Threats, Vulnerabilities and Attack Methods

Introduction and Context

Cybersecurity incidents rarely result from a single technical weakness. They usually arise from an interaction among a threat actor, an exploitable vulnerability, an exposed attack surface, an opportunity to achieve an objective, and weaknesses in preventive or detective controls. A public-facing application may be technically vulnerable, but compromise also depends on whether it is reachable, whether authentication is required, whether exploitation is known, and whether monitoring detects abnormal activity.

This chapter examines the major threats and attack methods encountered by organisations: malware, phishing, social engineering, credential attacks, denial of service, insider threats and advanced persistent threats (APTs). It also introduces attack surfaces, the cyber kill chain, MITRE ATT&CK and vulnerability concepts as complementary ways to analyse attacks.

A professional cybersecurity analyst must distinguish between a threat, a vulnerability, an attack and a risk. A threat is a potential cause of harm, such as a criminal group or malicious program. A vulnerability is a weakness that can be exploited. An attack is an intentional action that attempts to compromise confidentiality, integrity or availability. Risk is the possibility and consequence of harm when a threat can exploit a vulnerability.

Learning Objectives

By the end of this chapter, you should be able to:

• distinguish threats, vulnerabilities, exploits, attacks and risks;
• identify and reduce an organisation’s attack surface;
• explain the operation and impact of common malware families;
• analyse phishing, social engineering and credential attacks;
• explain denial-of-service attacks and appropriate resilience measures;
• evaluate insider threats and advanced persistent threats;
• apply the cyber kill chain and MITRE ATT&CK to incident analysis;
• assess limitations, ethical issues and governance responsibilities in threat analysis.

1. Threat, Vulnerability and Risk Concepts

1.1 Threat actors

Threat actors are individuals or groups capable of causing harm. Their capabilities, resources, motivation and access differ substantially. Common categories include:

A threat actor may be external, internal or operating through a trusted third party. Attribution is difficult because attackers can use compromised infrastructure, proxy services, false identities and tools copied from other groups.

1.2 Vulnerabilities and exploits

A vulnerability is a weakness in software, hardware, configuration, process, architecture or human behaviour. Examples include an unpatched server, excessive privileges, weak passwords, insecure application programming interfaces, exposed management interfaces and inadequate staff verification procedures.

An exploit is a method, code or sequence of actions that takes advantage of a vulnerability. A vulnerability may exist without a known exploit, while an exploit may be unavailable to most attackers. A vulnerability becomes especially dangerous when it is remotely reachable, requires little skill to exploit, affects a critical asset and has no effective compensating control.

Vulnerabilities may be classified as:

• Technical vulnerabilities: software defects, insecure protocols and misconfigured systems.
• Administrative vulnerabilities: inadequate policies, poor risk assessment and insufficient training.
• Physical vulnerabilities: uncontrolled access to servers, removable media or network equipment.
• Human vulnerabilities: susceptibility to deception, unsafe handling of information or excessive trust.
• Supply-chain vulnerabilities: weaknesses introduced by vendors, service providers, libraries or managed platforms.

A zero-day vulnerability is a vulnerability unknown to the vendor or for which no effective patch was available when exploitation occurred. The term describes the defender’s remediation position, not necessarily the age of the flaw.

1.3 Assets, attack surfaces and attack vectors

An asset is anything valuable to an organisation, including information, systems, services, credentials, facilities and reputation. The attack surface is the collection of reachable points through which an attacker could attempt access, influence or disruption. It includes internet-facing systems, cloud services, remote-access platforms, employee accounts, application interfaces, suppliers, mobile devices and physical locations.

An attack vector is the specific route or method used to conduct an attack. Email attachments, stolen passwords, exposed APIs, malicious websites, removable media and supply-chain updates are examples.

Attack-surface management is a continuous activity rather than a one-time inventory exercise. Organisations should identify assets, owners, data flows, software versions, external exposure, trust relationships and business criticality. Unknown assets are particularly dangerous because they are unlikely to be patched, monitored or included in incident-response plans.

1.4 Risk and control relationships

A useful qualitative model is that risk increases when the likelihood of exploitation and the impact of compromise increase. In formal risk assessments, organisations may estimate likelihood and impact using defined scales. Such scores are decision aids, not objective measurements of reality. They should be supported by evidence such as vulnerability intelligence, asset criticality, threat activity and control effectiveness.

