CompTIA Security+ SY0-701 Indicators of Malicious Activity Practice Test

 

Topic 08 focuses on Indicators of Malicious Activity for the CompTIA Security+ certification and the SY0-701 exam, using practical cybersecurity scenarios aligned to the published Security+ objectives. For broader exam preparation, review the CompTIA Security+ SY0-701 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which term describes malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession?

1. DDoS amplification
2. Impossible travel
3. Ransomware
4. Virus

Correct Answer: C

 

Correct Answer

Answer C is correct because Ransomware means malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession.

Incorrect Answers

Answer A is incorrect because DDoS amplification would fit a different scenario. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

Answer B is incorrect because Impossible travel addresses a different requirement. Impossible travel refers to an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time.

Answer D is incorrect because Virus represents a different security function. Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed.

 

Question 2

To trick a user into executing harmful code disguised as something benign, which security approach should be selected?

1. Rootkit
2. Keylogger
3. Trojan
4. Password brute force

Correct Answer: C

 

Correct Answer

Answer C is correct because Trojan means malware that appears legitimate or useful but contains hidden malicious functionality.

Incorrect Answers

Answer A is incorrect because Rootkit would fit a different scenario. Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence.

Answer B is incorrect because Keylogger addresses a different security requirement. Keylogger refers to software or hardware that records keystrokes.

Answer D is incorrect because Password brute force addresses a different requirement. Password brute force refers to systematically trying many password candidates against an account or captured hash.

 

Question 3

Which term describes self-propagating malware that spreads between systems without requiring a user to copy each instance?

1. Worm
2. Spyware
3. Directory traversal
4. Privilege escalation

Correct Answer: A

 

Correct Answer

Answer A is correct because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance.

Incorrect Answers

Answer B is incorrect because Spyware addresses a different requirement. Spyware refers to malware designed to covertly collect information about users or systems.

Answer C is incorrect because Directory traversal would fit a different scenario. Directory traversal refers to manipulation of path input to access files or directories outside an intended location.

Answer D is incorrect because Privilege escalation represents a different security function. Privilege escalation refers to an attack that obtains permissions beyond those originally granted.

 

Question 4

To detect unauthorized monitoring and data collection, which security approach should be selected?

1. DDoS amplification
2. Worm
3. Missing logs
4. Spyware

Correct Answer: D

 

Correct Answer

Answer D is correct because Spyware means malware designed to covertly collect information about users or systems.

Incorrect Answers

Answer A is incorrect because DDoS amplification addresses a different requirement. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

Answer B is incorrect because Worm would fit a different scenario. Worm refers to self-propagating malware that spreads between systems without requiring a user to copy each instance.

Answer C is incorrect because Missing logs addresses a different security requirement. Missing logs refers to absence of expected telemetry or audit records.

 

Question 5

Which term describes malware that attaches to a host file or other object and replicates when the infected host is executed?

1. Virus
2. Password spraying
3. DDoS amplification
4. Out-of-cycle logging

Correct Answer: A

 

Correct Answer

Answer A is correct because Virus means malware that attaches to a host file or other object and replicates when the infected host is executed.

Incorrect Answers

Answer B is incorrect because Password spraying addresses a different requirement. Password spraying refers to trying a small number of common passwords across many accounts.

Answer C is incorrect because DDoS amplification represents a different security function. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

Answer D is incorrect because Out-of-cycle logging would fit a different scenario. Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns.

 

Question 6

To capture credentials or sensitive text entered by a user, which security approach should be selected?

1. Virus
2. Concurrent session anomaly
3. Privilege escalation
4. Keylogger

Correct Answer: D

 

Correct Answer

Answer D is correct because Keylogger means software or hardware that records keystrokes.

Incorrect Answers

Answer A is incorrect because Virus would fit a different scenario. Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed.

Answer B is incorrect because Concurrent session anomaly addresses a different security requirement. Concurrent session anomaly refers to unexpected simultaneous use of the same identity from different devices or locations.

Answer C is incorrect because Privilege escalation addresses a different requirement. Privilege escalation refers to an attack that obtains permissions beyond those originally granted.

 

Question 7

Which term describes malicious code that remains dormant until a specific condition, event, or time triggers execution?

1. Out-of-cycle logging
2. Logic bomb
3. Worm
4. Missing logs

Correct Answer: B

 

Correct Answer

Answer B is correct because Logic bomb means malicious code that remains dormant until a specific condition, event, or time triggers execution.

