During a routine vulnerability scan of a web application, you discover a flaw where user-supplied input in a search field is directly reflected back in the HTML response without proper sanitization. An attacker could potentially craft a malicious link that, when clicked by a victim, executes JavaScript in the victim’s browser context. What type of attack is this scenario most directly describing?

You are reviewing the incident response plan for your organization. The plan states that after an incident is contained, the next phase involves taking steps to remove the attacker’s artifacts, restore systems from clean backups, and harden systems against future attacks. What is the official name for this phase in the NIST incident response lifecycle?

A security analyst is configuring a SIEM and needs to ensure it can properly correlate events from network devices, servers, and applications. The analyst is looking at the various log sources and notices that the web server logs, firewall logs, and endpoint detection logs all format timestamps differently (e.g., local time vs. UTC, different date formats). What is the most critical foundational step the analyst must take to enable effective correlation?

While analyzing a packet capture, you notice several TCP sessions where the SYN, SYN-ACK, and ACK handshake completes, but then the initiating client immediately sends a RST packet to tear down the connection without exchanging any application data. This pattern repeats hundreds of times to different ports on the same server. What is the most likely purpose of this network activity?

Your organization is adopting a new cloud-based software development platform. The development team wants to integrate security testing directly into their CI/CD pipeline so that code is automatically scanned for vulnerabilities every time a change is committed, without manual intervention. Which of the following security practices best describes this automated, integrated approach?

After a malware incident, you are performing forensic analysis on an affected Linux server. You need to check for any unauthorized user accounts that may have been created by the attacker as a backdoor. Which of the following files should you examine first for a list of all user accounts on the system?

You receive an alert that a host on the network is communicating with an external IP address known to be associated with a command-and-control (C2) server. You immediately isolate the host from the network. According to the Cyber Kill Chain framework, at which stage has the attacker most likely been stopped?

During a risk assessment, you are evaluating the threat of a sophisticated phishing campaign targeting senior executives. The campaign uses highly personalized emails (spear phishing) that could lead to significant financial loss and data breach. The likelihood is assessed as medium, but the potential impact is very high. How should this risk most likely be classified for treatment priority?

A junior analyst is writing a query in their security tool to hunt for potential brute-force attacks against the VPN concentrator. They want to find source IPs that have generated more than 20 failed authentication events within a 5-minute window. What type of query logic is the analyst constructing?

During a routine vulnerability scan of a web application, you discover a flaw where user-supplied input in a search field is directly reflected back in the HTML response without proper sanitization. An attacker could potentially craft a malicious link that, when clicked by a victim, executes JavaScript in the victim’s browser context. What type of attack is this scenario most directly describing?0