A security administrator examines a network session to a compromised database server with a packet
analyzer. Within the session there is a repeated series of the hex character 90 (x90).
Which of the following attack types has occurred?

A security analyst, Ann, is reviewing an IRC channel and notices that a malicious exploit has been created
for a frequently used application. She notifies the software vendor and asks them for remediation steps,
but is alarmed to find that no patches are available to mitigate this vulnerability.
Which of the following BEST describes this exploit?

Using a heuristic system to detect an anomaly in a computer’s baseline, a system administrator was able
to detect an attack even though the company signature based IDS and antivirus did not detect it. Further
analysis revealed that the attacker had downloaded an executable file onto the company PC from the USB
port, and executed it to trigger a privilege escalation flaw.
Which of the following attacks has MOST likely occurred?

An attacker used an undocumented and unknown application exploit to gain access to a file server. Which
of the following BEST describes this type of attack?

Which of the following can only be mitigated through the use of technical controls rather that user
security training?

The security administrator is observing unusual network behavior from a workstation. The workstation is
communicating with a known malicious destination over an encrypted tunnel. A full antivirus scan, with
an updated antivirus definition file, does not show any signs of infection.
Which of the following has happened on the workstation?

Which of the following types of application attacks would be used to identify malware causing security
breaches that have NOT yet been identified by any trusted sources?

Which of the following may cause Jane, the security administrator, to seek an ACL work around?

Matt, an IT administrator, wants to protect a newly built server from zero day attacks. Which of the
following would provide the BEST level of protection?

Joe, a user, in a coffee shop is checking his email over a wireless network. An attacker records the
temporary credentials being passed to Joe’s browser. The attacker later uses the credentials to
impersonate Joe and creates SPAM messages. Which of the following attacks allows for this
impersonation?