Incorrect Answers

Answer A is incorrect because Out-of-cycle logging represents a different security function. Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns.

Answer C is incorrect because Worm addresses a different requirement. Worm refers to self-propagating malware that spreads between systems without requiring a user to copy each instance.

Answer D is incorrect because Missing logs would fit a different scenario. Missing logs refers to absence of expected telemetry or audit records.

 

Question 8

To recognize stealthy persistence that manipulates or hides low-level system activity, which security approach should be selected?

1. Rootkit
2. Trojan
3. DDoS reflection
4. Directory traversal

Correct Answer: A

 

Correct Answer

Answer A is correct because Rootkit means malware designed to maintain privileged hidden access and conceal its presence.

Incorrect Answers

Answer B is incorrect because Trojan addresses a different security requirement. Trojan refers to malware that appears legitimate or useful but contains hidden malicious functionality.

Answer C is incorrect because DDoS reflection would fit a different scenario. DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing.

Answer D is incorrect because Directory traversal addresses a different requirement. Directory traversal refers to manipulation of path input to access files or directories outside an intended location.

 

Question 9

Which term describes copying or emulating data from an RFID credential?

1. Logic bomb
2. Directory traversal
3. Spyware
4. RFID cloning

Correct Answer: D

 

Correct Answer

Answer D is correct because RFID cloning means copying or emulating data from an RFID credential.

Incorrect Answers

Answer A is incorrect because Logic bomb would fit a different scenario. Logic bomb refers to malicious code that remains dormant until a specific condition, event, or time triggers execution.

Answer B is incorrect because Directory traversal addresses a different requirement. Directory traversal refers to manipulation of path input to access files or directories outside an intended location.

Answer C is incorrect because Spyware represents a different security function. Spyware refers to malware designed to covertly collect information about users or systems.

 

Question 10

To identify unusually large attack traffic generated from small spoofed requests, which security approach should be selected?

1. Birthday attack
2. Keylogger
3. DDoS reflection
4. DDoS amplification

Correct Answer: D

 

Correct Answer

Answer D is correct because DDoS amplification means a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

Incorrect Answers

Answer A is incorrect because Birthday attack addresses a different security requirement. Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.

Answer B is incorrect because Keylogger would fit a different scenario. Keylogger refers to software or hardware that records keystrokes.

Answer C is incorrect because DDoS reflection addresses a different requirement. DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing.

 

Question 11

What is a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing?

1. On-path attack
2. Spyware
3. Password brute force
4. DDoS reflection

Correct Answer: D

 

Correct Answer

Answer D is correct because DDoS reflection means a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing.

Incorrect Answers

Answer A is incorrect because On-path attack would fit a different scenario. On-path attack refers to an attack in which an adversary positions itself between communicating parties to observe or alter traffic.

Answer B is incorrect because Spyware addresses a different requirement. Spyware refers to malware designed to covertly collect information about users or systems.

Answer C is incorrect because Password brute force represents a different security function. Password brute force refers to systematically trying many password candidates against an account or captured hash.

 

Question 12

To disrupt or manipulate name resolution, which security approach should be selected?

1. Password spraying
2. Rootkit
3. DNS attack
4. Out-of-cycle logging

Correct Answer: C

 

Correct Answer

Answer C is correct because DNS attack means malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure.

Incorrect Answers

Answer A is incorrect because Password spraying would fit a different scenario. Password spraying refers to trying a small number of common passwords across many accounts.

Answer B is incorrect because Rootkit addresses a different requirement. Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence.

Answer D is incorrect because Out-of-cycle logging addresses a different security requirement. Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns.

 

Question 13

What is an attack in which an adversary positions itself between communicating parties to observe or alter traffic?

1. Rootkit
2. Injection attack
3. On-path attack
4. Missing logs

Correct Answer: C

 

Correct Answer

Answer C is correct because On-path attack means an attack in which an adversary positions itself between communicating parties to observe or alter traffic.

Incorrect Answers

Answer A is incorrect because Rootkit represents a different security function. Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence.

Answer B is incorrect because Injection attack would fit a different scenario. Injection attack refers to an application attack that causes untrusted input to be interpreted as commands, queries, or code.

Answer D is incorrect because Missing logs addresses a different requirement. Missing logs refers to absence of expected telemetry or audit records.

