OBJ 4.9: Bluejacking is an attack where an attacker sends unsolicited messages to Bluetooth-enabled devices. The goal is usually to annoy the recipient rather than gain unauthorized access or deploy malware. Intercepting data between devices is more aligned with attacks like eavesdropping. OBJ. 4.9

OBJ 1.5: Linux systems use the sshd (SSH daemon) to provide ssh connectivity. If Tim changes the sshd_config to deny root logins, it will still allow any authenticated non-root user to connect over ssh. The sshd service has a configuration setting that is named PermitRootLogin. If you set this configuration setting to no or deny, all root logins will be denied by the ssh daemon. If you didn't know about this setting, you could still answer this question by using the process of elimination. An iptables rule is a Linux firewall rule, and this would block the port for ssh, not the root login. Adding root to the sudoers group won't help either since the sudoers group allows users to login as root. If you have a network IPS rule to block root logins, the IPS would have to see the traffic being sent within the SSH tunnel. This is not possible since SSH connections are encrypted end-to-end by default. Therefore, the only possible right answer is to change the sshd_config setting to deny root logins. OBJ. 1.5

OBJ 1.5: The gpupdate command refreshes a computer's local Group Policy and any Active Directory-based group policies. This command works on Windows systems. The gpupdate command can be used to restrict access to USB removable storage devices (like USB thumb drives and hard drives). In some organizations, USB storage devices are blocked for security reasons to prevent security leakage of confidential data and the penetration of viruses into the internal corporate network. A Group Policy is the primary administrative tool for defining and controlling how programs, network resources, and the operating system operate for users and computers in an organization. In an active directory environment, Group Policy is applied to users or computers based on their membership in sites, domains, or organizational units. The gpresult command is used to display the Resultant Set of Policy (RSoP) information for a remote user and computer. Because you can apply overlapping policy settings to any computer or user, the Group Policy feature generates a resulting set of policy settings when the user logs on. The gpresult command displays the resulting set of policy settings that were enforced on the computer for the specified user when the user logged on. The diskpart command is a command-line disk-partitioning utility available for Microsoft operating systems. You can use it to view, create, delete, and modify a computer's disk partitions. The system file checker (SFC) command is a utility in Windows that allows users to scan for and restore corrupted Windows system files from the command line. OBJ. 1.5

NFC is correct because Near Field Communication is specifically designed for very short-range wireless communication, typically within 4 inches (10 centimeters), and is commonly used for contactless payments and secure badge interactions. Zigbee is incorrect because it is a low-power wireless protocol used for IoT and mesh networking over longer distances than a few centimeters. Wi-Fi is incorrect because it supports wireless networking over significantly greater ranges and does not require close physical proximity. RFID is incorrect because while it uses radio-frequency identification, it can operate over a broader range of distances depending on tag type and does not specifically require the very close proximity characteristic of NFC-based tap interactions. OBJ. 4.9

An XML External Entity (XXE) attack was successfully used to retrieve local system files is correct because the presence of an entity reference such as &abc; following a DOCTYPE declaration fragment (]>) indicates that the application is processing external entities, allowing an attacker to define and resolve entities that point to local files like /etc/passwd. The character encoding limited the application to Latin-based input, restricting exploitation attempts is incorrect because encoding does not mitigate entity expansion attacks. The application properly sanitized input using parameterized queries to prevent injection is incorrect because parameterized queries do not apply to XML parsing and the attack clearly succeeded. The retrieved file does not contain sensitive data and does not pose a risk is incorrect because even partial file disclosure can aid further exploitation and reconnaissance. OBJ. 4.5

OBJ 4.4: A Modbus attack targets systems that use the Modbus protocol, which is commonly found in ICS (Industrial Control System) environments. This protocol often lacks strong security measures, making it susceptible to unauthorized commands and data manipulation. The other options do not specifically target the systems involved. OBJ. 4.4

Tailgating is correct because the unauthorized individual gained physical access to a restricted area by following closely behind an authorized person without using their own credentials, thereby bypassing access controls. Shoulder surfing is incorrect because it involves observing someone enter sensitive information, such as passwords or PINs, rather than physically entering a secured area. Impersonation is incorrect because there is no indication that the individual pretended to be someone else to gain trust or access. Spoofing is incorrect because it involves falsifying digital identifiers, such as IP address or email addresses, and does not apply to physical access control bypass. OBJ. 4.8

OBJ 1.5: C and C++ contain built-in functions such as strcpy that do not provide a default mechanism for checking if data will overwrite the boundaries of a buffer. The developer must identify such insecure functions and ensure that every call made to them by the program is performed securely. Many development projects use higher-level languages, such as Java, Python, and PHP. These interpreted languages will halt execution if an overflow condition is detected. However, changing languages may be infeasible in an environment that relies heavily on legacy code. By ensuring that the operating system supports ASLR, you can make it impossible for a buffer overflow to work by randomizing where objects in memory are being loaded. Rewriting the source code would be highly desirable but could be costly, time-consuming, and would not be an immediate mitigation to this problem. The strcpy function (which is short for String copy) does not work on integers, and it only works on strings. As strcpy does not check for boundary conditions, buffer overflows are certainly possible using this deprecated method. OBJ. 1.5

Service version detection scan is correct because additional scanning (such as -sV) is required to identify the software and versions running on open ports. Packet capture is incorrect because it analyzes traffic, not service versions. Reverse DNS lookup is incorrect because it resolves hostnames, not services. Host discovery scan is incorrect because it only identifies live hosts. OBJ. 2.2

OBJ 2.3 - A for loop is ideal here because it works well for going through a defined list of lines (IP addresses). A while loop is better for tasks where the number of items is uncertain, and a do-while loop is not typically suited for reading files in this way. OBJ. 2.3