Attack surfaces and vectors in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Attack Surfaces

Which of the following best describes an attack surface in cybersecurity?

A The physical location of servers hosting the system.

B The list of software licenses used by the system.

C All the points where an unauthorized user can try to enter or extract data from a system.

D The total number of vulnerabilities in a system's codebase.

💡 Hint

Think about where an attacker can interact with a system.

An attack surface includes all the points where an attacker can try to access or extract data from a system. It is not just about code vulnerabilities but all possible entry points.

📋 Factual

intermediate

Common Attack Vectors

Which of the following is not typically considered an attack vector?

A Regular software updates applied by the IT team.

B Open network ports accessible from the internet.

C Phishing emails sent to employees.

D Malicious USB devices plugged into company computers.

💡 Hint

Attack vectors are ways attackers gain access, not protective actions.

Regular software updates are a security measure, not an attack vector. The other options are common ways attackers try to breach systems.

🔍 Analysis

advanced

Evaluating Attack Surface Reduction

A company disables unused network services and closes unnecessary ports on its servers. What is the primary effect of this action on the attack surface?

A It shifts the attack surface to physical security vulnerabilities.

B It increases the attack surface by adding more entry points.

C It has no effect on the attack surface.

D It reduces the attack surface by limiting possible entry points.

💡 Hint

Think about how fewer open services affect potential access points.

Disabling unused services and closing ports reduces the number of ways attackers can access the system, thus reducing the attack surface.

❓ Reasoning

advanced

Identifying Attack Vectors in a Scenario

In a scenario where an attacker gains access by tricking an employee into clicking a malicious link, which attack vector is being exploited?

A SQL injection

B Social engineering

C Denial of Service

D Man-in-the-middle

💡 Hint

Consider how the attacker manipulates human behavior.

Social engineering involves manipulating people to gain unauthorized access, such as tricking employees into clicking malicious links.

❓ Comparison

expert

Comparing Attack Surfaces in Cloud vs On-Premises

Which statement best compares the attack surfaces of cloud-based systems versus on-premises systems?

A Cloud systems may have a larger attack surface due to shared resources and internet exposure.

B On-premises systems have a smaller attack surface because they are physically isolated.

C Cloud systems have no attack surface because the provider handles security.

D On-premises systems always have a larger attack surface due to outdated hardware.

💡 Hint

Think about how cloud systems are accessed and shared.

Cloud systems often have a larger attack surface because they rely on internet access and shared infrastructure, which can expose more entry points compared to isolated on-premises systems.