WGU D484 Penetration Testing (Latest
Update ) Questions & Answers
{Grade A} 100% Correct
What are some ways in which a malicious actor can compromise cloud storage
containers? (Select all that apply.)
A.Secrets management
B.Misconfiguration
C.Power Consumption
D.OS Images - Correct answer A.Secrets management
B.Misconfiguration
D.OS Images
Improperly managed secrets such as API keys, tokens, and passwords, can cause
container security risks and vulnerabilities that a malicious actor can take advantage of
to compromise cloud storage containers.
A misconfiguration when setting up or administering a cloud storage container can
create a risk for unauthorized access.
,Improperly constructed OS images that contain non-essential software can cause
container security risks and vulnerabilities that a malicious actor can take advantage of
to compromise cloud storage containers.
Knowledge about the power consumption of a device would not allow the container to
be compromised.
A malicious actor compromised a virtual machine host which allowed the malicious
actor to gain control of the virtual environment. What type of attack does this represent?
(Select all that apply.)
A.Hyperjacking
B.Class 1
C.VM escape
D.Class 3 - Correct answer A.Hyperjacking
B.Class 1
This represents hyperjacking which is when a malicious actor takes control of the
hypervisor that manages a virtual environment and then has all the required privileges
to take full control of the environment.
,This represents a class 1 virtual environment attack in which the attack happens outside
of the virtual machine and can affect the entire virtual environment.
A city's subway system is optimizing the way equipment at each of the subway stations
handles data. The new system will allow the subway system to collect data to
automatically delay or stop trains when there is a problem down the line, as well as to
determine when to dispatch more trains to manage capacity. What concept merges the
control of functionality with the data collecting ability of a device?
A.ICS
B.SCADA
C.IIoT
D.IoT - Correct answer C.IIoT
The subway system is optimizing with the Industrial Internet of Things (IIoT) or Industry
4.0, which is a complement to a SCADA system and merges the control functionality with
the data collecting ability of an IoT device.
An industrial control system (ICS) is any system that enables users to control industrial
and critical infrastructure assets over a network.
, A Supervisory control and data acquisition (SCADA) system is a type of ICS that manages
large-scale, multiple-site devices and equipment spread over geographically large
areas from a host computer.
Security risks to web applications are common. Which does the OWASP deem as the
most critical? (Select all that apply.)
A.Insecure Data Transmission
B.Lack of Error Handling
C.Secure design
D.Lack of Code Signing - Correct answer A.Insecure Data Transmission
B.Lack of Error Handling
An administrator configured the system to lock out accounts for 30 minutes after 3
unsuccessful login attempts, but the system did not lock out accounts after three
unsuccessful attempts and a threat actor took advantage of this failure to compromise
a user's password. What does this represent?
A.Business logic flaw
B.Horizontal privilege escalation
Update ) Questions & Answers
{Grade A} 100% Correct
What are some ways in which a malicious actor can compromise cloud storage
containers? (Select all that apply.)
A.Secrets management
B.Misconfiguration
C.Power Consumption
D.OS Images - Correct answer A.Secrets management
B.Misconfiguration
D.OS Images
Improperly managed secrets such as API keys, tokens, and passwords, can cause
container security risks and vulnerabilities that a malicious actor can take advantage of
to compromise cloud storage containers.
A misconfiguration when setting up or administering a cloud storage container can
create a risk for unauthorized access.
,Improperly constructed OS images that contain non-essential software can cause
container security risks and vulnerabilities that a malicious actor can take advantage of
to compromise cloud storage containers.
Knowledge about the power consumption of a device would not allow the container to
be compromised.
A malicious actor compromised a virtual machine host which allowed the malicious
actor to gain control of the virtual environment. What type of attack does this represent?
(Select all that apply.)
A.Hyperjacking
B.Class 1
C.VM escape
D.Class 3 - Correct answer A.Hyperjacking
B.Class 1
This represents hyperjacking which is when a malicious actor takes control of the
hypervisor that manages a virtual environment and then has all the required privileges
to take full control of the environment.
,This represents a class 1 virtual environment attack in which the attack happens outside
of the virtual machine and can affect the entire virtual environment.
A city's subway system is optimizing the way equipment at each of the subway stations
handles data. The new system will allow the subway system to collect data to
automatically delay or stop trains when there is a problem down the line, as well as to
determine when to dispatch more trains to manage capacity. What concept merges the
control of functionality with the data collecting ability of a device?
A.ICS
B.SCADA
C.IIoT
D.IoT - Correct answer C.IIoT
The subway system is optimizing with the Industrial Internet of Things (IIoT) or Industry
4.0, which is a complement to a SCADA system and merges the control functionality with
the data collecting ability of an IoT device.
An industrial control system (ICS) is any system that enables users to control industrial
and critical infrastructure assets over a network.
, A Supervisory control and data acquisition (SCADA) system is a type of ICS that manages
large-scale, multiple-site devices and equipment spread over geographically large
areas from a host computer.
Security risks to web applications are common. Which does the OWASP deem as the
most critical? (Select all that apply.)
A.Insecure Data Transmission
B.Lack of Error Handling
C.Secure design
D.Lack of Code Signing - Correct answer A.Insecure Data Transmission
B.Lack of Error Handling
An administrator configured the system to lock out accounts for 30 minutes after 3
unsuccessful login attempts, but the system did not lock out accounts after three
unsuccessful attempts and a threat actor took advantage of this failure to compromise
a user's password. What does this represent?
A.Business logic flaw
B.Horizontal privilege escalation