Controls can be classified as:

• Preventive: reduce the probability of a successful attack, such as patching, segmentation and multifactor authentication.
• Detective: identify suspicious activity, such as endpoint detection, logging and intrusion detection.
• Corrective: restore systems or remove persistence, such as rebuilding hosts and resetting credentials.
• Deterrent: discourage attacks, such as visible monitoring and disciplinary policies.
• Compensating: provide alternative protection when a preferred control is impractical.

Defence in depth is the deliberate use of multiple, independent or partially independent controls. It recognises that no single control is perfect.

2. Malware and Malicious Code

Malware is software or firmware designed to perform unauthorised actions, including theft, disruption, surveillance, extortion or unauthorised control. Malware should be analysed by behaviour rather than by labels alone because categories overlap.

2.1 Major malware categories

Viruses attach themselves to legitimate files and generally require execution of the infected host file to spread. Worms self-propagate across networks or systems without requiring a user to copy an infected file. Trojans appear legitimate but perform hidden malicious actions. Ransomware denies access to data or systems, commonly through encryption, and may also steal data for extortion. Spyware collects information covertly. Keyloggers capture keystrokes. Rootkits conceal malicious activity and maintain privileged access. Botnet malware enrols systems into a remotely controlled network. Remote-access trojans provide attackers with covert control. Wipers destroy data or system functionality rather than seeking recoverable financial extortion.

Fileless or living-off-the-land attacks use legitimate tools and components already present in an operating system. For example, an attacker may abuse scripting engines, administrative utilities or remote-management tools. These attacks challenge traditional antivirus because there may be no distinctive malicious executable on disk.

2.2 Typical malware lifecycle

A malware operation may involve initial access, execution, persistence, privilege escalation, defence evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration and impact. The sequence is not always linear. Attackers may repeat stages, skip stages or operate several stages simultaneously.

Malware analysis commonly uses:

• Static analysis: examination of code, metadata, strings, imports and configuration without executing the sample.
• Dynamic analysis: observation in a controlled sandbox or isolated environment.
• Memory analysis: examination of volatile memory for injected code, credentials and running processes.
• Behavioural analysis: study of files, processes, network connections, persistence and system changes.

Analysts must preserve evidence, isolate samples and avoid executing malware on production systems. Indicators of compromise, such as hashes, domains and file paths, are useful but can become obsolete quickly. Behavioural indicators and detection logic are often more durable.

2.3 Ransomware and organisational resilience

Ransomware prevention requires more than endpoint antivirus. Important controls include tested offline or immutable backups, least privilege, network segmentation, application control, patch management, multifactor authentication, email filtering, endpoint detection and response, and rehearsed recovery procedures. Backups must be protected from the same administrative accounts and network paths that ransomware could compromise.

A ransomware response should prioritise safety, containment, evidence preservation, legal obligations, business continuity and recovery. Paying a ransom does not guarantee data deletion, decryption or future non-targeting. Decisions must involve executive leadership, legal advisers, insurers, law enforcement where appropriate and affected stakeholders.

3. Phishing and Social Engineering

Social engineering manipulates people into taking actions that weaken security or disclose information. It exploits cognitive biases such as authority, urgency, familiarity, reciprocity and fear. Technical controls reduce exposure, but they cannot eliminate the need for sound human decision-making.

3.1 Forms of phishing

• Bulk phishing: generic messages sent to many recipients.
• Spear phishing: targeted messages designed for a particular person or group.
• Whaling: spear phishing aimed at senior executives or high-value individuals.
• Business email compromise: manipulation of payment, invoice or account processes, often without malware.
• Smishing: phishing through SMS or messaging services.
• Vishing: voice-based deception, including fraudulent support calls.
• Clone phishing: a copied legitimate message containing a substituted link or attachment.
• Consent phishing: deception that persuades a user to grant a malicious application access to cloud data.

Phishing analysis should examine the sender identity, reply-to address, authentication results, links, attachments, language, timing and requested action. A familiar logo is not evidence of authenticity. A compromised legitimate account may produce a message that passes normal sender checks.

3.2 Social-engineering controls

Effective controls combine technology, process and culture:

1. Require independent verification of payment or account-change requests.
2. Use phishing-resistant multifactor authentication where feasible.
3. Configure email authentication and filtering, while recognising their limitations.
4. Disable or restrict risky macros and unnecessary script execution.
5. Train staff using realistic but ethical exercises.
6. Make reporting easy and non-punitive.
7. Monitor unusual mailbox rules, forwarding settings and OAuth grants.
8. Use dual authorisation for high-value transactions.

