CSLB General Building (B) — All Questions

An attacker sends an email that appears to come from the company CEO, urgently asking the finance team to wire funds to a new vendor. What type of social engineering attack is this?

• a.Vishing
• b.Business email compromise✓
• c.Watering hole attack
• d.Tailgating

Business email compromise (BEC) impersonates a trusted executive or partner to trick employees into transferring money or sensitive data. It relies on authority and urgency rather than malware. Because it uses legitimate-looking email, it often bypasses technical filters and targets human judgment.

Which malware type encrypts a victim's files and demands payment for the decryption key?

• a.Ransomware✓
• b.Rootkit
• c.Keylogger
• d.Adware

Ransomware encrypts data and extorts the victim for a decryption key, often with a payment deadline. Modern variants also exfiltrate data first to enable double extortion. Reliable offline backups are the most effective recovery control.

A user reports that their credentials worked on a fake login page that looked identical to the corporate portal. Which attack most likely occurred?

• a.SQL injection
• b.Buffer overflow
• c.Phishing✓
• d.Privilege escalation

Phishing lures users to fraudulent pages that harvest credentials by mimicking legitimate sites. The cloned portal is the classic delivery mechanism. User training and multifactor authentication reduce the impact of harvested passwords.

Which term describes a previously unknown software vulnerability for which no patch yet exists?

• a.Legacy flaw
• b.Misconfiguration
• c.Race condition
• d.Zero-day✓

A zero-day is a vulnerability unknown to the vendor and defenders, giving zero days to prepare a fix. Attackers exploiting it face no available patch. Compensating controls like segmentation and behavior-based detection help mitigate the risk.

An attacker overwhelms a web server with traffic from thousands of compromised devices, making it unavailable. What is this called?

• a.Man-in-the-middle
• b.Distributed denial-of-service✓
• c.On-path replay
• d.DNS poisoning

A distributed denial-of-service (DDoS) attack floods a target from many compromised hosts, often a botnet, exhausting bandwidth or resources. The goal is to disrupt availability rather than steal data. Rate limiting, scrubbing services, and CDNs help absorb the load.

Which type of threat actor is typically well-funded, highly skilled, and motivated by espionage on behalf of a government?

• a.Nation-state actor✓
• b.Script kiddie
• c.Hacktivist
• d.Insider by accident

Nation-state actors, often labeled advanced persistent threats, have significant resources, patience, and sophisticated tooling. Their goals include espionage, sabotage, and strategic advantage. They frequently use zero-days and long-dwell stealthy campaigns.

A disgruntled employee copies confidential designs to a USB drive before resigning. This is an example of what threat?

• a.Supply chain attack
• b.Watering hole
• c.Insider threat✓
• d.Shadow IT

An insider threat comes from someone with authorized access who misuses it, whether maliciously or negligently. The employee here abuses legitimate access to steal data. Data loss prevention, least privilege, and monitoring help detect such activity.

Which attack injects malicious database commands through unvalidated user input fields?

• a.Cross-site scripting
• b.SQL injection✓
• c.Directory traversal
• d.Session hijacking

SQL injection inserts crafted database statements through input that the application fails to sanitize. It can expose, modify, or delete data. Parameterized queries and input validation are the primary defenses.

An attacker leaves infected USB drives in a company parking lot hoping employees will plug them in. This technique is known as:

• a.Pretexting
• b.Whaling
• c.Shoulder surfing
• d.Baiting✓

Baiting entices victims with something appealing, such as a found USB drive, to trigger a compromise. Curiosity leads the victim to introduce the malware themselves. Endpoint controls that block unknown removable media reduce this risk.

Which malware disguises itself as legitimate software but performs malicious actions once installed?

• a.Trojan✓
• b.Worm
• c.Logic bomb
• d.Botnet

A Trojan masquerades as a benign or useful program to trick users into running it. Unlike a worm, it does not self-replicate; it relies on deception. Once executed it may open backdoors, steal data, or download further payloads.

A malicious program spreads across a network automatically without any user interaction. What is it?

• a.Trojan
• b.Spyware
• c.Worm✓
• d.Rootkit

A worm self-replicates and propagates across networks by exploiting vulnerabilities, requiring no user action. This makes outbreaks spread rapidly. Timely patching and network segmentation slow worm propagation.

An attacker calls an employee pretending to be IT support to trick them into revealing a password. This voice-based social engineering is called:

• a.Smishing
• b.Vishing✓
• c.Phishing
• d.Spooling

Vishing uses voice calls to manipulate victims into disclosing information or performing actions. The attacker builds a plausible pretext, often posing as a trusted party. Verification callbacks and never sharing passwords by phone are effective countermeasures.

