Threats & Attacks interview questions

1. A.corrupting DNS responses so a name resolves to an attacker-controlled IP address
2. B.tricking a logged-in user's browser into sending an unwanted authenticated request
3. C.channel an attacker uses to remotely direct compromised hosts after initial access
4. D.deceptive messages tricking users into revealing credentials or installing malware

Answer + AI explanation with Pro

1. A.Phishing
2. B.Spear phishing
3. C.Malware
4. D.Vishing

Answer + AI explanation with Pro

1. A.Phishing — deceptive messages tricking users into revealing credentials or installing malware
2. B.Phishing — authenticating by replaying a captured password hash without knowing the plaintext password
3. C.Phishing — hiding the true destination of traffic behind a trusted domain on a shared CDN to evade filtering
4. D.Phishing — stealthy, well-resourced adversary maintaining long-term unauthorized access to a network

Answer + AI explanation with Pro

1. A.malicious software such as viruses, worms, trojans, or spyware designed to harm or exploit systems
2. B.attack that overwhelms a system's resources to make it unavailable to legitimate users
3. C.targeted phishing crafted for a specific individual or organization using personalized details
4. D.Distributed Denial of Service using many compromised hosts to flood a target simultaneously

Answer + AI explanation with Pro

1. A.Malware
2. B.Domain fronting
3. C.Smishing
4. D.Lateral movement

Answer + AI explanation with Pro

1. A.Malware — tricking a logged-in user's browser into sending an unwanted authenticated request
2. B.Malware — requesting service tickets and cracking their encryption offline to recover service-account passwords
3. C.Malware — deceptive messages tricking users into revealing credentials or installing malware
4. D.Malware — malicious software such as viruses, worms, trojans, or spyware designed to harm or exploit systems

Answer + AI explanation with Pro

1. A.abusing legitimate built-in tools and binaries to evade detection during an attack
2. B.malware that encrypts a victim's data and demands payment for the decryption key
3. C.techniques an attacker uses to pivot from one compromised host to others inside a network
4. D.deceptive messages tricking users into revealing credentials or installing malware

Answer + AI explanation with Pro

1. A.Brute-force attack
2. B.DDoS
3. C.Ransomware
4. D.Tailgating

Answer + AI explanation with Pro

1. A.Ransomware — compromising a website a target group frequents to infect visitors with malware
2. B.Ransomware — malware that encrypts a victim's data and demands payment for the decryption key
3. C.Ransomware — attack that overwhelms a system's resources to make it unavailable to legitimate users
4. D.Ransomware — systematically trying many credentials or keys until the correct one is found

Answer + AI explanation with Pro

1. A.attack that overwhelms a system's resources to make it unavailable to legitimate users
2. B.social-engineering attack conducted over voice calls to extract information or credentials
3. C.manipulating people into divulging information or performing actions that weaken security
4. D.vulnerability unknown to the vendor and exploited before a patch is available

Answer + AI explanation with Pro

1. A.DDoS
2. B.Clickjacking
3. C.Denial of Service (DoS)
4. D.DNS spoofing

Answer + AI explanation with Pro

1. A.Denial of Service (DoS) — overlaying invisible UI to trick a user into clicking something different from what they perceive
2. B.Denial of Service (DoS) — attack that overwhelms a system's resources to make it unavailable to legitimate users
3. C.Denial of Service (DoS) — physically following an authorized person through a secured door to gain entry
4. D.Denial of Service (DoS) — compromising a trusted vendor, dependency, or build pipeline to reach downstream targets

Answer + AI explanation with Pro

1. A.Distributed Denial of Service using many compromised hosts to flood a target simultaneously
2. B.channel an attacker uses to remotely direct compromised hosts after initial access
3. C.manipulating people into divulging information or performing actions that weaken security
4. D.requesting service tickets and cracking their encryption offline to recover service-account passwords

Answer + AI explanation with Pro

1. A.Social engineering
2. B.DDoS
3. C.Clickjacking
4. D.Smishing

Answer + AI explanation with Pro

1. A.Social engineering — manipulating people into divulging information or performing actions that weaken security
2. B.Social engineering — physically following an authorized person through a secured door to gain entry
3. C.Social engineering — compromising a website a target group frequents to infect visitors with malware
4. D.Social engineering — authenticating by replaying a captured password hash without knowing the plaintext password

Answer + AI explanation with Pro

1. A.requesting service tickets and cracking their encryption offline to recover service-account passwords
2. B.stealthy, well-resourced adversary maintaining long-term unauthorized access to a network
3. C.hiding the true destination of traffic behind a trusted domain on a shared CDN to evade filtering
4. D.systematically trying many credentials or keys until the correct one is found

