You are an ethical hacker at Apex Cyber Defense contracted to audit Coastal Healthcare ' s wireless estate in Miami, Florida. During a network sweep, your logs show a previously unknown access point physically connected to the hospital ' s internal switch and issuing IP addresses to devices on the corporate VLAN - it was neither provisioned by IT nor listed in the asset inventory. The device is relaying internal traffic and providing remote connectivity back to an external host. Based on the observed behavior, which wireless threat has the attacker most likely introduced?

• A. Rogue AP
• B. Misconfigured AP
• C. Honeypot AP
• D. Evil Twin AP

In a private exploit-development laboratory in Boston, Massachusetts, ethical hacker Elena Vasquez was refining a custom buffer-overflow exploit for a legacy application during the system-hacking phase of an advanced red-team engagement. To increase the reliability of the exploit and create a larger landing area for the shellcode, she needed to insert a sequence of safe instructions that would not alter the program's execution flow.
She loaded a specific Metasploit module that allowed her to generate this padding sequence in an arbitrary length and format it for inclusion in the exploit code.
What Metasploit module was Elena most likely using?

• A. Metasploit Auxiliary Module
• B. Metasploit Payload Module
• C. Metasploit Encoder Module
• D. Metasploit NOPS Module

During a controlled malware detonation test at a financial institution in New York City, ethical hacker Elena Vasquez executes a suspicious sample in a sandbox environment to observe its runtime effects on system behavior.
To identify persistence mechanisms, she compares system snapshots taken before and after execution, focusing on newly introduced entries that trigger additional components during normal system initialization.
This monitoring reveals unauthorized additions that ensure the malware reloads after system restarts, allowing her to determine how the threat maintains long-term persistence without immediate detection.
What type of host integrity monitoring is primarily being used in this analysis?

• A. Event Logs Monitoring/Analysis
• B. Port and Process Monitoring
• C. Windows Registry and Services Monitoring
• D. Startup Programs Monitoring

At Pinnacle Financial Services in Chicago, Illinois, ethical hacker Sarah Thompson is conducting a penetration test to evaluate the security of the company ' s online banking portal. During her assessment, Sarah positions herself on the internal network and uses a sniffer to capture traffic between a user's browser and the banking server. She quietly collects session data, including user IDs and authentication tokens, without interfering with the ongoing communication. Later, she plans to use this information to impersonate a legitimate user in a controlled test environment to demonstrate potential risk to the bank's IT team.
What type of session hijacking is Sarah performing during this phase of her penetration test?

• A. Man-in-the-browser Attack
• B. Passive Session Hijacking
• C. Session Fixation Attack
• D. Active Session Hijacking

As part of a cybersecurity assessment for a healthcare provider in Denver, Colorado, you are asked to recommend a framework that addresses how organizations should identify, assess, and treat information security risks as part of their ISMS. Which international standard best meets this requirement?

• A. ISO/IEC 27701:2019
• B. ISO/IEC 27001:2022
• C. ISO/IEC 27002:2022
• D. ISO/IEC 27005:2022