic voice communications to obtain sensitive information or to impersonate a known source?

3. Fill in the blank: The stages of a social engineering attack include to prepare, establish trust, use persuasion tactics, and ____.

4. Phishing kits typically contain which of the following tools to help attackers avoid detection? Select three answers.

5. Which of the following may be stages of a social engineering attack? Select three answers.

6. Which of the following is a form of phishing? Select two answers.

TEST YOUR KNOWLEDGE: MALWARE

1. Which of the following are types of malware? Select two answers.

2. Fill in the blank: ____ are malware that automatically duplicate and spread themselves across systems.

3. What is it called when someone’s computing resources are illegally hijacked to mine cryptocurrencies?

4. Which of the following are common signs of a malware infection? Select three answers.

5. Fill in the blank: _____ is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access.

6. Which of the following actions can be taken to protect against cryptojacking?

Test your knowledge: Web-based exploits

1. Fill in the blank: _____ are malicious code or behaviors that are used to take advantage of coding flaws in a web application.

2. Cross-site scripting (XSS) attacks are often delivered by exploiting which of the following languages? Select two answers.

3. Fill in the blank: A _____ is a coding technique that executes SQL statements before passing them onto the database.

4. What are two examples of when SQL injections can take place?

5. In a SQL injection attack, malicious hackers attempt to obtain which of the following? Select two answers.

6. Which of the following are types of cross-site scripting (XSS) attacks? Select three answers.

7. Fill in the blank: A(n) _____ is an attack that executes unexpected queries on a database.

TEST YOUR KNOWLEDGE: THREAT MODELING

1. Fill in the blank: Threat modeling is a process that security teams use to _____ attacks.

2. Which of the following are steps of a threat modeling process? Select three answers.

3. A threat modeling team has identified potential threats and vulnerabilities that might be exploited. The team creates a diagram that maps the threats to assets. What type of diagram is this known as?

4. Which of the following are threat modeling frameworks? Select two answers.

5. What are the objectives of PASTA or any other threat modeling activity? Select three answers.

6. Which of the following is a step of the threat modeling process? Select two answers.

7. Fill in the blank: PASTA is a popular _____ framework that’s used across many industries.

MODULE 4 CHALLENGE

1. Fill in the blank: The four stages of a social engineering attack are to prepare, _____, use persuasion tactics, and disconnect from the target.

2. What is the main difference between a vishing attack and a smishing attack?

3. Fill in the blank: The main difference between a worm and a virus is that a worm can _____.

4. Which type of malware requires the user to make a payment to the attacker to regain access to their device?

5. Fill in the blank: Cryptojacking is a type of malware that uses someone’s device to _____ cryptocurrencies.

6. What is malicious code that is inserted into a vulnerable application called?

7. An attacker sends a malicious link to subscribers of a sports news site. If someone clicks the link, a malicious script is sent to the site’s server and activated during the server’s response.

This is an example of what type of injection attack?

8. What are the reasons that an attacker would perform a SQL injection attack? Select three answers.

9. What are some key benefits of the threat modeling process? Select all that apply.

10. A security team is decomposing an application during a PASTA threat model. What information will they discover during this step of the process?

11. Which of the following could be examples of social engineering attacks? Select three answers.

12. Fill in the blank: _____ uses text messages to manipulate targets into sharing sensitive information.

13. A digital artist receives a free version of professional editing software online that has been infected with malware. After installing the program, their computer begins to freeze and crash repeatedly.

The malware hidden in this editing software is an example of which type of malware?

14. Fill in the blank: A(n) _____ tool can be used by security professionals to catch abnormal activity, like malware mining for cryptocurrency.

15. A hacktivist group gained access to the website of a utility company. The group bypassed the site’s login page by inserting malicious code that granted them access to customer accounts to clear their debts.

What type of attack did the hacktivist group perform?

16. Fill in the blank: A _____ cross-site scripting (XSS) attack is an instance when malicious script exists in the webpage a browser loads.

17. During which stage of the PASTA framework is an attack tree created?

18. Which of the following are not types of malware? Select two answers.

19. Which of the following are common signs that a computer is infected with cryptojacking software? Select three answers.

20. Which of the following are areas of a website that are vulnerable to SQL injection? Select two answers.

21. Which stage of the PASTA framework is related to identifying the application components that must be evaluated?

22. A threat actor tricked a new employee into sharing information about a senior executive over the phone.

This is an example of what kind of attack?

23. What is the most common form of social engineering used by attackers?

24. A government contractor is tricked into installing a virus on their workstation that encrypts all their files. The virus displays a message on the workstation telling the contractor that they can have the files decrypted if they make a payment of $31,337 to an email address.

What type of attack is this an example of?

25. Security researchers inserted malicious code into the web-applications of various organizations. This allowed them to obtain the personally identifiable information (PII) of various users across multiple databases.

What type of attack did the researchers perform?

26. What are the characteristics of a ransomware attack? Select three answers.

27. A small business that sells online courses conducted a threat modeling exercise on its data systems. The team conducting the exercise started by defining the scope of the model. Then, they identified threat actors who might target the data systems. Next, the team is creating a diagram that maps threats to assets that are being protected.

What is this type of diagram called?

CONCLUSION – Threats to Asset Security