 

Question 14

To recognize successful access using previously captured authentication material, which security approach should be selected?

1. Worm
2. Credential replay
3. Virus
4. DDoS amplification

Correct Answer: B

 

Correct Answer

Answer B is correct because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system.

Incorrect Answers

Answer A is incorrect because Worm addresses a different requirement. Worm refers to self-propagating malware that spreads between systems without requiring a user to copy each instance.

Answer C is incorrect because Virus would fit a different scenario. Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed.

Answer D is incorrect because DDoS amplification addresses a different security requirement. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

 

Question 15

Which application attack causes untrusted input to be interpreted as commands, queries, or code?

1. Virus
2. Impossible travel
3. Injection attack
4. Directory traversal

Correct Answer: C

 

Correct Answer

Answer C is correct because Injection attack means an application attack that causes untrusted input to be interpreted as commands, queries, or code.

Incorrect Answers

Answer A is incorrect because Virus represents a different security function. Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed.

Answer B is incorrect because Impossible travel would fit a different scenario. Impossible travel refers to an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time.

Answer D is incorrect because Directory traversal addresses a different requirement. Directory traversal refers to manipulation of path input to access files or directories outside an intended location.

 

Question 16

To recognize movement from a lower-privilege context to higher authority, which security approach should be selected?

1. RFID cloning
2. Missing logs
3. Privilege escalation
4. DDoS amplification

Correct Answer: C

 

Correct Answer

Answer C is correct because Privilege escalation means an attack that obtains permissions beyond those originally granted.

Incorrect Answers

Answer A is incorrect because RFID cloning would fit a different scenario. RFID cloning refers to copying or emulating data from an RFID credential.

Answer B is incorrect because Missing logs addresses a different requirement. Missing logs refers to absence of expected telemetry or audit records.

Answer D is incorrect because DDoS amplification addresses a different security requirement. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

 

Question 17

Which term describes manipulation of path input to access files or directories outside an intended location?

1. DDoS amplification
2. Injection attack
3. Impossible travel
4. Directory traversal

Correct Answer: D

 

Correct Answer

Answer D is correct because Directory traversal means manipulation of path input to access files or directories outside an intended location.

Incorrect Answers

Answer A is incorrect because DDoS amplification addresses a different requirement. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

Answer B is incorrect because Injection attack would fit a different scenario. Injection attack refers to an application attack that causes untrusted input to be interpreted as commands, queries, or code.

Answer C is incorrect because Impossible travel represents a different security function. Impossible travel refers to an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time.

 

Question 18

To recognize negotiation manipulated toward weaker protection, which security approach should be selected?

1. Virus
2. Downgrade attack
3. Spyware
4. Ransomware

Correct Answer: B

 

Correct Answer

Answer B is correct because Downgrade attack means a cryptographic or protocol attack that forces use of a weaker version or less secure option.

Incorrect Answers

Answer A is incorrect because Virus would fit a different scenario. Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed.

Answer C is incorrect because Spyware addresses a different security requirement. Spyware refers to malware designed to covertly collect information about users or systems.

Answer D is incorrect because Ransomware addresses a different requirement. Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession.

 

Question 19

Which attack seeks two different inputs producing the same hash value?

1. DDoS amplification
2. Rootkit
3. Collision attack
4. Trojan

Correct Answer: C

 

Correct Answer

Answer C is correct because Collision attack means an attack that seeks two different inputs producing the same hash value.

Incorrect Answers

Answer A is incorrect because DDoS amplification addresses a different requirement. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

Answer B is incorrect because Rootkit represents a different security function. Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence.

Answer D is incorrect because Trojan would fit a different scenario. Trojan refers to malware that appears legitimate or useful but contains hidden malicious functionality.

 

Question 20

To recognize collision search based on probability rather than direct preimage recovery, which security approach should be selected?

1. Birthday attack
2. Password spraying
3. Collision attack
4. Injection attack

Correct Answer: A

 

Correct Answer

Answer A is correct because Birthday attack means a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.

Incorrect Answers

Answer B is incorrect because Password spraying would fit a different scenario. Password spraying refers to trying a small number of common passwords across many accounts.

Answer C is incorrect because Collision attack addresses a different security requirement. Collision attack refers to an attack that seeks two different inputs producing the same hash value.

