Threats, Vulnerabilities and Attack Methodologies

Introduction

Network security is concerned not merely with preventing isolated attacks, but with understanding how adversaries identify opportunities, exploit weaknesses, establish control, achieve objectives, and avoid detection. A secure network therefore requires a structured analysis of threats, vulnerabilities, attack techniques, defensive controls, and intelligence about the changing threat environment.

A threat is a potential cause of harm to an information asset. A vulnerability is a weakness that can be exploited by a threat actor. An attack is the deliberate attempt to exploit a vulnerability. Risk expresses the possibility and consequence of harm arising from a threat exploiting a vulnerability. These concepts are related but not interchangeable: a vulnerability may exist without being exploited, and a threat may exist without having a feasible path to a particular asset.

At postgraduate level, threat analysis must move beyond lists of attack types. It should examine adversary objectives, dependencies between attack stages, uncertainty in intelligence, defensive assumptions, and the organizational consequences of compromise.

Learning Objectives

After completing this chapter, the learner should be able to:

1. Distinguish threat actors, assets, vulnerabilities, exploits, events, and risks.
2. Apply the cyber kill chain and MITRE ATT&CK as complementary analytical frameworks.
3. Explain reconnaissance, spoofing, sniffing, malware, denial-of-service, session attacks, and social engineering.
4. Describe the vulnerability lifecycle and evaluate vulnerability-management decisions.
5. Construct and interpret basic attack graphs and threat models.
6. Explain the role, lifecycle, and limitations of cyber-threat intelligence.
7. Analyse a realistic attack scenario and recommend layered controls.
8. Evaluate ethical, legal, governance, and operational implications of defensive decisions.

1. Threat Actors, Assets and the Risk Relationship

1.1 Threat actors

A threat actor is an individual, group, organization, or state capable of conducting malicious activity. Common categories include:

These categories are not mutually exclusive. A criminal group may use political rhetoric, an insider may cooperate with an external actor, and a state may use criminal infrastructure to conceal attribution.

1.2 Assets and attack surfaces

An asset is anything that has value or requires protection. Examples include data, credentials, applications, devices, services, intellectual property, operational technology, reputation, and human safety. The attack surface is the collection of reachable interfaces, technologies, people, processes, and relationships through which an asset may be attacked.

Attack surfaces have expanded through cloud services, remote work, application programming interfaces, mobile devices, Internet of Things devices, software dependencies, and third-party providers. Security analysis must therefore include not only internal networks but also identity providers, contractors, managed services, repositories, build pipelines, and physical access points.

1.3 Threat, vulnerability, exploit and risk

A vulnerability can be technical, procedural, organizational, or human. Examples include an unpatched service, excessive privileges, an insecure default, poor password recovery, inadequate logging, or insufficient employee awareness.

An exploit is a method, code, or sequence of actions that takes advantage of a vulnerability. A threat event is an occurrence that may cause harm, while an incident is a security event that has been assessed as violating or threatening security policy.

A common qualitative risk model is:

Likelihood represents the probability or credible frequency of an adverse event, and impact represents the magnitude of resulting harm. This expression is a decision aid rather than a universal physical law. It assumes that the organization can assess likelihood and impact on comparable ordinal or quantitative scales. Multiplying arbitrary scores does not create objective probability; the scoring method, assumptions, and uncertainty must be documented.

A more detailed decomposition may consider threat capability, exposure, vulnerability exploitability, control effectiveness, and consequence. In practice, risk assessments often use ordinal categories such as low, moderate, and high because precise probabilities are unavailable.

2. Attack Methodologies and the Cyber Kill Chain

An attack methodology describes how an adversary organizes activity to achieve an objective. A useful analysis distinguishes the adversary’s goal from the observable technique used to reach it.

The Lockheed Martin Cyber Kill Chain is a linear model containing seven stages:

1. Reconnaissance – identifying targets, personnel, systems, and information.
2. Weaponization – preparing a malicious payload or delivery mechanism.
3. Delivery – transmitting the payload through email, websites, removable media, or other channels.
4. Exploitation – triggering a vulnerability or persuading a user to execute an action.
5. Installation – establishing malware or another persistent mechanism.
6. Command and control – communicating with infrastructure controlled by the adversary.
7. Actions on objectives – theft, disruption, fraud, espionage, or destruction.

The model encourages “break-the-chain” defense. For example, secure email controls may reduce delivery, patching may reduce exploitation, application allow-listing may reduce installation, and network monitoring may detect command and control.