Training should not imply that users are the sole security boundary. If a process allows a single deceptive email to move a large payment, the process—not merely the employee—requires redesign.

4. Credential Attacks and Identity Abuse

Credentials are attractive targets because they can provide legitimate-looking access. Credential attacks include password guessing, brute force, password spraying, credential stuffing, phishing, malware-based theft, session-token theft and abuse of default or exposed credentials.

• Brute force: attempts many passwords against one account.
• Password spraying: tries a small number of common passwords across many accounts, reducing lockout risk.
• Credential stuffing: tests username-password pairs stolen from other services.
• Pass-the-hash or pass-the-ticket techniques: abuse authentication material without directly recovering the user’s plaintext password.
• MFA fatigue: sends repeated authentication prompts until a user approves one.
• Session hijacking: uses stolen cookies or tokens to impersonate an authenticated session.

Controls include password managers, breached-password screening, long unique passwords, rate limiting, adaptive authentication, phishing-resistant MFA, secure session management, privileged-access management and monitoring of impossible travel or unusual device activity. Account lockouts must be designed carefully because excessive lockouts can themselves enable denial of service.

Identity security should follow least privilege, separation of duties and continuous verification. Authentication confirms an identity claim; authorisation determines what that identity may do. Strong authentication cannot compensate for excessive permissions.

5. Denial of Service and Availability Attacks

A denial-of-service (DoS) attack attempts to make a service unavailable or unusable. A distributed denial-of-service (DDoS) attack uses multiple systems, frequently a botnet or abused infrastructure, to generate traffic or requests.

Common forms include:

• Volumetric attacks: consume network bandwidth.
• Protocol attacks: exhaust connection tables or network-device resources.
• Application-layer attacks: send apparently valid requests that consume expensive application or database resources.
• Reflective or amplified attacks: cause third-party systems to send responses to the victim, increasing traffic volume.
• Asymmetric attacks: exploit an imbalance in the cost of processing requests and responses.

Availability protection is layered. Measures include capacity planning, rate limiting, caching, autoscaling with safeguards, web application firewalls, upstream filtering, content delivery networks, resilient DNS, network segmentation and provider-level DDoS protection. Organisations also need service degradation plans, alternative communication channels and clear thresholds for escalation.

DDoS defence is not simply a matter of purchasing more bandwidth. A large application-layer attack may exhaust database connections while network utilisation remains moderate. Detection must therefore monitor service latency, error rates, connection counts, resource saturation and user experience.

6. Insider Threats

An insider is a person with authorised or trusted access. Insider threat includes malicious misuse, negligent behaviour, compromised insiders and accidental disclosure. Examples include copying confidential data before leaving employment, installing unauthorised software, sending information to the wrong recipient or approving a fraudulent request after account compromise.

A mature programme avoids simplistic profiling. Behavioural indicators are context-dependent and should not be treated as proof of wrongdoing. Effective measures include least privilege, data classification, access reviews, privileged-session monitoring, segregation of duties, data-loss prevention, secure offboarding and support for employees who report concerns.

Insider-threat programmes create privacy and employment-law concerns. Monitoring should be proportionate, transparent, access-controlled and governed by documented purposes. Investigations should preserve due process and avoid discriminatory assumptions.

7. Advanced Persistent Threats

An advanced persistent threat is a sustained, adaptive intrusion in which an attacker seeks long-term access to a target. The word “advanced” does not mean that every tool is technically sophisticated. Persistence, operational discipline, stealth, intelligence gathering and adaptation may be more significant than novel malware.

APT campaigns often involve reconnaissance, initial access, establishment of persistence, privilege escalation, internal discovery, lateral movement, collection, command and control, exfiltration and concealment. A campaign may use stolen credentials, legitimate administration tools, supplier access or previously compromised infrastructure.

Defence against APTs requires assuming that prevention may fail. Important capabilities include centralised logging, identity monitoring, endpoint telemetry, network visibility, segmentation, privileged-access controls, threat hunting, vulnerability management, incident-response readiness and tested recovery. Detection should focus on unusual sequences and relationships, not only known malware signatures.

