Topic 08 Practice Test 2 covers Indicators of Malicious Activity for CompTIA Security+ SY0-701 and maps to objective 2.4: Given a scenario, analyze indicators of malicious activity. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
To disrupt or manipulate name resolution, which security approach should be selected?
- Rootkit
- Out-of-cycle logging
- Password spraying
- DNS attack
Correct Answer: D
Correct Answer
Answer D is correct because DNS attack means malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure. The deciding point is functional fit: this option covers the stated need, while Rootkit addresses malware designed to maintain privileged hidden access and conceal its presence.
Incorrect Answers
Answer A is incorrect because Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence. The question is not asking for this function. It is testing malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure, so DNS attack is the stronger fit.
Answer B is incorrect because Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns. The concept is valid, but it does not match this stem. The required function is malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure, which maps to DNS attack.
Answer C is incorrect because Password spraying refers to trying a small number of common passwords across many accounts. The scenario instead requires malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure, which is why DNS attack is the better answer; this option serves the different function defined above.
Question 2
To trick a user into executing harmful code disguised as something benign, which security approach should be selected?
- Keylogger
- Password brute force
- Rootkit
- Trojan
Correct Answer: D
Correct Answer
Answer D is correct because Trojan means malware that appears legitimate or useful but contains hidden malicious functionality. That makes it the best answer here; Rootkit addresses malware designed to maintain privileged hidden access and conceal its presence, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Keylogger refers to software or hardware that records keystrokes. The key mismatch is functional: Trojan addresses malware that appears legitimate or useful but contains hidden malicious functionality, the need stated by the question.
Answer B is incorrect because Password brute force refers to systematically trying many password candidates against an account or captured hash. The concept is valid, but it does not match this stem. The required function is malware that appears legitimate or useful but contains hidden malicious functionality, which maps to Trojan.
Answer C is incorrect because Rootkit refers to malware designed to maintain privileged hidden access and conceal its presence. The key mismatch is functional: Trojan addresses malware that appears legitimate or useful but contains hidden malicious functionality, the need stated by the question.
Question 3
An architect working on a SOC investigation of suspicious activity needs one capability that provides malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure and another that provides systematically trying many password candidates against an account or captured hash. Which TWO selections are the best match? Choose TWO.
- DDoS reflection
- DDoS amplification
- Birthday attack
- DNS attack
- Password brute force
Correct Answers: D, E
Correct Answers
Answer D is correct because DNS attack means malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure. It belongs in the fixed-count answer set because it covers one of the stated requirements. DDoS amplification instead serves a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim and cannot replace this function.
Answer E is correct because Password brute force means systematically trying many password candidates against an account or captured hash. One required function is exactly what this option provides. Birthday attack may be useful elsewhere, but it is used for a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.
Incorrect Answers
Answer A is incorrect because DDoS reflection means a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. The question requires exactly 2 selections: DNS attack, Password brute force. This option falls outside that required set.
Answer B is incorrect because DDoS amplification means a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. The required choices are DNS attack, Password brute force. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer C is incorrect because Birthday attack means a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. The required choices are DNS attack, Password brute force. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 4
To recognize collision search based on probability rather than direct preimage recovery, which security approach should be selected?
- Password spraying
- Collision attack
- Birthday attack
- Injection attack
Correct Answer: C
Correct Answer
Answer C is correct because Birthday attack means a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. This matches the requirement as written. Password spraying can be valid in another context, but it is used for trying a small number of common passwords across many accounts.
Incorrect Answers
Answer A is incorrect because Password spraying refers to trying a small number of common passwords across many accounts. That concept can be valid in another scenario, but this question is testing a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output; Birthday attack therefore fits the requirement more directly.
Answer B is incorrect because Collision attack refers to an attack that seeks two different inputs producing the same hash value. That concept can be valid in another scenario, but this question is testing a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output; Birthday attack therefore fits the requirement more directly.
Answer D is incorrect because Injection attack refers to an application attack that causes untrusted input to be interpreted as commands, queries, or code. This could be appropriate elsewhere, but the required function is a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output; that makes Birthday attack the precise choice.
Question 5
To recognize negotiation manipulated toward weaker protection, which security approach should be selected?
- Ransomware
- Virus
- Spyware
- Downgrade attack
Correct Answer: D
Correct Answer
Answer D is correct because Downgrade attack means a cryptographic or protocol attack that forces use of a weaker version or less secure option. This is the precise fit for the scenario. Spyware serves the different purpose of malware designed to covertly collect information about users or systems.
Incorrect Answers
Answer A is incorrect because Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. This could be appropriate elsewhere, but the required function is a cryptographic or protocol attack that forces use of a weaker version or less secure option; that makes Downgrade attack the precise choice.