Its limitations are equally important. Real attacks are not always linear. Adversaries may begin with stolen credentials, return to reconnaissance after gaining access, skip weaponization, or conduct several stages simultaneously. The model is therefore best used as a communication and control-mapping framework rather than as a complete representation of adversary behavior.

3. MITRE ATT&CK as a Behavioural Knowledge Base

MITRE ATT&CK organizes observed adversary behavior into tactics, techniques, and sub-techniques. Tactics describe why an adversary acts, such as reconnaissance, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, command and control, exfiltration, and impact. Techniques describe how a tactic may be achieved.

For example, phishing may support initial access; valid accounts may support persistence or lateral movement; operating-system discovery may support discovery; and data encrypted for impact may support disruption. A single technique can serve multiple tactical purposes depending on context.

ATT&CK is useful for:

• translating incident observations into a common vocabulary;
• mapping detection rules and security controls;
• identifying gaps in telemetry;
• organizing threat-hunting hypotheses;
• comparing adversary groups by behavior; and
• designing adversary-emulation exercises.

ATT&CK is not a checklist proving that an organization is secure. Technique presence does not establish attribution, and technique absence in logs does not establish that an action did not occur. The framework also evolves as research produces new evidence. Analysts must record confidence, source quality, time, and alternative explanations.

The kill chain emphasizes sequential disruption; ATT&CK emphasizes detailed behaviors and alternative paths. They can be combined: kill-chain stages provide a high-level narrative, while ATT&CK techniques provide operational detail.

4. Reconnaissance and Initial Access

Reconnaissance is the collection and analysis of information before or during an intrusion. Passive reconnaissance uses publicly available information without directly interacting with the target, including websites, public records, job advertisements, code repositories, metadata, breach disclosures, and social-media profiles. Active reconnaissance directly probes systems, domains, services, or applications and is more likely to generate evidence or violate policy.

Defenders should conduct authorized attack-surface discovery of their own assets, remove unnecessary exposure, protect employee information, monitor domain impersonation, and establish rules for external scanning. Organizations should avoid publishing sensitive architecture details, credentials, internal hostnames, or personal information without a legitimate purpose.

Common initial-access paths include:

• phishing and business email compromise;
• exploitation of public-facing applications;
• stolen or guessed credentials;
• compromised suppliers and software updates;
• malicious removable media;
• exposed remote-management services; and
• abuse of legitimate cloud or identity services.

The most effective control is rarely a single technology. Identity assurance, secure configuration, patch management, user verification procedures, segmentation, and detection must operate together.

5. Spoofing, Sniffing and Interception

5.1 Spoofing

Spoofing is the impersonation of a trusted identity, address, service, or source. Examples include email-address spoofing, domain impersonation, caller-ID manipulation, IP-address spoofing, ARP spoofing, DNS manipulation, and fraudulent login pages.

Spoofing attacks exploit assumptions about identity. Defenses should therefore validate identity cryptographically or through independent channels. Relevant measures include authenticated protocols, certificate validation, secure DNS practices, email authentication mechanisms such as SPF, DKIM, and DMARC, mutual authentication where appropriate, network segmentation, and user procedures for verifying unusual requests.

Source-address filtering can reduce certain forms of IP spoofing, but it does not authenticate the sender of an application message. A message that appears to originate from a permitted address may still be malicious if an account or application has been compromised.

5.2 Sniffing and interception

Sniffing is the capture and analysis of network traffic. On a shared or poorly protected network, an attacker may observe credentials, session identifiers, personal information, or application content. Passive sniffing listens to traffic; active interception may manipulate routing, perform a man-in-the-middle attack, or inject data.

Encryption in transit reduces the value of captured traffic, but only when correctly implemented. Secure transport requires authenticated endpoints, current cryptographic protocols, valid certificate chains, protection against downgrade, and careful handling of keys. Encryption does not prevent traffic analysis, endpoint compromise, malicious insiders with legitimate access, or an attacker who controls a trusted endpoint.

6. Malware and Malicious Code

Malware is software or firmware designed to perform unauthorized or harmful actions. Important categories include:

• Virus: code that attaches to a host and replicates when the host is executed.
• Worm: malware that propagates between systems, often without requiring a user to run an infected file.
• Trojan: software that appears legitimate while performing hidden malicious actions.
• Ransomware: malware that denies access to data or systems, commonly through encryption or destruction, in exchange for payment or other demands.
• Spyware: software that collects information covertly.
• Rootkit: mechanisms designed to hide malicious activity or maintain privileged control.
• Botnet malware: code that places a device under remote control as part of a larger network.
• Fileless or living-off-the-land activity: abuse of legitimate tools and memory-resident execution to reduce reliance on conventional files.

