A multinational healthcare provider headquartered in Boston, Massachusetts relies on federated authentication to allow employees to access multiple cloud-hosted applications using a single sign-on portal. During an authorized red team engagement, a security consultant gains access to the organization's identity infrastructure and extracts signing material used in trust relationships between the internal identity provider and external cloud services.
Using this material, the consultant generates authentication responses that grant administrative-level access to several cloud applications without interacting with user credentials or triggering multifactor authentication challenges. The access appears legitimate within the cloud service logs.
Which cloud attack technique best aligns with this behavior?

• A. Cloud Hopper Attack
• B. Golden SAML Attack
• C. Living off the Cloud (LotC) Attack
• D. Man-in-the-Cloud (MITC) Attack

A security consultant is conducting an authorized assessment for a healthcare billing provider in Phoenix, Arizona. While monitoring internal traffic, he observes an authenticated employee interacting with a sensitive web-based management portal over TCP.
During the session, the consultant carefully crafts and injects packets into the ongoing communication stream.
Shortly afterward, the legitimate user experiences irregular responses from the application, and the server begins processing commands originating from the consultant's injected traffic as though they were part of the established session.
The technique does not involve credential guessing or forcing the user to reauthenticate. Instead, it targets the communication channel already in progress.
From a network-level perspective, what type of session hijacking technique is being demonstrated?

• A. TCP/IP Hijacking
• B. Blind Hijacking
• C. UDP Hijacking
• D. RST Hijacking

During an external assessment of a healthcare insurance company in Houston, a penetration tester identifies a service running on TCP port 389. When queried, the service accepts anonymous binds and reveals directory data. By structuring his search filter, the tester is able to obtain usernames, departmental details, and organizational units. This information could potentially be used for targeted password attacks or privilege escalation.
Which classification best describes this enumeration activity?

• A. NTP Enumeration
• B. SMTP Enumeration
• C. DNS Enumeration
• D. LDAP Enumeration

A security assessment at a manufacturing firm in Pittsburgh, Pennsylvania, reveals that several network appliances respond to external management queries and return detailed operational information such as device identifiers and interface statistics.
Further analysis shows that the appliances use legacy management settings that permit unauthenticated read access through widely known community strings. The security team decides to implement a control that prevents unauthorized systems from retrieving management information while still allowing legitimate administrative monitoring.
What countermeasure best mitigates this enumeration risk?

• A. Use SSL or STARTTLS to encrypt directory-service traffic
• B. Upgrade to SNMPv3, which provides authentication and message privacy
• C. Implement NFS tunneling through SSH to encrypt file-system traffic
• D. Use Transport Layer Security (TLS) to encrypt communication with the SMTP server