8. The Cyber Kill Chain

The Lockheed Martin Cyber Kill Chain describes seven stages:

1. Reconnaissance: gathering information about the target.
2. Weaponisation: combining an exploit with a payload.
3. Delivery: transmitting the weapon through email, web, removable media or another route.
4. Exploitation: triggering a vulnerability or human action.
5. Installation: establishing malware or another persistent mechanism.
6. Command and control: creating a channel for attacker instructions.
7. Actions on objectives: theft, disruption, manipulation or other outcomes.

The model encourages defenders to disrupt an operation as early as possible. Its limitation is that modern attacks are not always linear. Cloud attacks, credential abuse and insider activity may not fit neatly into the stages, and several stages may occur without malware installation.

9. MITRE ATT&CK as an Analytical Framework

MITRE ATT&CK is a knowledge base of adversary tactics, techniques and procedures based on observed behaviour. Tactics describe objectives, such as Initial Access, Execution, Persistence, Privilege Escalation, Defence Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. Techniques describe how those objectives may be achieved.

ATT&CK can support:

• threat-informed detection engineering;
• mapping observed events to adversary behaviour;
• identifying gaps in security telemetry;
• threat hunting hypotheses;
• purple-team exercises;
• incident reporting and communication;
• evaluation of security controls.

ATT&CK is not a checklist of every control an organisation must implement, and technique presence does not prove that a particular group conducted an incident. Mappings require evidence. Analysts should record the observed event, confidence level, data source and alternative explanations.

The kill chain provides a campaign sequence and disruption perspective. ATT&CK provides a detailed behavioural vocabulary. Vulnerability management identifies weaknesses that may enable access. Used together, they provide a more complete analysis.

10. A Practical Investigation Method

A structured investigation can proceed as follows:

Establish scope. Identify affected users, systems, locations, time periods and business services.

Preserve evidence. Secure logs, memory, disk images, email headers, cloud audit records and relevant communications. Record chain of custody.

Build a timeline. Correlate authentication, process, network, email and administrative events using reliable time sources.

Identify the initial access route. Consider phishing, exposed services, stolen credentials, third-party access and insider activity.

Map behaviours. Relate observed actions to kill-chain stages and ATT&CK techniques, while recording uncertainty.

Contain safely. Isolate compromised hosts, revoke tokens, reset credentials, block malicious infrastructure and preserve evidence before destructive actions when possible.

Eradicate and recover. Remove persistence, patch or reconfigure systems, rebuild where trust is uncertain, restore from verified backups and increase monitoring.

Learn and improve. Identify control failures, update detections, revise procedures and test the improvements.

Applied Case: Illustrative Healthcare Phishing and Ransomware Incident

Background

A fictional regional healthcare provider operates a cloud email platform, electronic health-record systems, remote access and several third-party diagnostic services. Staff use multifactor authentication, but approval-based push authentication is enabled for all users.

Problem

An accounts employee receives a message appearing to come from a finance manager. The message requests urgent approval of a supplier bank-account change. Shortly afterwards, the employee receives repeated authentication prompts and approves one. The attacker enters the mailbox, creates a hidden forwarding rule and searches messages for invoices and remote-access information. A stolen session token is then used to access a workstation. Ransomware later encrypts several file shares, while evidence suggests that sensitive records were copied.

Analysis

The attack surface included the employee’s mailbox, approval-based MFA, cloud session tokens, remote access, file shares and supplier payment processes. The initial access involved social engineering and identity abuse rather than exploitation of a software vulnerability.

Using the kill chain, reconnaissance involved learning the employee’s role and supplier relationships. Delivery occurred through targeted email. Exploitation was the employee’s approval of the fraudulent authentication request. Installation and persistence were represented by mailbox forwarding and continued token access. Command and control used cloud services. Actions on objectives included financial fraud, data theft and ransomware impact.

An ATT&CK-informed assessment could map the activity to spear phishing, valid accounts, additional cloud credentials or tokens, email collection, data from information repositories, exfiltration and impact through data encrypted for impact. Exact mappings would require forensic evidence.

Approach and solution

The organisation disabled the malicious session, revoked tokens, reset credentials, removed forwarding rules, isolated affected endpoints and engaged its incident-response provider. It preserved cloud audit logs and endpoint evidence. Payment instructions were independently verified with the supplier. File services were restored from protected backups after the environment was rebuilt and administrative credentials were rotated.