Answer B is incorrect because Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed. That concept can be valid in another scenario, but this question is testing a cryptographic or protocol attack that forces use of a weaker version or less secure option; Downgrade attack therefore fits the requirement more directly.
Answer C is incorrect because Spyware refers to malware designed to covertly collect information about users or systems. The concept is valid, but it does not match this stem. The required function is a cryptographic or protocol attack that forces use of a weaker version or less secure option, which maps to Downgrade attack.
Question 6
An architect working on a SOC investigation of suspicious activity needs one capability that provides malicious code that remains dormant until a specific condition, event, or time triggers execution and another that provides attack that obtains permissions beyond those originally granted. Which TWO selections are the best match? Choose TWO.
- Collision attack
- Logic bomb
- Concurrent session anomaly
- Worm
- Privilege escalation
Correct Answers: B, E
Correct Answers
Answer B is correct because Logic bomb means malicious code that remains dormant until a specific condition, event, or time triggers execution. It belongs in the fixed-count answer set because it covers one of the stated requirements. Worm instead serves self-propagating malware that spreads between systems without requiring a user to copy each instance and cannot replace this function.
Answer E is correct because Privilege escalation means an attack that obtains permissions beyond those originally granted. The fixed-count item needs this function in the answer set. Worm covers self-propagating malware that spreads between systems without requiring a user to copy each instance, a different requirement.
Incorrect Answers
Answer A is incorrect because Collision attack means an attack that seeks two different inputs producing the same hash value. The question requires exactly 2 selections: Logic bomb, Privilege escalation. This option falls outside that required set. For example, Logic bomb is required for malicious code that remains dormant until a specific condition, event, or time triggers execution.
Answer C is incorrect because Concurrent session anomaly means unexpected simultaneous use of the same identity from different devices or locations. The question requires exactly 2 selections: Logic bomb, Privilege escalation. This option falls outside that required set. For example, Privilege escalation is required for an attack that obtains permissions beyond those originally granted.
Answer D is incorrect because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance. Every answer slot must map to a stated requirement. The correct set is Logic bomb, Privilege escalation, so this option cannot replace one of those selections.
Question 7
Two requirements remain open in a SOC investigation of suspicious activity: attack that seeks two different inputs producing the same hash value; absence of expected telemetry or audit records. Which TWO options close those specific gaps? Choose TWO.
- Birthday attack
- Downgrade attack
- Privilege escalation
- Collision attack
- Missing logs
Correct Answers: D, E
Correct Answers
Answer D is correct because Collision attack means an attack that seeks two different inputs producing the same hash value. The fixed-count item needs this function in the answer set. Privilege escalation covers an attack that obtains permissions beyond those originally granted, a different requirement.
Answer E is correct because Missing logs means absence of expected telemetry or audit records. This option satisfies a specific requirement in the stem; Birthday attack serves a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output and therefore is not interchangeable with it.
Incorrect Answers
Answer A is incorrect because Birthday attack means a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. Every answer slot must map to a stated requirement. The correct set is Missing logs, Collision attack, so this option cannot replace one of those selections.
Answer B is incorrect because Downgrade attack means a cryptographic or protocol attack that forces use of a weaker version or less secure option. The fixed-count answer set is Missing logs, Collision attack; this option does not fill one of those named functions.
Answer C is incorrect because Privilege escalation means an attack that obtains permissions beyond those originally granted. The required choices are Missing logs, Collision attack. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 8
Two requirements remain open in a SOC investigation of suspicious activity: software or hardware that records keystrokes; reuse of captured authentication data or tokens to impersonate a legitimate user or system. Which TWO options close those specific gaps? Choose TWO.
- Birthday attack
- Keylogger
- Privilege escalation
- RFID cloning
- Credential replay
Correct Answers: B, E
Correct Answers
Answer B is correct because Keylogger means software or hardware that records keystrokes. This selection maps directly to one of the named needs. Birthday attack addresses a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output, so it does not satisfy the same slot.
Answer E is correct because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system. The fixed-count item needs this function in the answer set. Privilege escalation covers an attack that obtains permissions beyond those originally granted, a different requirement.
Incorrect Answers
Answer A is incorrect because Birthday attack means a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. The scenario calls for Credential replay, Keylogger. Selecting this option would leave one of those required functions uncovered.
Answer C is incorrect because Privilege escalation means an attack that obtains permissions beyond those originally granted. Every answer slot must map to a stated requirement. The correct set is Credential replay, Keylogger, so this option cannot replace one of those selections.