Answer + AI explanation with Pro

1. A.Privilege escalation
2. B.Brute-force attack
3. C.Kerberoasting
4. D.Command and Control (C2)

Answer + AI explanation with Pro

1. A.Brute-force attack — vulnerability unknown to the vendor and exploited before a patch is available
2. B.Brute-force attack — systematically trying many credentials or keys until the correct one is found
3. C.Brute-force attack — channel an attacker uses to remotely direct compromised hosts after initial access
4. D.Brute-force attack — attack that overwhelms a system's resources to make it unavailable to legitimate users

Answer + AI explanation with Pro

1. A.tricking a logged-in user's browser into sending an unwanted authenticated request
2. B.overlaying invisible UI to trick a user into clicking something different from what they perceive
3. C.attack that overwhelms a system's resources to make it unavailable to legitimate users
4. D.targeted phishing crafted for a specific individual or organization using personalized details

Answer + AI explanation with Pro

1. A.Command and Control (C2)
2. B.Cross-Site Request Forgery (CSRF)
3. C.Kerberoasting
4. D.Smishing

Answer + AI explanation with Pro

1. A.Cross-Site Request Forgery (CSRF) — tricking a logged-in user's browser into sending an unwanted authenticated request
2. B.Cross-Site Request Forgery (CSRF) — channel an attacker uses to remotely direct compromised hosts after initial access
3. C.Cross-Site Request Forgery (CSRF) — abusing legitimate built-in tools and binaries to evade detection during an attack
4. D.Cross-Site Request Forgery (CSRF) — hiding the true destination of traffic behind a trusted domain on a shared CDN to evade filtering

Answer + AI explanation with Pro

1. A.channel an attacker uses to remotely direct compromised hosts after initial access
2. B.Distributed Denial of Service using many compromised hosts to flood a target simultaneously
3. C.requesting service tickets and cracking their encryption offline to recover service-account passwords
4. D.intercepting and possibly altering communication between two parties who believe they talk directly

Answer + AI explanation with Pro

1. A.Business Email Compromise (BEC)
2. B.Cross-Site Request Forgery (CSRF)
3. C.Man-in-the-Middle (MitM)
4. D.Privilege escalation

Answer + AI explanation with Pro

1. A.Man-in-the-Middle (MitM) — phishing carried out via SMS text messages containing malicious links or requests
2. B.Man-in-the-Middle (MitM) — compromising a website a target group frequents to infect visitors with malware
3. C.Man-in-the-Middle (MitM) — stealthy, well-resourced adversary maintaining long-term unauthorized access to a network
4. D.Man-in-the-Middle (MitM) — intercepting and possibly altering communication between two parties who believe they talk directly

Answer + AI explanation with Pro

1. A.channel an attacker uses to remotely direct compromised hosts after initial access
2. B.attack that overwhelms a system's resources to make it unavailable to legitimate users
3. C.exploiting a flaw to gain higher permissions than originally granted
4. D.Distributed Denial of Service using many compromised hosts to flood a target simultaneously

Answer + AI explanation with Pro

1. A.Denial of Service (DoS)
2. B.Cross-Site Request Forgery (CSRF)
3. C.Command and Control (C2)
4. D.Privilege escalation

Answer + AI explanation with Pro

1. A.Privilege escalation — sending forged ARP messages to associate the attacker's MAC with another host's IP on a LAN
2. B.Privilege escalation — compromising a trusted vendor, dependency, or build pipeline to reach downstream targets
3. C.Privilege escalation — exploiting a flaw to gain higher permissions than originally granted
4. D.Privilege escalation — Distributed Denial of Service using many compromised hosts to flood a target simultaneously

Answer + AI explanation with Pro

1. A.manipulating people into divulging information or performing actions that weaken security
2. B.malicious software such as viruses, worms, trojans, or spyware designed to harm or exploit systems
3. C.malware that encrypts a victim's data and demands payment for the decryption key
4. D.Distributed Denial of Service using many compromised hosts to flood a target simultaneously

Answer + AI explanation with Pro

1. A.Zero-day
2. B.DDoS
3. C.Lateral movement
4. D.ARP spoofing

Answer + AI explanation with Pro

1. A.DDoS — Distributed Denial of Service using many compromised hosts to flood a target simultaneously
2. B.DDoS — vulnerability unknown to the vendor and exploited before a patch is available
3. C.DDoS — channel an attacker uses to remotely direct compromised hosts after initial access
4. D.DDoS — physically following an authorized person through a secured door to gain entry

Answer + AI explanation with Pro