Malware analysis may be static, dynamic, or hybrid. Static analysis examines code, metadata, signatures, and structure without execution. Dynamic analysis observes behavior in a controlled environment. Sandboxing is useful but imperfect because sophisticated malware may detect analysis environments or delay execution.

Defensive measures include application control, endpoint detection and response, least privilege, secure backups, behavioral monitoring, vulnerability remediation, macro and script restrictions, network segmentation, and tested recovery procedures. Backups must be logically separated and periodically restored in order to be reliable against ransomware.

7. Denial-of-Service and Availability Attacks

A denial-of-service attack attempts to reduce or eliminate availability. A distributed denial-of-service attack uses many sources, often compromised devices or rented infrastructure. Attacks may exhaust bandwidth, connection state, CPU, memory, application threads, database capacity, or an expensive business function.

The impact of an availability attack depends on architecture and bottlenecks. A high-volume network flood may be absorbed by a provider, while a much smaller application-layer request rate may exhaust a database. Defenses include capacity planning, rate limiting, caching, filtering, resilient architecture, autoscaling with cost controls, upstream mitigation, anycast or distributed delivery, graceful degradation, and incident communication.

Availability risk should be assessed against recovery objectives. The recovery time objective (RTO) is the target time within which a service should be restored. The recovery point objective (RPO) is the maximum tolerable period of data loss measured in time. These are business requirements, not merely technical settings.

8. Session Attacks and Identity Abuse

A session represents an authenticated interaction between a client and a service. Session attacks include session hijacking, session fixation, replay, credential theft, token theft, and cross-site request forgery.

A secure session design should use unpredictable, sufficiently long session identifiers; transport protection; secure, HttpOnly, and appropriately scoped cookies; session expiration; reauthentication for sensitive actions; rotation after authentication or privilege change; server-side invalidation; and monitoring for anomalous use. Tokens should have limited scope and lifetime. Long-lived bearer tokens are convenient but dangerous because possession may be sufficient for access.

Cross-site request forgery abuses a victim’s authenticated browser to submit an unwanted request. Anti-CSRF tokens, same-site cookie controls, origin checks, and appropriate API authentication patterns reduce this risk. Cross-site scripting can steal sessions or perform actions in a user’s context; output encoding, contextual input handling, content security policy, and secure development practices are relevant countermeasures.

Multi-factor authentication reduces the value of stolen passwords but does not eliminate session theft, phishing-resistant authentication failures, malicious consent grants, or compromised endpoints. Hardware-backed, phishing-resistant methods are generally stronger than one-time codes delivered through easily intercepted channels.

9. Social Engineering

Social engineering manipulates human judgment rather than relying exclusively on a software flaw. It may involve authority, urgency, scarcity, fear, familiarity, reciprocity, or technical confusion. Forms include phishing, spear phishing, vishing, smishing, pretexting, baiting, tailgating, and business email compromise.

Awareness training alone is insufficient. Effective programs combine training with process and technical controls: payment verification through independent channels, dual authorization, strong identity controls, email authentication, browser isolation, reporting mechanisms, safe defaults, and a non-punitive culture that encourages rapid reporting.

A mature organization measures reporting speed, verification behavior, response quality, and control effectiveness rather than simply counting failed simulations. Simulations must be lawful, proportionate, transparent to governance bodies, and designed not to humiliate employees or collect unnecessary personal data.

10. Vulnerability Lifecycle and Remediation

The vulnerability lifecycle includes discovery, validation, disclosure, prioritization, remediation, verification, monitoring, and retirement or acceptance. Vulnerabilities may be discovered internally, reported by researchers, identified by vendors, or observed during exploitation.

A responsible disclosure process provides a communication channel, scope, response expectations, coordination procedures, and recognition policy. Organizations should avoid suppressing good-faith research while protecting sensitive information and affected users.

Prioritization should consider more than a severity score. Relevant factors include exploitability, exposure, asset criticality, business impact, threat intelligence, availability of compensating controls, exploit maturity, and whether exploitation is occurring in the wild. A critical vulnerability on an isolated, unused system may be less urgent than a moderate vulnerability on an Internet-facing identity service.