Answer D is incorrect because RFID cloning means copying or emulating data from an RFID credential. Every answer slot must map to a stated requirement. The correct set is Credential replay, Keylogger, so this option cannot replace one of those selections.
Question 9
To recognize malware that depends on a host object for propagation, which security approach should be selected?
- DNS attack
- Birthday attack
- Virus
- Credential replay
Correct Answer: C
Correct Answer
Answer C is correct because Virus means malware that attaches to a host file or other object and replicates when the infected host is executed. The requirement maps directly to this function, whereas Birthday attack is aimed at a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.
Incorrect Answers
Answer A is incorrect because DNS attack refers to malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure. The scenario instead requires malware that attaches to a host file or other object and replicates when the infected host is executed, which is why Virus is the better answer; this option serves the different function defined above.
Answer B is incorrect because Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. The question is not asking for this function. It is testing malware that attaches to a host file or other object and replicates when the infected host is executed, so Virus is the stronger fit.
Answer D is incorrect because Credential replay refers to reuse of captured authentication data or tokens to impersonate a legitimate user or system. This could be appropriate elsewhere, but the required function is malware that attaches to a host file or other object and replicates when the infected host is executed; that makes Virus the precise choice.
Question 10
To recognize extortion combined with loss of system or data access, which security approach should be selected?
- Spyware
- Out-of-cycle logging
- Ransomware
- Password spraying
Correct Answer: C
Correct Answer
Answer C is correct because Ransomware means malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. That is the function the question is testing. Password spraying would instead be used for trying a small number of common passwords across many accounts.
Incorrect Answers
Answer A is incorrect because Spyware refers to malware designed to covertly collect information about users or systems. The scenario instead requires malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession, which is why Ransomware is the better answer; this option serves the different function defined above.
Answer B is incorrect because Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns. The question is not asking for this function. It is testing malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession, so Ransomware is the stronger fit.
Answer D is incorrect because Password spraying refers to trying a small number of common passwords across many accounts. The question is not asking for this function. It is testing malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession, so Ransomware is the stronger fit.
Question 11
Which term describes trying a small number of common passwords across many accounts?
- Spyware
- Injection attack
- DDoS reflection
- Password spraying
Correct Answer: D
Correct Answer
Answer D is correct because Password spraying means trying a small number of common passwords across many accounts. That is the function the question is testing. Spyware would instead be used for malware designed to covertly collect information about users or systems.
Incorrect Answers
Answer A is incorrect because Spyware refers to malware designed to covertly collect information about users or systems. That concept can be valid in another scenario, but this question is testing trying a small number of common passwords across many accounts; Password spraying therefore fits the requirement more directly.
Answer B is incorrect because Injection attack refers to an application attack that causes untrusted input to be interpreted as commands, queries, or code. The key mismatch is functional: Password spraying addresses trying a small number of common passwords across many accounts, the need stated by the question.
Answer C is incorrect because DDoS reflection refers to a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. The scenario instead requires trying a small number of common passwords across many accounts, which is why Password spraying is the better answer; this option serves the different function defined above.
Question 12
To identify interception that occurs in the communication path, which security approach should be selected?
- On-path attack
- Directory traversal
- Birthday attack
- Ransomware
Correct Answer: A
Correct Answer
Answer A is correct because On-path attack means an attack in which an adversary positions itself between communicating parties to observe or alter traffic. This matches the requirement as written. Birthday attack can be valid in another context, but it is used for a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output.
Incorrect Answers
Answer B is incorrect because Directory traversal refers to manipulation of path input to access files or directories outside an intended location. The key mismatch is functional: On-path attack addresses an attack in which an adversary positions itself between communicating parties to observe or alter traffic, the need stated by the question.
Answer C is incorrect because Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. That concept can be valid in another scenario, but this question is testing an attack in which an adversary positions itself between communicating parties to observe or alter traffic; On-path attack therefore fits the requirement more directly.
Answer D is incorrect because Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. The question is not asking for this function. It is testing an attack in which an adversary positions itself between communicating parties to observe or alter traffic, so On-path attack is the stronger fit.
Question 13
Two requirements remain open in a SOC investigation of suspicious activity: denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing; reuse of captured authentication data or tokens to impersonate a legitimate user or system. Which TWO options close those specific gaps? Choose TWO.
- DDoS reflection
- RFID cloning
- Injection attack
- Credential replay
- Keylogger
Correct Answers: A, D
Correct Answers
Answer A is correct because DDoS reflection means a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. It belongs in the fixed-count answer set because it covers one of the stated requirements. RFID cloning instead serves copying or emulating data from an RFID credential and cannot replace this function.
