What types of attacks are phishing, spear phishing, vishing, scareware, and watering hole?
Answer(s): C
Social engineering exploits human psychology to manipulate individuals into divulging sensitive information, granting access, or performing actions that compromise security. Unlike technical exploits, it targets the "human factor," often bypassing technical defenses. The listed attacks fit this category:Phishing: Mass, untargeted emails (e.g., fake bank alerts) trick users into entering credentials on spoofed sites. Uses tactics like urgency or trust (e.g., typosquatting domains). Spear Phishing: Targeted phishing against specific individuals/organizations (e.g., CEO fraud), leveraging reconnaissance (e.g., LinkedIn data) for credibility. Vishing (Voice Phishing): Phone-based attacks (e.g., fake tech support calls) extract info via verbal manipulation. Often spoofs caller ID.Scareware: Fake alerts (e.g., "Your PC is infected!" pop-ups) scare users into installing malware or paying for bogus fixes. Exploits fear and urgency.Watering Hole: Compromises trusted websites frequented by a target group (e.g., industry forums), infecting visitors via drive-by downloads. Relies on habitual trust.Technical Details:Delivery: Email (phishing), VoIP (vishing), web (watering hole/scareware). Payloads: Credential theft, malware (e.g., trojans), or financial fraud. Mitigation: User training, email filters (e.g., DMARC), endpoint protection. Security Implications: Social engineering accounts for ~90% of breaches (e.g., Verizon DBIR 2023), as it exploits unpatchable human error. CNSP likely emphasizes awareness (e.g., phishing simulations) and layered defenses (e.g., MFA).Why other options are incorrect:A . Probes: Reconnaissance techniques (e.g., port scanning) to identify vulnerabilities, not manipulation-based like these attacks.B . Insider threats: Malicious actions by authorized users (e.g., data theft by employees), not external human-targeting tactics.D . Ransomware: A malware type (e.g., WannaCry) that encrypts data for ransom, not a manipulation method--though phishing often delivers it.Real-World Context: The 2016 DNC hack used spear phishing to steal credentials, showing social engineering's potency.
CNSP Official Study Guide (Social Engineering Threats); NIST SP 800-50 (Security Awareness Training).
Which of the following is an example of a SUID program?
In Linux/Unix, the SUID (Set User ID) bit allows a program to execute with the owner's permissions, typically root, rather than the caller's. It's denoted by an s in the user execute field (e.g., -rwsr-xr-x). Common SUID programs perform privileged tasks requiring temporary elevation.Analysis:C . /usr/bin/passwd:Purpose: Updates user passwords in /etc/shadow (root-owned, 0600 perms). Permissions: Typically -rwsr-xr-x, owned by root. The SUID bit lets non-root users modify shadow securely.Command: ls -l /usr/bin/passwd confirms SUID (s in user execute).A . /bin/ls:Purpose: Lists directory contents, no privileged access needed. Permissions: -rwxr-xr-x (no SUID). Runs as the calling user.B . /usr/bin/curl:Purpose: Transfers data over HTTP/FTP, no root privileges required by default.Permissions: -rwxr-xr-x (no SUID).Technical Details:SUID Bit: Set via chmod u+s <file> or chmod 4755.Security: SUID binaries are audited (e.g., find / -perm -u=s) due to escalation risks if writable or poorly coded (e.g., buffer overflows).Security Implications: CNSP likely highlights SUID as an attack vector (e.g., CVE-1996-0095 exploited passwd flaws). Hardening removes unnecessary SUID bits.Why other options are incorrect:A, B: Lack SUID; no privileged operations.D: Incorrect, as /usr/bin/passwd is a SUID example.Real-World Context: SUID on /bin/su or /usr/bin/sudo similarly enables privilege escalation, often targeted in exploits.
CNSP Official Documentation (Linux Security); Linux File Permissions Guide.
Which of the following services do not encrypt its traffic by default?
