Explanation: A low-interaction honeypot is a type of honeypot that simulates a real OS as well as the applications and services of a target network, but only responds to pre-configured commands. It is designed to capture basic information about the attacker, such as their IP address, tools, and techniques. A low-interaction honeypot is easier to deploy and maintain than a high-interaction honeypot, which fully emulates a real system and allows the attacker to interact with it. A pure honeypot is a real system that is intentionally vulnerable and exposed to attackers. A medium-interaction honeypot is a type of honeypot that offers more functionality and interactivity than a low-interaction honeypot, but less than a high-interaction honeypot.

Explanation: Technical threat intelligence is a type of threat intelligence that provides information about the technical details of specific attacks, such as indicators of compromise (IOCs), malware signatures, attack vectors, and vulnerabilities. Technical threat intelligence helps the NOC team understand how attackers are expected to perform an attack on the organization, identify the information leakage, and determine the attack goals as well as attack vectors. Technical threat intelligence is often consumed by security analysts, incident responders, and penetration testers who need to analyze and respond to active or potential threats.

Explanation: Private cloud is the type of cloud deployment model that the company implemented in this scenario. Cloud computing is a model that provides on-demand access to shared and scalable computing resources, such as servers, storage, networks, applications, etc., over the internet or a network. Cloud computing can have different types based on its service or deployment model. A cloud deployment model defines how and where the cloud infrastructure and services are hosted and accessed . A cloud deployment model can have different types, such as public cloud, private cloud, hybrid cloud, community cloud, etc. A private cloud is a type of cloud deployment model that provides exclusive access to cloud infrastructure and services to a single organization or entity . A private cloud can be hosted within or outside the organization’s premises and managed by the organization or a third-party provider . A private cloud can be used to secure sensitive data from external access and maintain full control over the corporate data . In the scenario, the company decided to implement the cloud infrastructure within its corporate firewall to secure sensitive data from external access. The company invested heavily in creating a cloud architecture within its premises to manage full control over its corporate data. This means that the company implemented a private cloud for this purpose. A multi-cloud is not a type of cloud deployment model, but a term that describes a strategy that uses multiple public or private clouds from different providers for different purposes or functions . A public cloud is a type of cloud deployment model that provides open access to cloud infrastructure and services to multiple organizations or entities over the internet . A public cloud can be hosted and managed by a third-party provider that owns and operates the cloud infrastructure and services . A community cloud is a type of cloud deployment model that provides shared access to cloud infrastructure and services to multiple organizations or entities that have common interests or goals.

Explanation: Type = 12 is the type of ICMP error message received by Jaden in the above scenario. ICMP (Internet Control Message Protocol) is a protocol that sends error and control messages between network devices. ICMP error messages are categorized by types and codes, which indicate the cause and nature of the error. Type = 12 is the type of ICMP error message that indicates an IP parameter problem, which means that the IP header field contains invalid information . Type = 8 is the type of ICMP message that indicates an echo request, which is used to test the connectivity and reachability of a destination host. Type = 5 is the type of ICMP error message that indicates a redirect, which means that a better route to the destination host is available. Type = 3 is the type of ICMP error message that indicates a destination unreachable, which means that the destination host or network cannot be reached.

Explanation: The correct answer is B, as it identifies the type of account that the organization has given to Sam in the above scenario. A guest account is a type of account that allows temporary or limited access to a system or network for visitors or users who do not belong to the organization. A guest account typically has minimal privileges and permissions and can only access certain files or applications. In the above scenario, the organization has given Sam a guest account for the demonstration. Using this account, Sam can only access the files that are required for the demonstration and cannot open any other file in the system. Option A is incorrect, as it does not identify the type of account that the organization has given to Sam in the above scenario. A service account is a type of account that allows applications or services to run on a system or network under a specific identity. A service account typically has high privileges and permissions and can access various files or applications. In the above scenario, the organization has not given Sam a service account for the demonstration. Option C is incorrect, as it does not identify the type of account that the organization has given to Sam in the above scenario. A user account is a type of account that allows regular access to a system or network for employees or members of an organization. A user account typically has moderate privileges and permissions and can access various files or applications depending on their role. In the above scenario, the organization has not given Sam a user account for the demonstration. Option D is incorrect, as it does not identify the type of account that the organization has given to Sam in the above scenario. An administrator account is a type of account that allows full access to a system or network for administrators or managers of an organization. An administrator account typically has the highest privileges and permissions and can access and modify any files or applications. In the above scenario, the organization has not given Sam an administrator account for the demonstration.

Explanation: Weaponization is the stage of the cyber kill chain that you are at in the above scenario. The cyber kill chain is a model that describes the phases of a cyberattack from the perspective of the attacker. The cyber kill chain consists of seven stages: reconnaissance, weaponization,delivery, exploitation, installation, command and control, and actions on objectives. Reconnaissance is the stage of the cyber kill chain that involves gathering information about the target, such as IP addresses, domain names, vulnerabilities, etc. Weaponization is the stage of the cyber kill chain that involves creating a malicious payload or tool that can exploit the target’s vulnerabilities. Weaponization can include creating a client-side backdoor to send it to the employees via email. Delivery is the stage of the cyber kill chain that involves transmitting or delivering the weaponized payload or tool to the target’s system or network. Exploitation is the stage of the cyber kill chain that involves executing or triggering the weaponized payload or tool on the target’s system or network.