Answer D is correct because Credential replay means reuse of captured authentication data or tokens to impersonate a legitimate user or system. The fixed-count item needs this function in the answer set. Keylogger covers software or hardware that records keystrokes, a different requirement.
Incorrect Answers
Answer B is incorrect because RFID cloning means copying or emulating data from an RFID credential. The scenario calls for Credential replay, DDoS reflection. Selecting this option would leave one of those required functions uncovered. For example, Credential replay is required for reuse of captured authentication data or tokens to impersonate a legitimate user or system.
Answer C is incorrect because Injection attack means an application attack that causes untrusted input to be interpreted as commands, queries, or code. The fixed-count answer set is Credential replay, DDoS reflection; this option does not fill one of those named functions.
Answer E is incorrect because Keylogger means software or hardware that records keystrokes. Every answer slot must map to a stated requirement. The correct set is Credential replay, DDoS reflection, so this option cannot replace one of those selections.
Question 14
Which term describes malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession?
- Impossible travel
- Ransomware
- DDoS amplification
- Virus
Correct Answer: B
Correct Answer
Answer B is correct because Ransomware means malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. This is the precise fit for the scenario. DDoS amplification serves the different purpose of a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim.
Incorrect Answers
Answer A is incorrect because Impossible travel refers to an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time. This could be appropriate elsewhere, but the required function is malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession; that makes Ransomware the precise choice.
Answer C is incorrect because DDoS amplification refers to a denial-of-service technique that causes third-party systems to send responses larger than the attacker’s requests toward a victim. The scenario instead requires malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession, which is why Ransomware is the better answer; this option serves the different function defined above.
Answer D is incorrect because Virus refers to malware that attaches to a host file or other object and replicates when the infected host is executed. The scenario instead requires malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession, which is why Ransomware is the better answer; this option serves the different function defined above.
Question 15
To detect possible account sharing or credential compromise, which security approach should be selected?
- Concurrent session anomaly
- On-path attack
- RFID cloning
- Spyware
Correct Answer: A
Correct Answer
Answer A is correct because Concurrent session anomaly means unexpected simultaneous use of the same identity from different devices or locations. The requirement maps directly to this function, whereas RFID cloning is aimed at copying or emulating data from an RFID credential.
Incorrect Answers
Answer B is incorrect because On-path attack refers to an attack in which an adversary positions itself between communicating parties to observe or alter traffic. The key mismatch is functional: Concurrent session anomaly addresses unexpected simultaneous use of the same identity from different devices or locations, the need stated by the question.
Answer C is incorrect because RFID cloning refers to copying or emulating data from an RFID credential. That concept can be valid in another scenario, but this question is testing unexpected simultaneous use of the same identity from different devices or locations; Concurrent session anomaly therefore fits the requirement more directly.
Answer D is incorrect because Spyware refers to malware designed to covertly collect information about users or systems. The scenario instead requires unexpected simultaneous use of the same identity from different devices or locations, which is why Concurrent session anomaly is the better answer; this option serves the different function defined above.
Question 16
To identify rapid autonomous spread across reachable hosts, which security approach should be selected?
- Collision attack
- Ransomware
- Worm
- Privilege escalation
Correct Answer: C
Correct Answer
Answer C is correct because Worm means self-propagating malware that spreads between systems without requiring a user to copy each instance. The requirement maps directly to this function, whereas Privilege escalation is aimed at an attack that obtains permissions beyond those originally granted.
Incorrect Answers
Answer A is incorrect because Collision attack refers to an attack that seeks two different inputs producing the same hash value. The scenario instead requires self-propagating malware that spreads between systems without requiring a user to copy each instance, which is why Worm is the better answer; this option serves the different function defined above.
Answer B is incorrect because Ransomware refers to malware that denies access to data or systems, commonly by encrypting files, and demands payment or another concession. The key mismatch is functional: Worm addresses self-propagating malware that spreads between systems without requiring a user to copy each instance, the need stated by the question.
Answer D is incorrect because Privilege escalation refers to an attack that obtains permissions beyond those originally granted. The concept is valid, but it does not match this stem. The required function is self-propagating malware that spreads between systems without requiring a user to copy each instance, which maps to Worm.
Question 17
During a SOC investigation of suspicious activity, three requirements must be addressed: (1) manipulation of path input to access files or directories outside an intended location; (2) unexpected simultaneous use of the same identity from different devices or locations; and (3) security-relevant activity recorded at an unusual time compared with normal operational patterns. Which THREE choices best satisfy them? Choose THREE.