Answer(s): A
Encryption ensures confidentiality and integrity of network traffic. Analyzing defaults:A . DNS (Domain Name System):Default: Unencrypted (UDP/TCP 53), per RFC 1035. Queries/responses (e.g., "google.com 142.250.190.14") are plaintext.Modern Options: DNS over HTTPS (DoH, TCP 443) or DNS over TLS (DoT, TCP 853) encrypt, but aren't default in most systems (e.g., pre-2020 Windows).B . SSH (Secure Shell):Default: Encrypted (TCP 22), per RFC 4251. Uses asymmetric (e.g., RSA) and symmetric (e.g., AES) crypto for all sessions.C . FTPS (FTP Secure):Default: Encrypted (TCP 21 control, dynamic data ports). Extends FTP with SSL/TLS (e.g., RFC 4217), securing file transfers.Technical Details:DNS: Plaintext exposes queries to eavesdropping (e.g., ISP snooping) or spoofing (e.g., cache poisoning).SSH/FTPS: Encryption is baked into their standards; disabling it requires explicit misconfiguration. Security Implications: Unencrypted DNS risks privacy and integrity (e.g., Kaminsky attack). CNSP likely pushes DoH/DoT adoption.Why other options are incorrect:B, C: Encrypt by default.D: False, as only DNS lacks default encryption.Real-World Context: The 2013 Snowden leaks exposed DNS monitoring; DoH uptake (e.g., Cloudflare1.1.1.1) counters this.
CNSP Official Study Guide (Protocol Security); RFC 1035 (DNS), RFC 4251 (SSH).
Which SMB (Server Message Block) network protocol versions are vulnerable to the EternalBlue (MS17-010) Windows exploit?
EternalBlue (MS17-010) is an exploit targeting a buffer overflow in Microsoft's SMB (Server Message Block) implementation, leaked by the Shadow Brokers in 2017. SMB enables file/printer sharing:SMBv1 (1980s): Legacy, used in Windows NT/XP.SMBv2 (2006, Vista): Enhanced performance/security.SMBv3 (2012, Windows 8): Adds encryption, multichannel.Vulnerability:EternalBlue exploits a flaw in SMBv1's SRVNET driver (srv.sys), allowing remote code execution via crafted packets. Microsoft patched it in March 2017 (MS17-010). Affected OS: Windows XP to Server 2016 (pre-patch), if SMBv1 enabled. Proof: WannaCry/NotPetya used it, targeting port 445/TCP.Version Scope:SMBv1 Only: The bug resides in SMBv1's packet handling (e.g., TRANS2 requests). SMBv2/v3 rewrote this code, immune to the specific overflow.Microsoft: Post-patch, SMBv1 is disabled by default (Windows 10 1709+). Security Implications: CNSP likely stresses disabling SMBv1 (e.g., via Group Policy) and patching, as EternalBlue remains a threat in legacy environments.Why other options are incorrect:B, C: SMBv2/v3 aren't vulnerable; the flaw is SMBv1-specific.D: SMBv2 isn't affected, only SMBv1.Real-World Context: WannaCry's 2017 rampage hit unpatched SMBv1 systems (e.g., NHS), costing billions.
CNSP Official Documentation (Windows Exploits); Microsoft MS17-010 Bulletin.
What RID is given to an Administrator account on a Microsoft Windows machine?
Answer(s): B
In Windows, security principals (users, groups) are identified by a Security Identifier (SID), formatted as S-1-<authority>-<domain>-<RID>. The RID (Relative Identifier) is the final component, unique within a domain or machine. For local accounts:RID 500: Assigned to the built-in Administrator account on every Windows machine (e.g., S-1-5-21- <machine>-500).Created during OS install, with full system privileges. Disabled by default in newer Windows versions (e.g., 10/11) unless explicitly enabled. RID 501: Guest account (e.g., S-1-5-21-<machine>-501), limited access.Technical Details:Stored in SAM (C:\Windows\System32\config\SAM).Enumeration: Tools like wmic useraccount or net user reveal RIDs. Domain Context: Domain Admins use RID 512, but the question specifies a local machine. Security Implications: RID 500 is a prime target for brute-forcing or pass-the-hash attacks (e.g., Mimikatz). CNSP likely advises renaming/disabling it (e.g., via GPO).Why other options are incorrect:A . 0: Reserved (e.g., Null SID, S-1-0-0), not a user RID.C . 501: Guest, not Administrator.D . 100: Invalid; local user RIDs start at 1000 (e.g., custom accounts). Real-World Context: Post-compromise, attackers query RID 500 (e.g., net user Administrator) for privilege escalation.
CNSP Official Study Guide (Windows Security); Microsoft SID Documentation.
Post your Comments and Discuss The SecOps Group CNSP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CNSP content, but please register or login to continue.