Longer-term improvements included phishing-resistant MFA, stricter conditional access, mailbox-rule alerts, dual approval for payment changes, segmentation of clinical and administrative networks, privileged-access management, immutable backups and exercises involving suppliers and executives.

Outcome and learning points

The provider restored critical services, but the incident caused operational disruption, investigation costs and possible privacy obligations. The main lesson is that MFA is valuable but not uniform: approval-based MFA remains vulnerable to social engineering. Identity controls, transaction verification, monitoring and recovery controls must work together. The event also demonstrates why an attack-surface inventory must include cloud identities, sessions, business processes and trusted suppliers—not only servers.

Governance, Ethics and Regulation

Threat analysis must be conducted lawfully and proportionately. Organisations should define authority for monitoring, penetration testing, malware analysis and threat intelligence collection. Unauthorised testing can itself be an offence. Personal data in logs, email and endpoint telemetry requires appropriate access control, retention limits and lawful processing.

Incident reporting obligations vary by jurisdiction and sector. Healthcare, finance, government and critical infrastructure organisations may face specific notification, resilience and record-keeping duties. Legal counsel should be involved early when personal data, regulated services, extortion or cross-border evidence is involved.

Threat intelligence must be evaluated for reliability and handling restrictions. Sharing indicators without context can create false positives or disclose sensitive information. AI-assisted detection can identify unusual patterns and summarise large event sets, but it can also produce false positives, expose confidential data or encode biased assumptions. Human review, data governance, model validation and auditability remain necessary.

Contemporary Developments and Best Practice

The modern attack environment is shaped by cloud identity, software supply chains, ransomware extortion, deepfakes, automated phishing, exposed application programming interfaces and criminal use of legitimate services. Attackers increasingly target identity providers and suppliers because these relationships provide scalable access.

A practical security programme should:

• maintain an authoritative asset and identity inventory;
• reduce unnecessary internet exposure and privileges;
• patch according to exploitability and business criticality;
• use phishing-resistant MFA for privileged and high-risk access;
• segment critical services and protect administrative paths;
• centralise and protect logs with accurate time synchronisation;
• test backups, recovery objectives and crisis communications;
• rehearse incident response with technical and executive participants;
• continuously review suppliers and inherited cloud controls;
• measure control effectiveness rather than merely counting tools.

No framework eliminates uncertainty. The objective is to reduce attack opportunities, limit attacker movement, detect harmful behaviour quickly, preserve trustworthy evidence and recover essential services.

Chapter Summary

Threats, vulnerabilities, exploits, attacks and risks are related but distinct concepts. An organisation’s attack surface includes technical systems, identities, cloud services, people, suppliers and business processes. Malware can steal, spy, persist, encrypt or destroy, while phishing and social engineering manipulate people into enabling unauthorised access. Credential attacks exploit weak, reused, exposed or socially obtained authentication material. DoS and DDoS attacks target availability, whereas insider threats exploit legitimate access or trusted relationships. APTs are sustained campaigns characterised by persistence, adaptation and strategic objectives.

The cyber kill chain helps analysts understand attack progression and identify disruption opportunities. MITRE ATT&CK supplies a detailed vocabulary for adversary tactics and techniques. Vulnerability management, identity security, monitoring, segmentation, resilience and incident response must be integrated rather than treated as isolated activities. Ethical monitoring, privacy, legal authority, evidence handling and regulatory duties are essential parts of professional cybersecurity practice.

Key Terms

Threat: A potential cause of harm to an asset or organisation.

Threat actor: A person, group or organisation capable of conducting a harmful action.

Vulnerability: A weakness that may be exploited.

Exploit: A method or code that takes advantage of a vulnerability.

Attack surface: The collection of reachable points through which an attack may be attempted.

Attack vector: A route or method used to conduct an attack.

Malware: Software or firmware designed to perform unauthorised or harmful actions.

Ransomware: Malware that denies access to data or systems, commonly for extortion.

Phishing: Deceptive communication intended to obtain information or cause an unsafe action.

Social engineering: Manipulation of people to undermine security.

Credential stuffing: Testing stolen username-password pairs against other services.

Password spraying: Trying a small set of common passwords across many accounts.

Denial of service: An attack that reduces or prevents service availability.

Insider threat: Harm caused by misuse, negligence or compromise of authorised access.

Advanced persistent threat: A sustained and adaptive intrusion seeking long-term access or strategic objectives.

