Start Here
Six review stations, each a different way to practice Chapter 3. Work through them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or the exam.
What this chapter asked you to be able to do
- Identify message-based vectors: phishing, spear-phishing, whaling, Business Email Compromise (BEC), vishing, and smishing.
- Analyze image, attachment, and browser vectors, including malicious QR codes, Office macros, drive-by downloads, and cross-site scripting.
- Explain network and remote access vectors, including DNS hijacking, RDP exposure, and VPN credential compromise.
- Assess endpoint, supply chain, wireless, and physical vectors that expand the attack surface beyond the network boundary.
- Categorize application and credential vulnerabilities and prioritize mitigation by likelihood and impact.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Matching Scenarios to the Threat Vector
Each scenario describes how an attacker reaches a target. Read it and choose the vector it describes, then check your answer.
Matching Web Application and Credential Attacks
These vectors target the application code and the login itself. Read each description and choose the attack or vulnerability it defines, then check your answer.
Reference: credential attacks at a glance
| Attack | What the attacker starts with | How it works |
|---|---|---|
| Credential stuffing | Real username and password pairs from a past breach | Reuses them against other services, hoping for password reuse. |
| Password spraying | A short list of common passwords | Tries each common password across many accounts to avoid lockouts. |
| Brute-force attack | No passwords, just time and compute | Systematically tries all possible combinations against an account. |
| Credential replay | Credentials captured over an unencrypted channel | Replays the intercepted credentials to authenticate without knowing the password. |
Multi-factor authentication weakens all four, because a stolen or guessed password alone is no longer enough to log in.
Knowledge Check
Ten multiple-choice questions across the whole chapter. Answer them all, then select Score my answers for feedback and a final total.