A practical lifecycle is:

1. Discover assets and vulnerabilities.
2. Validate findings and eliminate false positives.
3. Classify affected assets and business services.
4. Prioritize using risk and threat context.
5. Remediate through patching, configuration, replacement, isolation, or compensating controls.
6. Test that the vulnerability is closed.
7. Monitor for recurrence and newly disclosed variants.
8. Record residual risk and ownership.

Patch management has operational risks. Changes can interrupt services or introduce incompatibilities. Risk-based emergency change procedures, testing, rollback plans, and accurate asset inventories are therefore essential.

11. Attack Graphs and Threat Modeling

An attack graph represents possible paths from an attacker’s initial position to a target condition. Nodes may represent system states, privileges, credentials, or assets; edges represent actions or prerequisites. Attack graphs reveal that several individually moderate weaknesses may combine into a severe path.

For example, a public web flaw may permit application access; application access may expose a service account; the service account may access an internal file share; and a misconfiguration may permit privilege escalation. Defending only the final target misses opportunities to break earlier dependencies.

Threat modeling applies structured reasoning during design and change management. Common approaches include:

• STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
• PASTA: a risk-centric, attack-oriented process linking business impact to technical analysis.
• Attack trees: hierarchical decomposition of an attacker’s goal into alternative subgoals.
• Data-flow diagrams: representations of processes, data stores, trust boundaries, and communication flows.
• Abuse and misuse cases: descriptions of how legitimate functions may be deliberately misused.

Threat modeling should identify assets, trust boundaries, assumptions, adversaries, abuse cases, controls, residual risks, and verification activities. It is not a one-time workshop. Architecture changes, new suppliers, new data uses, and newly discovered attack techniques require reassessment.

12. Cyber-Threat Intelligence

Cyber-threat intelligence is information about threats that has been collected, processed, evaluated, and interpreted to support decisions. It differs from raw data. An IP address observed in a report becomes useful intelligence only when its relevance, confidence, timing, context, and recommended action are understood.

Intelligence is commonly discussed at four levels:

• Strategic: trends, geopolitical developments, business risk, and executive decisions.
• Operational: campaigns, threat groups, targeting, objectives, and likely timelines.
• Tactical: techniques, procedures, malware behavior, and defensive opportunities.
• Technical: indicators such as domains, hashes, addresses, and file characteristics.

The intelligence cycle includes direction, collection, processing, analysis, dissemination, and feedback. Collection should begin with questions: Which assets are likely to be targeted? Which techniques threaten our identity infrastructure? Which vulnerabilities are being actively exploited? Without such questions, organizations may accumulate indicators that create workload but little protection.

Indicators decay. A domain may be abandoned, a hash may change, or an address may be shared by benign services. Intelligence must therefore include provenance, confidence, timestamp, sighting context, and expiration or review conditions. Automated feeds can accelerate blocking, but automation may cause false positives, business interruption, or adversary adaptation.

13. Applied Case: Illustrative Manufacturing Ransomware Scenario

Background

A medium-sized manufacturer operates an enterprise network, cloud email, remote-access services, and a production environment. Employees regularly receive invoices and engineering documents from suppliers. The organization has endpoint protection but incomplete asset inventory, inconsistent multifactor authentication, and backups connected to the production domain.

Problem

An employee receives a convincing supplier-themed message and opens a document. A stolen password is used against a remote-access portal. The attacker discovers file servers, moves laterally using excessive privileges, disables selected security tools, and encrypts shared data. Production stops because engineering and scheduling files are unavailable.

Analysis

The scenario contains several linked weaknesses:

• reconnaissance through supplier relationships and public information;
• social engineering and malicious document delivery;
• credential theft and insufficient authentication assurance;
• excessive privileges and weak segmentation;
• inadequate monitoring of lateral movement;
• insufficiently isolated backups; and
• limited recovery testing.

The kill chain identifies multiple interruption points. ATT&CK-style analysis would map phishing, valid-account use, discovery, lateral movement, defense evasion, and impact behaviors. An attack graph shows that removing any one of several dependencies—strong authentication, privilege separation, segmentation, or protected backups—could reduce the final impact.

Approach and solution

The organization should first preserve evidence, isolate affected systems, disable compromised accounts, and activate its incident-response and business-continuity plans. It should avoid destroying forensic data or immediately reconnecting unverified systems.

Longer-term measures include phishing-resistant multifactor authentication for remote access, privileged-access management, network separation between office and production systems, application control, centralized logging, tested offline or immutable backups, supplier verification procedures, rapid patching of exposed services, and exercises involving technical and executive teams.