Cyber kill chain: A model describing stages of a cyber attack.

MITRE ATT&CK: A knowledge base of observed adversary tactics, techniques and procedures.

Persistence: Mechanisms that allow an attacker to retain access.

Defence in depth: Use of multiple complementary security controls.

Least privilege: Granting only the access required for an authorised task.

Review Questions

Short Answer Questions

1. Distinguish between a vulnerability and an exploit.
2. What is the difference between phishing and spear phishing?
3. Identify three common forms of credential attack.
4. Why are offline or immutable backups important in ransomware resilience?
5. State two limitations of the cyber kill chain.

Long Answer Questions

1. Explain how attack-surface management can reduce the likelihood and impact of cyber attacks.
2. Compare malware, social engineering and credential attacks as methods of obtaining initial access.
3. Explain the seven stages of the cyber kill chain and relate each stage to possible defensive controls.
4. Discuss how MITRE ATT&CK supports detection engineering and threat hunting.
5. Analyse the ethical, privacy and governance issues associated with insider-threat monitoring.

Analytical / Application Questions

1. An employee approves an unexpected MFA prompt, after which an attacker creates a mailbox forwarding rule and accesses a file share. Analyse the incident using the cyber kill chain and identify immediate containment actions.
2. A public-facing application is fully patched but experiences repeated application-layer denial-of-service attacks. Recommend a layered defence and explain why patching alone is insufficient.
3. A supplier’s compromised account is used to access a cloud tenant. Identify the relevant attack-surface elements, likely ATT&CK-informed behaviours and improvements to identity and supplier governance.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from an exploit?

A. A vulnerability is a weakness, while an exploit is a method of taking advantage of it.

B. A vulnerability is always malware, while an exploit is always a password.

C. A vulnerability is the impact of an incident, while an exploit is its business cost.

D. A vulnerability is a security policy, while an exploit is a backup.

Correct Answer: A. A vulnerability is a weakness, while an exploit is a method of taking advantage of it.

Question 2

Which attack attempts a small number of common passwords across many accounts?

A. Credential stuffing

B. Password spraying

C. Session hijacking

D. Reflective amplification

Correct Answer: B. Password spraying

Question 3

Which malware type primarily denies access to data through encryption and extortion?

A. Spyware

B. Rootkit

C. Ransomware

D. Worm

Correct Answer: C. Ransomware

Question 4

Which cyber kill-chain stage involves establishing a covert mechanism to retain access?

A. Reconnaissance

B. Delivery

C. Persistence or installation

D. Actions on objectives

Correct Answer: C. Persistence or installation

Question 5

What is a principal purpose of MITRE ATT&CK?

A. To provide a detailed vocabulary of observed adversary behaviours

B. To replace all vulnerability scanners

C. To guarantee that an organisation cannot be breached

D. To calculate the financial value of every asset

Correct Answer: A. To provide a detailed vocabulary of observed adversary behaviours

Question 6

Which control most directly reduces the risk of approval-based MFA fatigue?

A. Increasing the number of authentication prompts

B. Using phishing-resistant MFA and number matching where appropriate

C. Disabling all audit logs

D. Allowing shared administrator accounts

Correct Answer: B. Using phishing-resistant MFA and number matching where appropriate

Question 7

Which type of DDoS attack mainly attempts to exhaust application or database resources with expensive requests?

A. Application-layer attack

B. Physical theft attack

C. Password-spraying attack

D. Supply-chain attack

Correct Answer: A. Application-layer attack

Question 8

Why are unknown internet-facing assets especially risky?

A. They are automatically immune to malware.

B. They are unlikely to be included in patching, monitoring and response processes.

C. They cannot communicate with users.

D. They always contain classified information.

Correct Answer: B. They are unlikely to be included in patching, monitoring and response processes.

Question 9

Which principle requires users to receive only the access needed for their tasks?

A. Defence evasion

B. Least privilege

C. Open trust

D. Maximum availability

Correct Answer: B. Least privilege

Question 10

Which statement about advanced persistent threats is most accurate?

A. They always use previously unknown malware.

B. They are necessarily short, opportunistic attacks.

C. They are sustained and adaptive intrusions seeking continued access or strategic objectives.

D. They can occur only against government systems.

Correct Answer: C. They are sustained and adaptive intrusions seeking continued access or strategic objectives.