Answer D is incorrect because Injection attack addresses a different requirement. Injection attack refers to an application attack that causes untrusted input to be interpreted as commands, queries, or code.

 

Question 21

Which term describes trying a small number of common passwords across many accounts?

1. Spyware
2. Password spraying
3. Injection attack
4. DDoS reflection

Correct Answer: B

 

Correct Answer

Answer B is correct because Password spraying means trying a small number of common passwords across many accounts.

Incorrect Answers

Answer A is incorrect because Spyware represents a different security function. Spyware refers to malware designed to covertly collect information about users or systems.

Answer C is incorrect because Injection attack would fit a different scenario. Injection attack refers to an application attack that causes untrusted input to be interpreted as commands, queries, or code.

Answer D is incorrect because DDoS reflection addresses a different requirement. DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing.

 

Question 22

To recover or guess a credential through exhaustive attempts, which security approach should be selected?

1. Password brute force
2. Collision attack
3. Concurrent session anomaly
4. DDoS amplification

Correct Answer: A

 

Correct Answer

Answer A is correct because Password brute force means systematically trying many password candidates against an account or captured hash.

Incorrect Answers

Answer B is incorrect because Collision attack addresses a different security requirement. Collision attack refers to an attack that seeks two different inputs producing the same hash value.

Answer C is incorrect because Concurrent session anomaly would fit a different scenario. Concurrent session anomaly refers to unexpected simultaneous use of the same identity from different devices or locations.

Answer D is incorrect because DDoS amplification addresses a different requirement. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

 

Question 23

Which identity-monitoring indicator in which successive logins originate from locations cannot realistically be traversed in the elapsed time?

1. Password spraying
2. Out-of-cycle logging
3. Privilege escalation
4. Impossible travel

Correct Answer: D

 

Correct Answer

Answer D is correct because Impossible travel means an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time.

Incorrect Answers

Answer A is incorrect because Password spraying represents a different security function. Password spraying refers to trying a small number of common passwords across many accounts.

Answer B is incorrect because Out-of-cycle logging addresses a different requirement. Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns.

Answer C is incorrect because Privilege escalation would fit a different scenario. Privilege escalation refers to an attack that obtains permissions beyond those originally granted.

 

Question 24

To detect possible account sharing or credential compromise, which security approach should be selected?

1. Concurrent session anomaly
2. RFID cloning
3. On-path attack
4. Spyware

Correct Answer: A

 

Correct Answer

Answer A is correct because Concurrent session anomaly means unexpected simultaneous use of the same identity from different devices or locations.

Incorrect Answers

Answer B is incorrect because RFID cloning addresses a different security requirement. RFID cloning refers to copying or emulating data from an RFID credential.

Answer C is incorrect because On-path attack addresses a different requirement. On-path attack refers to an attack in which an adversary positions itself between communicating parties to observe or alter traffic.

Answer D is incorrect because Spyware would fit a different scenario. Spyware refers to malware designed to covertly collect information about users or systems.

 

Question 25

Which term describes security-relevant activity recorded at an unusual time compared with normal operational patterns?

1. Rootkit
2. Virus
3. Birthday attack
4. Out-of-cycle logging

Correct Answer: D

 

Correct Answer

Answer D is correct because Out-of-cycle logging means security-relevant activity recorded at an unusual time compared with normal operational patterns.

Incorrect Answers

Answer A is incorrect because Rootkit addresses a different requirement. Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence.

Answer B is incorrect because Virus would fit a different scenario. Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed.

Answer C is incorrect because Birthday attack represents a different security function. Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.

 

Question 26

To recognize possible tampering, collection failure, or blind spots in monitoring, which security approach should be selected?

1. Missing logs
2. DDoS reflection
3. Password spraying
4. RFID cloning

Correct Answer: A

 

Correct Answer

Answer A is correct because Missing logs means absence of expected telemetry or audit records.

Incorrect Answers

Answer B is incorrect because DDoS reflection would fit a different scenario. DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing.

Answer C is incorrect because Password spraying addresses a different requirement. Password spraying refers to trying a small number of common passwords across many accounts.

Answer D is incorrect because RFID cloning addresses a different security requirement. RFID cloning refers to copying or emulating data from an RFID credential.

 

Question 27

To recognize extortion combined with loss of system or data access, which security approach should be selected?

1. Password spraying
2. Out-of-cycle logging
3. Ransomware
4. Spyware

Correct Answer: C

 

Correct Answer

Answer C is correct because Ransomware means malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession.