Outcome

Assuming these controls are implemented and tested, a future compromise may still occur, but the attacker is less likely to obtain broad privileges or destroy recovery resources. Detection should occur earlier, restoration should be faster, and production impact should be reduced.

Learning points

1. Security failure usually results from a chain of conditions rather than one defective product.
2. Identity, segmentation, backups, and monitoring must be treated as interdependent controls.
3. Threat intelligence is valuable when it changes a decision or improves detection.
4. Recovery capability is part of security, not an afterthought.
5. Incident response must balance containment with evidence preservation and operational continuity.

14. Governance, Ethics and Contemporary Developments

Security testing, scanning, red teaming, and deception must have authorization, defined scope, safety controls, and data-protection safeguards. Unauthorized testing can be illegal even when intentions are defensive. Organizations should document ownership, consent, retention, disclosure, and escalation procedures.

Privacy is relevant to monitoring, user behavior analytics, threat hunting, and insider-risk programs. Proportionality, purpose limitation, access control, retention limits, transparency, and independent oversight help prevent security controls from becoming unjustified surveillance.

Artificial intelligence is increasingly used for phishing generation, vulnerability discovery, malware variation, anomaly detection, alert triage, and analyst assistance. It can improve speed but also introduce hallucinated conclusions, biased prioritization, data leakage, adversarial manipulation, and automation errors. Human review, provenance, testing, access restrictions, and clearly defined accountability remain necessary.

Contemporary defensive practice emphasizes zero-trust principles, identity-centric controls, software supply-chain security, secure-by-design development, cloud workload protection, continuous exposure management, and resilience engineering. These approaches do not eliminate threats; they reduce implicit trust, limit blast radius, increase observability, and improve recovery.

Best-Practice Checklist

• Maintain an accurate inventory of assets, identities, services, and dependencies.
• Classify assets by business criticality and sensitivity.
• Apply least privilege and separate administrative functions.
• Require strong, preferably phishing-resistant, authentication for high-risk access.
• Patch exposed and actively exploited vulnerabilities rapidly.
• Segment networks and restrict unnecessary east-west movement.
• Collect useful, time-synchronized logs and protect their integrity.
• Test backups, restoration, incident response, and crisis communication.
• Map defenses and detections to observed adversary behaviors.
• Use threat intelligence to answer defined operational questions.
• Conduct authorized threat modeling whenever architecture or business use changes.
• Measure resilience, detection, containment, and recovery—not only prevention.

Chapter Summary

Threats arise from actors and conditions capable of harming assets; vulnerabilities are weaknesses; exploits are methods of taking advantage of those weaknesses; and risk reflects likely harm and consequence. Attack analysis benefits from both the cyber kill chain, which emphasizes interruption across an attack sequence, and MITRE ATT&CK, which provides a detailed behavioral vocabulary.

Reconnaissance, spoofing, sniffing, malware, denial-of-service, session abuse, and social engineering exploit different technical and human assumptions. Effective defense is layered and combines secure design, identity assurance, segmentation, patching, monitoring, user processes, and tested recovery.

The vulnerability lifecycle requires discovery, validation, prioritization, remediation, verification, and continuous monitoring. Attack graphs and threat modeling expose dependencies and alternative paths. Cyber-threat intelligence becomes valuable when evaluated, contextualized, and connected to decisions. Finally, ethical authorization, privacy, governance, and human accountability are essential to responsible security practice.

Key Terms

Threat actor: An entity capable of conducting malicious or harmful activity.

Asset: Something valuable or requiring protection.

Vulnerability: A weakness that may be exploited.

Exploit: A method or code used to take advantage of a vulnerability.

Attack surface: The reachable interfaces and conditions through which attack may occur.

Risk: The possibility and consequence of harm.

Reconnaissance: Collection of information about a target.

Spoofing: Impersonation of a trusted identity, source, or service.

Sniffing: Capturing and analyzing network traffic.

Malware: Software or firmware designed for unauthorized or harmful activity.

Ransomware: Malware that denies access to data or systems for extortion or impact.

Denial-of-service: An attack against availability.

Session hijacking: Unauthorized takeover of an authenticated session.

Social engineering: Manipulation of people to obtain access or cause an action.

Cyber kill chain: A staged model of adversary activity.

MITRE ATT&CK: A knowledge base of observed adversary tactics and techniques.