Explanation: Availability is the information security element that ensures that Stella’s transaction status is immediately reflected in her bank account in this scenario. Information security is the practice of protecting information and information systems from unauthorized access, use, disclosure, modification, or destruction. Information security can be based on three fundamental principles: confidentiality, integrity, and availability. Confidentiality is the principle that ensures that information is accessible only to authorized parties and not disclosed to unauthorized parties. Integrity is the principle that ensures that information is accurate, complete, and consistent and not altered or corrupted by unauthorized parties. Availability is the principle that ensures that information and information systems are accessible and usable by authorized parties when needed. In the scenario, Stella purchased a smartwatch online using her debit card. After making payment for the product through the payment gateway, she received a transaction text message with a deducted and available balance from her bank. This means that her transaction status was immediately reflected in her bank account, which indicates that availability was ensured by her bank’s information system.

Explanation: Wireless repeater is the network component employed by the administrator to extend signals in this scenario. A wireless network is a type of network that uses radio waves or infrared signals to transmit data between devices without using cables or wires. A wireless network can consist of various components, such as wireless access points (APs), wireless routers, wireless adapters, wireless bridges, wireless repeaters, etc. A wireless repeater is a network component that extends the range or coverage of a wireless signal by receiving it from an AP or another repeater and retransmitting it to another area . A wireless repeater can be used to support new devices connected to the network beyond the AP’s range . In the scenario, a startup firm contains various devices connected to a wireless network across the floor. An AP with internet connectivity is placed in a corner to allow wireless communication between devices. To support new devices connected to the network beyond the AP’s range, an administrator used a network component that extended the signals of the wireless AP and transmitted it to the uncovered area. This means that he used a wireless repeater for this purpose. A wireless bridge is a network component that connects two or more wired or wireless networks or segments together . A wireless bridge can be used to expand the network or share resources between networks . A wireless modem is a network component that modulates and demodulates wireless signals to enable data transmission over a network . A wireless modem can be used to provide internet access to devices via a cellular network or a satellite network . A wireless router is a network component that performs the functions of both a wireless AP and a router . A wireless router can be used to create a wireless network and connect it to another network, such as the internet.

Explanation:
Immediate Containment:
Reference: NIST SP 800-61, Computer Security Incident Handling Guide.
Preservation of Evidence:
Archiving all logs and related data ensures that crucial evidence is preserved for future forensic analysis. This helps in understanding the attack vector and the scope of the breach.
Reference: ISO/IEC 27037:2012, Guidelines for Identification, Collection, Acquisition, and Preservation of Digital Evidence.
Business Continuity:
Shifting core services to backup systems ensures that the business operations continue with minimal disruption. This maintains client trust and operational stability. Reference: NIST SP 800-34, Contingency Planning Guide for Federal Information Systems.
Parallel Investigation:
While the immediate response focuses on containment and continuity, a parallel investigation can be conducted to understand the breach and devise long-term mitigation strategies.

Explanation: 20.20.10.19 is the source IP address of the SYN flooding attack in the above scenario. SYN flooding is a type of denial-of-service (DoS) attack that exploits the TCP (Transmission Control Protocol) three-way handshake process to disrupt the network and gain advantage over the network to bypass the firewall. SYN flooding sends a large number of SYN packets with spoofed source IP addresses to a target server, causing it to allocate resources and wait for the corresponding ACK packets that never arrive. This exhausts the server’s resources and prevents it from accepting legitimate requests . To determine the source IP address of the SYN flooding attack, one has to follow these steps:
Navigate to the Documents folder of Attacker-1 machine.
Double-click on Synflood.pcapng file to open it with Wireshark.
Click on Statistics menu and select Conversations option.
Click on TCP tab and sort the list by Bytes column in descending order.
Observe the IP address that has sent the most bytes to 20.20.10.26 (target server).
The IP address that has sent the most bytes to 20.20.10.26 is 20.20.10.19 , which is the source IP address of the SYN flooding attack.

Reference: NIST SP 800-41, Guidelines on Firewalls and Firewall Policy.
Session Information Tracking:
Stateful inspection maintains a state table that keeps track of all active connections passing through the firewall, ensuring that only legitimate packets part of an established session are allowed.
Reference: CIS Controls, Control 12 - Boundary Defense.
Application-Level Gateway Firewalls:
Also known as proxy firewalls, these operate at the application layer of the OSI model. They filter traffic by examining the content of the packets, making decisions based on the application data, and enforcing security policies at the application level.
Reference: OWASP Top Ten Security Risks.
Control Over Applications:
Application-level gateway firewalls provide granular control over input, output, and access to applications or services. They can enforce application-specific policies, perform deep packet inspection, and block malicious traffic at the application layer.
Reference: Cisco’s Firewall Technology Guide.
By understanding the distinct functionalities and capabilities of stateful multilayer inspection firewalls and application-level gateway firewalls, organizations can better secure their network infrastructure.

Explanation:
Definition of Rootkit:
Reference: "Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats" by Alex Matrosov.
Sophisticated Stealth Mechanisms:
Rootkits often employ sophisticated techniques to remain undetected by traditional security measures, such as antivirus software and intrusion detection systems.
Reference: "The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System" by Bill Blunden.
Manipulating System Processes:
Rootkits can deeply embed themselves in the system, allowing them to manipulate system processes, such as altering transaction values and transferring funds without detection.
Reference: NIST SP 800-83, Guide to Malware Incident Prevention and Handling.
Impact on Financial Systems:
In the context of the bank's transaction processing system, the rootkit's ability to alter transaction values intermittently and subtly makes it difficult to detect, thus causing financial losses over time.
Reference: SANS Institute's "Understanding Rootkits and How to Defend Against Them." Given the description of the malware's behavior, a rootkit best fits the type of malware used in this security breach.