312-50v13 Practice Test practice questions, page 26 of 42, with answer review and explanations.
Question 126
A regional healthcare provider in Phoenix began experiencing intermittent outages affecting its patient portal. Network monitoring showed an abrupt surge of traffic consisting of short, stateless datagrams directed at random service ports across multiple edge-facing servers. Unlike connection-oriented attacks, there was no evidence of incomplete handshakes or abnormal session buildup. Instead, the attack traffic simply consumed available upstream capacity through sheer packet volume, preventing legitimate users from reaching the web platform. Based on the observed behavior, determine the most likely attack technique.
NTP amplification attack
Ping of Death attack
ICMP flood attack
UDP flood attack
Question 127
An enterprise logistics company in Nashville, Tennessee recently rolled out an automation update across its internal administrative systems. Within days, performance monitoring tools began reporting sporadic spikes in outbound connections and short-lived execution chains tied to a built-in scripting utility. Security teams conducted full disk scans and integrity checks but found no unfamiliar executables or altered application binaries. Closer inspection of live system activity revealed that encoded command sequences were being executed within trusted system processes. The activity ceased after a restart but reappeared when similar administrative actions were triggered. Identify the malware category that best aligns with this operational pattern.
Rootkit
Trojan
Fileless Malware
Worm
Question 128
An enterprise organization in Chicago deploys a WPA2-Enterprise wireless network integrated with a centralized authentication server to validate user credentials through 802.1X. A security consultant is tasked with assessing the resilience of the authentication workflow. While monitoring wireless traffic near the facility, the consultant captures a successful authentication exchange between a legitimate employee device and the authentication infrastructure. Instead of attempting to derive credentials or modify packet contents, the consultant retransmits portions of the previously observed authentication messages to the network under controlled conditions. The access point processes the retransmitted authentication sequence in a manner that suggests acceptance of reused authentication data rather than rejecting it as stale or duplicated. Identify the wireless attack technique demonstrated in this assessment.
RADIUS Replay Attack
Bit-Flipping Attack
Data Frame Injection
Initialization Vector Replay Attack
Question 129
A healthcare technology company deploys internet-connected cardiac monitoring devices across several hospitals in Minneapolis, Minnesota. During a controlled security review, an analyst discovers that administrative configuration features can be accessed remotely through components that interact with external management platforms. Further analysis reveals that these externally reachable components process user-supplied data without sufficient validation checks. Additionally, authentication controls protecting remote configuration features rely solely on basic credential verification without additional safeguards against automated misuse. According to the OWASP Top 10 IoT Vulnerabilities, how should this weakness be classified?
Insecure Ecosystem Interfaces
Insecure Default Settings
Insecure Network Services
Lack of Device Management
Question 130
During a penetration test, an analyst repeatedly initiates TCP connections to a target host and records the sequence numbers returned in the SYN/ACK responses. By examining predictable or incremental patterns in these values, the analyst attempts to infer characteristics of the underlying operating system. What OS fingerprinting attribute is being analyzed in this scenario?