Security+ PBQ 2: Threats and Mitigations

Scenario

A security analyst reviews several alerts from email security, web application logs, identity logs, and endpoint protection. Management wants the best immediate mitigation for each issue.

Your task: Match each symptom to the threat type or mitigation.

Evidence	Source
Fake vendor invoice from a look-alike executive address	Email gateway
Login from Chicago and Tokyo within 20 minutes	Identity provider
Database error after apostrophe in login field	Web app log

1. Fake executive email requesting urgent payment is most likely:

2. A malicious text message asking users to verify credentials is:

3. User input changes a database query and exposes records. Attack type:

4. Same account logs in from distant countries too quickly. Indicator:

Controls

5. Encrypted files and payment demand on multiple workstations indicate:

6. Best way to limit malware movement between departments:

7. Best control to prevent unauthorized executables from running:

8. First hardening step for newly installed IoT cameras:

Instructor Answer

Business email compromise uses impersonation to trigger payments or data release.
Text-message phishing is smishing.
Database query manipulation through input is SQL injection.
Impossible travel can indicate credential compromise.
Encrypted files plus a payment demand point to ransomware.
Segmentation limits lateral movement.
An application allow list blocks unapproved software from running.
Default passwords should be changed during hardening.