Social proof relies on the fact that people want to fit in and conform. If a victim sees or believes others are performing some action, they will believe it is okay for them to do it. In this case, the victim is convinced that "everyone else" is also using this website to watch a new movie, so they decide to join in. Little do they know, the penetration testing team set up this website to collect their information or load malicious code onto their laptop for a future exploit. Fear is a visceral emotion that can motivate people to act in ways they normally would not. In this scenario, the social engineer tries to convince the victim that their actions must be taken immediately, or bad consequences might occur. This is an attempt to cause fear and anxiety in the victim to hand over their password. Authority is used to take advantage of people's willingness to act when directed to by someone with the power or right to give orders. For example, an attacker may pose as a police officer, government agent, or high-level executive to force an employee to take some form of action, whether it is ethically dubious or counter to their interests. Scarcity is used to create a fear in a person of missing out on a special deal or offer. This technique is used in advertising all the time, such as "supplies are limited," "only available for the next 4 hours", and other such artificial limitations being used. OBJ. 4.8

OBJ 3.3 - Securing the parking lot with surveillance cameras and regularly monitoring the area for suspicious items helps directly address the physical security risks posed by malicious USB drives left in such spaces. Surveillance cameras act as a deterrent and provide a means to review any unauthorized activities, while regular monitoring helps identify and remove potential threats like USB drives before employees interact with them. Limiting access to the parking lot during non-work hours may reduce unauthorized entry but is less effective for detecting or addressing dropped USB drives. Implementing RFID-based access control enhances security but focuses on preventing unauthorized vehicle access rather than identifying or addressing dropped devices. Encouraging employees to report suspicious items supports awareness but relies on employee action after a potential threat is present, rather than proactively addressing the issue. OBJ. 3.3

Certificate analysis is correct because examining TLS certificates can reveal additional domains or systems using the same certificate, helping identify undisclosed assets. Directory brute forcing is incorrect because it targets web paths, not infrastructure relationships. Packet crafting is incorrect because it involves generating custom packets rather than analyzing certificates. Service exploitation is incorrect because it focuses on attacking systems, not identifying them. OBJ. 2.1

OBJ 1.1: While the fictitious Westeros may have no privacy laws or regulations, the laws of the countries where the company's customers reside may still retain sovereignty over the data obtained from those regions during the company's business there. This is called Data Sovereignty. Data sovereignty refers to a jurisdiction (such as France or the European Union) preventing or restricting processing and storage from taking place on systems that do not physically reside within that jurisdiction. Data sovereignty may demand certain concessions on your part, such as using location-specific storage facilities in a cloud service. Fail to Pass Systems will likely face steep fines from different regions if they go through with their plan to sell all of their customers' data to the highest bidders. Fail to Pass Systems may even be blocked from communicating with individual regions. Although data minimization and data limitation policies may be violated depending on the company's internal policies, these policies are not legally binding like the provisions of GDPR are. Data enrichment means that the machine analytics behind the view of a particular alert can deliver more correlating and contextual information with a higher degree of confidence, both from within the local network’s data points and from external threat intelligence. OBJ. 1.1

Perform an authenticated scan to access more detailed system information is correct because authenticated scans leverage valid credentials to log into target systems and perform in-depth configuration and patch analysis, significantly reducing false negatives that commonly occur in unauthenticated scans. Increasing concurrent scans affects speed, not visibility into internal configurations. Changing tools does not address the root issue of limited host-level access. Re-scanning with different scan types modifies port-scanning techniques but does not provide deeper configuration or patch-level insight required for comprehensive vulnerability validation. OBJ. 3.2

OBJ 4.1: Developing an attack path for each vulnerability helps Ted visualize and compare how different vulnerabilities could be exploited and what the potential outcomes might be. This step is crucial in prioritizing his actions based on risk and potential impact. While the other options are useful, they should follow after the attack paths are mapped out and analyzed. OBJ. 4.1

Phishing is correct because the email is broadly distributed, generic in nature, and not tailored to specific individuals. Additionally, phishing campaigns target large groups in hopes that some recipients will respond, regardless of whether the message is contextually accurate. Spear phishing is incorrect because it involves targeted, personalized messages crafted for specific individuals or roles. Whaling is incorrect because it specifically targets senior executives or high-value individuals. Brute force is unrelated, as it involves repeated password guessing attempts rather than deceptive email-based social engineering. OBJ. 4.8

Container image scan is correct because the output references image layers and known CVEs within packaged components. Network port scan is incorrect because it identifies open ports. Dynamic application scan is incorrect because it analyzes runtime behavior of applications. Wireless scan is incorrect because it targets wireless networks. OBJ. 3.1

OBJ 4.4: Unquoted service path injection involves exploiting an unquoted service path in Windows, which can allow an attacker to place a malicious executable in a path that gets executed instead of the intended service. Joel is using this vulnerability to gain persistent access. Shell escape and log tampering are unrelated, while DLL hijacking involves manipulating the way applications load dynamic-link libraries. OBJ. 4.4

Based on the scenario, we can eliminate evil twin (focused on wireless access points) and IP spoofing (since this affects layer 3 traffic). While MAC spoofing the gateway's address might work, it would also affect every computer on this subnet. ARP poisoning (also known as ARP spoofing) is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network. By conducting an ARP spoofing, Rick can poison the cache and replace Mary's computer's MAC address and IP binding association with his own, allowing him to complete an on-path attack between Mary and the default gateway. OBJ. 4.2