- Out-of-cycle logging
- Concurrent session anomaly
- Injection attack
- Birthday attack
- Collision attack
- Directory traversal
Correct Answers: A, B, F
Correct Answers
Answer A is correct because Out-of-cycle logging means security-relevant activity recorded at an unusual time compared with normal operational patterns. One required function is exactly what this option provides. Collision attack may be useful elsewhere, but it is used for an attack that seeks two different inputs producing the same hash value.
Answer B is correct because Concurrent session anomaly means unexpected simultaneous use of the same identity from different devices or locations. One required function is exactly what this option provides. Collision attack may be useful elsewhere, but it is used for an attack that seeks two different inputs producing the same hash value.
Answer F is correct because Directory traversal means manipulation of path input to access files or directories outside an intended location. It belongs in the fixed-count answer set because it covers one of the stated requirements. Injection attack instead serves an application attack that causes untrusted input to be interpreted as commands, queries, or code and cannot replace this function.
Incorrect Answers
Answer C is incorrect because Injection attack means an application attack that causes untrusted input to be interpreted as commands, queries, or code. The question requires exactly 3 selections: Concurrent session anomaly, Directory traversal, Out-of-cycle logging. This option falls outside that required set.
Answer D is incorrect because Birthday attack means a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. The required choices are Concurrent session anomaly, Directory traversal, Out-of-cycle logging. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Collision attack means an attack that seeks two different inputs producing the same hash value. The question requires exactly 3 selections: Concurrent session anomaly, Directory traversal, Out-of-cycle logging. This option falls outside that required set.
Question 18
Which term describes software or hardware that records keystrokes?
- Keylogger
- Impossible travel
- Trojan
- On-path attack
Correct Answer: A
Correct Answer
Answer A is correct because Keylogger means software or hardware that records keystrokes. This is the precise fit for the scenario. Trojan serves the different purpose of malware that appears legitimate or useful but contains hidden malicious functionality.
Incorrect Answers
Answer B is incorrect because Impossible travel refers to an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time. This could be appropriate elsewhere, but the required function is software or hardware that records keystrokes; that makes Keylogger the precise choice.
Answer C is incorrect because Trojan refers to malware that appears legitimate or useful but contains hidden malicious functionality. The scenario instead requires software or hardware that records keystrokes, which is why Keylogger is the better answer; this option serves the different function defined above.
Answer D is incorrect because On-path attack refers to an attack in which an adversary positions itself between communicating parties to observe or alter traffic. That concept can be valid in another scenario, but this question is testing software or hardware that records keystrokes; Keylogger therefore fits the requirement more directly.
Question 19
Which identity-monitoring indicator in which successive logins originate from locations cannot realistically be traversed in the elapsed time?
- Password spraying
- Impossible travel
- Out-of-cycle logging
- Privilege escalation
Correct Answer: B
Correct Answer
Answer B is correct because Impossible travel means an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time. This is the precise fit for the scenario. Password spraying serves the different purpose of trying a small number of common passwords across many accounts.
Incorrect Answers
Answer A is incorrect because Password spraying refers to trying a small number of common passwords across many accounts. The question is not asking for this function. It is testing an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time, so Impossible travel is the stronger fit.
Answer C is incorrect because Out-of-cycle logging refers to security-relevant activity recorded at an unusual time compared with normal operational patterns. That concept can be valid in another scenario, but this question is testing an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time; Impossible travel therefore fits the requirement more directly.
Answer D is incorrect because Privilege escalation refers to an attack that obtains permissions beyond those originally granted. The concept is valid, but it does not match this stem. The required function is an identity-monitoring indicator in which successive logins originate from locations that cannot realistically be traversed in the elapsed time, which maps to Impossible travel.
Question 20
To recognize attack traffic that appears to originate from many legitimate reflectors, which security approach should be selected?
- DNS attack
- DDoS reflection
- Missing logs
- Birthday attack
Correct Answer: B
Correct Answer
Answer B is correct because DDoS reflection means a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing. The deciding point is functional fit: this option covers the stated need, while DNS attack addresses malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure.
Incorrect Answers
Answer A is incorrect because DNS attack refers to malicious activity targeting domain-name resolution, records, resolvers, or DNS infrastructure. The concept is valid, but it does not match this stem. The required function is a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing, which maps to DDoS reflection.
Answer C is incorrect because Missing logs refers to absence of expected telemetry or audit records. The concept is valid, but it does not match this stem. The required function is a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing, which maps to DDoS reflection.
Answer D is incorrect because Birthday attack refers to a probabilistic technique that exploits the birthday paradox to find hash collisions more efficiently than brute-forcing every possible output. The concept is valid, but it does not match this stem. The required function is a denial-of-service technique in which responses from intermediary systems are directed toward a victim using spoofed source addressing, which maps to DDoS reflection.