Which attack compromises a website frequently visited by a target group to infect their systems?

• a.Rainbow table
• b.Pass-the-hash
• c.Typosquatting
• d.Watering hole✓

A watering hole attack infects a site the intended victims commonly use, so visiting it delivers malware. It targets a community indirectly through a trusted resource. Keeping browsers patched and using endpoint protection reduces exposure.

Which term describes a hidden vulnerability in a third-party component that compromises everyone who uses it?

• a.Supply chain risk✓
• b.Insider risk
• c.Physical risk
• d.Configuration drift

Supply chain risk arises when a trusted vendor, library, or hardware component is compromised, affecting downstream customers. A single tainted update can reach many organizations. Vendor assessments and software bill of materials help manage this risk.

Malware that records every keystroke a user types to capture passwords is a:

• a.Rootkit
• b.Keylogger✓
• c.Ransomware
• d.Backdoor

A keylogger captures keyboard input to steal credentials, messages, and other sensitive typed data. It can be software or hardware based. Multifactor authentication limits the damage from stolen static passwords.

An attacker registers a domain like 'goggle.com' hoping users mistype the real address. This is:

• a.Pharming
• b.DNS spoofing
• c.Typosquatting✓
• d.Session fixation

Typosquatting registers look-alike domains based on common misspellings to catch mistyped traffic. Victims may land on malicious or fraudulent pages. Users should verify URLs and organizations can defensively register close variants.

Which type of malware hides deep in the operating system to conceal its presence and maintain privileged access?

• a.Adware
• b.Trojan
• c.Worm
• d.Rootkit✓

A rootkit embeds itself at a low level, often the kernel, to hide processes and files while retaining elevated control. Its stealth makes detection and removal difficult. Secure boot and integrity monitoring help defend against rootkits.

A phishing attack that specifically targets a high-value executive is known as:

• a.Whaling✓
• b.Vishing
• c.Smishing
• d.Spear tailoring

Whaling is a form of spear phishing aimed at senior executives or high-profile targets. The lures are carefully crafted for that individual and their authority. Executive awareness training and verification procedures reduce success.

Which attack intercepts and possibly alters communication between two parties who believe they are talking directly?

• a.Denial-of-service
• b.On-path (man-in-the-middle)✓
• c.Brute force
• d.Cross-site request forgery

An on-path attack, historically called man-in-the-middle, positions the attacker between two endpoints to eavesdrop or tamper with traffic. Unencrypted channels are especially vulnerable. Strong encryption and certificate validation mitigate it.

A malicious script stored on a vulnerable web page runs in other users' browsers when they view it. This is:

• a.SQL injection
• b.CSRF
• c.Stored cross-site scripting✓
• d.Clickjacking

Stored cross-site scripting (XSS) persists malicious script on the server so it executes in every visitor's browser. It can steal session tokens or perform actions as the victim. Output encoding and input validation prevent XSS.

Which term describes exploiting a time gap between checking a resource and using it?

• a.Buffer overflow
• b.Replay attack
• c.Injection
• d.Race condition✓

A race condition, or time-of-check to time-of-use flaw, exploits the interval between validating and using a resource. An attacker changes state in that window to bypass controls. Proper locking and atomic operations prevent it.

An attacker follows an employee through a secured door without badging in. This physical attack is called:

• a.Tailgating✓
• b.Piggyback encryption
• c.Shoulder surfing
• d.Dumpster diving

Tailgating is entering a restricted area by closely following an authorized person through a controlled door. It exploits politeness and weak physical enforcement. Mantraps, turnstiles, and awareness reduce tailgating.

Which attack precomputes hashes to reverse password hashes quickly?

• a.Dictionary attack
• b.Rainbow table attack✓
• c.Credential stuffing
• d.Password spraying

A rainbow table uses precomputed hash chains to reverse unsalted password hashes efficiently. Adding a unique random salt to each password defeats this approach. Modern slow hashing functions further increase cracking cost.

An attacker tries a few very common passwords across many user accounts to avoid lockouts. This is:

• a.Brute force
• b.Rainbow table
• c.Password spraying✓
• d.Pass-the-hash

Password spraying tests a small set of common passwords across many accounts, staying under lockout thresholds. It exploits weak, reused passwords at scale. Strong password policies, MFA, and anomaly detection counter it.