Attack graph: A representation of possible paths from attacker position to target state.

Threat modeling: Structured identification and analysis of threats during system design or operation.

Cyber-threat intelligence: Evaluated threat information used to support decisions.

Residual risk: Risk remaining after controls are applied.

Review Questions

Short Answer Questions

1. Distinguish a threat, vulnerability, exploit, and risk.
2. What are the seven stages of the cyber kill chain?
3. Why is ATT&CK not a checklist proving that an organization is secure?
4. State two differences between passive and active reconnaissance.
5. Why are tested backups important in ransomware defense?

Long Answer Questions

1. Compare the cyber kill chain and MITRE ATT&CK, including their strengths and limitations.
2. Explain how spoofing and sniffing attacks work and discuss appropriate controls.
3. Describe the vulnerability lifecycle from discovery through verification and residual-risk management.
4. Explain how social engineering defeats purely technical security controls.
5. Discuss how attack graphs and threat modeling support secure architecture.

Analytical / Application Questions

1. An organization has a public remote-access portal, reused administrator passwords, flat network architecture, and backups connected to the domain. Construct a qualitative attack path and recommend controls that would break it at multiple points.
2. A threat-intelligence feed reports an IP address associated with malicious activity six months ago. Explain what evidence and context should be evaluated before blocking it.
3. Design an incident-response and resilience strategy for a business email compromise that may have exposed credentials and enabled fraudulent payments. Include technical, procedural, legal, and communication considerations.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes a vulnerability from an exploit?

A. A vulnerability is a weakness; an exploit is a method used to take advantage of it.

B. A vulnerability is always an attack; an exploit is always a security control.

C. A vulnerability describes impact; an exploit describes asset value.

D. A vulnerability is a threat actor; an exploit is a business process.

Correct Answer: A. A vulnerability is a weakness; an exploit is a method used to take advantage of it.

Question 2

Which framework primarily organizes observed adversary behavior into tactics, techniques, and sub-techniques?

A. STRIDE

B. MITRE ATT&CK

C. The CIA triad

D. The recovery lifecycle

Correct Answer: B. MITRE ATT&CK

Question 3

Which cyber kill-chain stage involves establishing malicious software or another persistent mechanism on a target?

A. Reconnaissance

B. Delivery

C. Installation

D. Actions on objectives

Correct Answer: C. Installation

Question 4

Which control most directly reduces the risk that a stolen password alone can authenticate to a remote-access portal?

A. Network address translation

B. Multifactor authentication

C. Increasing screen brightness

D. Deleting archived logs

Correct Answer: B. Multifactor authentication

Question 5

What is the principal purpose of an attack graph?

A. To calculate encryption key length

B. To represent possible paths from an attacker’s position to a target state

C. To replace all vulnerability scanning

D. To identify employee salaries

Correct Answer: B. To represent possible paths from an attacker’s position to a target state

Question 6

Which statement about cyber-threat intelligence is most accurate?

A. Every indicator remains reliable indefinitely.

B. Raw data becomes intelligence when evaluated and placed in decision-relevant context.

C. Technical indicators are always more valuable than strategic analysis.

D. Threat intelligence eliminates the need for monitoring.

Correct Answer: B. Raw data becomes intelligence when evaluated and placed in decision-relevant context.

Question 7

Which attack primarily targets service availability?

A. Denial-of-service

B. Credential stuffing

C. Data classification

D. Certificate enrollment

Correct Answer: A. Denial-of-service

Question 8

Which practice best protects against destructive ransomware affecting both production systems and backups?

A. Keeping all backups continuously writable from the production domain

B. Using isolated or immutable backups and regularly testing restoration

C. Disabling recovery exercises

D. Using one shared administrator account

Correct Answer: B. Using isolated or immutable backups and regularly testing restoration

Question 9

Why can a high vulnerability-severity score alone be insufficient for remediation prioritization?

A. Severity scores never describe technical weaknesses.

B. Prioritization also depends on exposure, asset criticality, exploit activity, and compensating controls.

C. Severity scores apply only to physical locks.

D. High scores automatically prove exploitation.

Correct Answer: B. Prioritization also depends on exposure, asset criticality, exploit activity, and compensating controls.

Question 10

Which is an example of passive reconnaissance?

A. Sending packets to enumerate open ports

B. Attempting password authentication against a portal

C. Reviewing publicly available company documents and job postings

D. Exploiting a public-facing application

Correct Answer: C. Reviewing publicly available company documents and job postings