Incorrect Answers

Answer A is incorrect because Password spraying would fit a different scenario. Password spraying refers to trying a small number of common passwords across many accounts.

Answer B is incorrect because Out-of-cycle logging addresses a different security requirement. Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns.

Answer D is incorrect because Spyware represents a different security function. Spyware refers to malware designed to covertly collect information about users or systems.

 

Question 28

Which term describes malware that appears legitimate or useful but contains hidden malicious functionality?

1. Directory traversal
2. Virus
3. DNS attack
4. Trojan

Correct Answer: D

 

Correct Answer

Answer D is correct because Trojan means malware that appears legitimate or useful but contains hidden malicious functionality.

Incorrect Answers

Answer A is incorrect because Directory traversal addresses a different security requirement. Directory traversal refers to manipulation of path input to access files or directories outside an intended location.

Answer B is incorrect because Virus represents a different security function. Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed.

Answer C is incorrect because DNS attack addresses a different requirement. DNS attack refers to malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure.

 

Question 29

To identify rapid autonomous spread across reachable hosts, which security approach should be selected?

1. Worm
2. Ransomware
3. Collision attack
4. Privilege escalation

Correct Answer: A

 

Correct Answer

Answer A is correct because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance.

Incorrect Answers

Answer B is incorrect because Ransomware represents a different security function. Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession.

Answer C is incorrect because Collision attack addresses a different security requirement. Collision attack refers to an attack that seeks two different inputs producing the same hash value.

Answer D is incorrect because Privilege escalation would fit a different scenario. Privilege escalation refers to an attack that obtains permissions beyond those originally granted.

 

Question 30

Which term describes malware designed to covertly collect information about users or systems?

1. Out-of-cycle logging
2. Spyware
3. DDoS amplification
4. DNS attack

Correct Answer: B

 

Correct Answer

Answer B is correct because Spyware means malware designed to covertly collect information about users or systems.

Incorrect Answers

Answer A is incorrect because Out-of-cycle logging addresses a different requirement. Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns.

Answer C is incorrect because DDoS amplification addresses a different security requirement. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

Answer D is incorrect because DNS attack represents a different security function. DNS attack refers to malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure.

 

Question 31

To recognize malware that depends on a host object for propagation, which security approach should be selected?

1. Credential replay
2. Birthday attack
3. Virus
4. DNS attack

Correct Answer: C

 

Correct Answer

Answer C is correct because Virus means malware that attaches to a host file or other object and replicates when the infected host is executed.

Incorrect Answers

Answer A is incorrect because Credential replay would fit a different scenario. Credential replay refers to reuse of captured authentication data or tokens to impersonate a legitimate user or system.

Answer B is incorrect because Birthday attack addresses a different security requirement. Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.

Answer D is incorrect because DNS attack represents a different security function. DNS attack refers to malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure.

 

Question 32

Which term describes software or hardware that records keystrokes?

1. Trojan
2. Keylogger
3. Impossible travel
4. On-path attack

Correct Answer: B

 

Correct Answer

Answer B is correct because Keylogger means software or hardware that records keystrokes.

Incorrect Answers

Answer A is incorrect because Trojan represents a different security function. Trojan refers to malware that appears legitimate or useful but contains hidden malicious functionality.

Answer C is incorrect because Impossible travel addresses a different requirement. Impossible travel refers to an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time.

Answer D is incorrect because On-path attack addresses a different security requirement. On-path attack refers to an attack in which an adversary positions itself between communicating parties to observe or alter traffic.

 

Question 33

To identify delayed malicious behavior tied to a trigger, which security approach should be selected?

1. Credential replay
2. Out-of-cycle logging
3. Logic bomb
4. DDoS amplification

Correct Answer: C

 

Correct Answer

Answer C is correct because Logic bomb means malicious code that remains dormant until a specific condition, event, or time triggers execution.

Incorrect Answers

Answer A is incorrect because Credential replay addresses a different security requirement. Credential replay refers to reuse of captured authentication data or tokens to impersonate a legitimate user or system.

Answer B is incorrect because Out-of-cycle logging would fit a different scenario. Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns.

Answer D is incorrect because DDoS amplification represents a different security function. DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

 

Question 34

Which term describes malware designed to maintain privileged hidden access and conceal its presence?

1. Trojan
2. Rootkit
3. Concurrent session anomaly
4. Missing logs

Correct Answer: B

 

Correct Answer

Answer B is correct because Rootkit means malware designed to maintain privileged hidden access and conceal its presence.

Incorrect Answers

Answer A is incorrect because Trojan addresses a different security requirement. Trojan refers to malware that appears legitimate or useful but contains hidden malicious functionality.

Answer C is incorrect because Concurrent session anomaly represents a different security function. Concurrent session anomaly refers to unexpected simultaneous use of the same identity from different devices or locations.

Answer D is incorrect because Missing logs addresses a different requirement. Missing logs refers to absence of expected telemetry or audit records.

 

Question 35

To impersonate a physical-access badge or other RFID token, which security approach should be selected?

1. Missing logs
2. Concurrent session anomaly
3. DDoS reflection
4. RFID cloning

Correct Answer: D

 

Correct Answer

Answer D is correct because RFID cloning means copying or emulating data from an RFID credential.

Incorrect Answers

Answer A is incorrect because Missing logs would fit a different scenario. Missing logs refers to absence of expected telemetry or audit records.

Answer B is incorrect because Concurrent session anomaly represents a different security function. Concurrent session anomaly refers to unexpected simultaneous use of the same identity from different devices or locations.

Answer C is incorrect because DDoS reflection addresses a different security requirement. DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing.

 

Question 36

Which denial-of-service technique causes third-party systems to send responses larger than the attacker’s requests toward a victim?

1. DDoS amplification
2. RFID cloning
3. Out-of-cycle logging
4. Ransomware

Correct Answer: A

 

Correct Answer

Answer A is correct because DDoS amplification means a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.

Incorrect Answers

Answer B is incorrect because RFID cloning represents a different security function. RFID cloning refers to copying or emulating data from an RFID credential.

Answer C is incorrect because Out-of-cycle logging addresses a different security requirement. Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns.

Answer D is incorrect because Ransomware addresses a different requirement. Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession.

 

Question 37

To recognize attack traffic that appears to originate from many legitimate reflectors, which security approach should be selected?

1. DDoS reflection
2. DNS attack
3. Birthday attack
4. Missing logs

Correct Answer: A

 

Correct Answer

Answer A is correct because DDoS reflection means a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing.

Incorrect Answers

Answer B is incorrect because DNS attack would fit a different scenario. DNS attack refers to malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure.

Answer C is incorrect because Birthday attack addresses a different security requirement. Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.

Answer D is incorrect because Missing logs represents a different security function. Missing logs refers to absence of expected telemetry or audit records.

 

Question 38

Which term describes malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure?

1. DDoS reflection
2. DNS attack
3. Privilege escalation
4. Ransomware

Correct Answer: B

 

Correct Answer

Answer B is correct because DNS attack means malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure.

Incorrect Answers

Answer A is incorrect because DDoS reflection addresses a different security requirement. DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing.

Answer C is incorrect because Privilege escalation addresses a different requirement. Privilege escalation refers to an attack that obtains permissions beyond those originally granted.

Answer D is incorrect because Ransomware represents a different security function. Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession.

 

Question 39

To identify interception that occurs in the communication path, which security approach should be selected?

1. Birthday attack
2. On-path attack
3. Ransomware
4. Directory traversal

Correct Answer: B

 

Correct Answer

Answer B is correct because On-path attack means an attack in which an adversary positions itself between communicating parties to observe or alter traffic.

Incorrect Answers

Answer A is incorrect because Birthday attack represents a different security function. Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.

Answer C is incorrect because Ransomware would fit a different scenario. Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession.

Answer D is incorrect because Directory traversal addresses a different security requirement. Directory traversal refers to manipulation of path input to access files or directories outside an intended location.

 

Question 40

Which term describes reuse of captured authentication data or tokens to impersonate a legitimate user or system?

1. Out-of-cycle logging
2. Credential replay
3. Rootkit
4. Collision attack

Correct Answer: B

 

Correct Answer

Answer B is correct because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system.

Incorrect Answers

Answer A is incorrect because Out-of-cycle logging represents a different security function. Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns.

Answer C is incorrect because Rootkit addresses a different requirement. Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence.

Answer D is incorrect because Collision attack addresses a different security requirement. Collision attack refers to an attack that seeks two different inputs producing the same hash value.