Common attack types: tell them apart on exams
Attack-type questions describe what the attacker did and ask you to name the attack, or name the control that stops it. The decision rule: ignore the story and find the one mechanism, meaning what was abused (a person, a password, an input field, a session, a network position, a resource limit), then match it to the name. Most wrong answers are lookalike attacks that abuse something different.
Clue-to-attack lookup
Read the scenario for the thing that was tricked or exhausted.
| What the scenario describes | Attack | What was abused | Typical control |
|---|---|---|---|
| Email with a fake login link sent to many people | Phishing | User trust | Awareness training, mail filtering, MFA |
| Same, but aimed at one named person using personal details | Spear phishing | User trust, targeted | Same, plus verification of unusual requests |
| Same, aimed at a senior executive | Whaling | Authority | Same, plus out-of-band approval for payments |
| Phone call or text message instead of email | Vishing, smishing | User trust | Call-back procedures, training |
| Text typed into a form changes a database query | SQL injection | Unvalidated input mixed into a query | Parameterised queries, input validation |
| A script placed in a page runs in other users’ browsers | Cross-site scripting (XSS) | Trust the browser has in the site | Output encoding, input validation, content security policy |
| A logged-in user’s browser is made to send a request they did not intend | Cross-site request forgery (CSRF) | Trust the site has in the browser’s session | Anti-CSRF tokens, SameSite cookies |
| Attacker sits between two parties and reads or changes traffic | On-path (man-in-the-middle) | Network position | TLS, certificate validation, switch protections |
| Thousands of requests from many hosts make a service unavailable | Distributed denial of service (DDoS) | Capacity | Upstream scrubbing, rate limiting, scaling |
| Many accounts tried with a few common passwords | Password spraying | Weak passwords, lockout thresholds | MFA, banned password lists, smart lockout |
| One account tried with many passwords | Brute force | Weak password | Lockout, MFA |
| Passwords leaked from site A tried on site B | Credential stuffing | Password reuse | MFA, unique passwords, breach detection |
| Captured session token or cookie reused | Session hijacking, replay | Stolen token | Short token lifetime, token binding, TLS |
Attacker supplies a path such as ../../ to reach other files | Directory traversal | Unvalidated path | Input validation, least-privilege file access |
| A host answers ARP requests for the gateway’s address and traffic starts flowing through it | ARP spoofing (poisoning) | Unauthenticated ARP on the local segment | Dynamic ARP inspection, port security |
| Files encrypted, payment demanded | Ransomware | Availability of data | Offline backups, patching, least privilege |
The lookalike pairs that cost marks
XSS versus CSRF. In XSS the attacker’s script runs inside the victim’s browser, in the context of a trusted site. In CSRF no script of the attacker runs; the victim’s browser is tricked into sending a forged request using a session it already has. XSS abuses the user’s trust in the site; CSRF abuses the site’s trust in the user’s browser.
Password spraying versus brute force. Brute force is many passwords against one account and trips account lockout quickly. Spraying is one or two passwords against many accounts, so each account sees few failures and lockout rarely triggers. “Many accounts, few attempts each” is the signature.
Phishing family. The variants differ only by channel and target. Email is phishing, voice is vishing, SMS is smishing, a single chosen victim is spear phishing, an executive is whaling. A QR code in a message is quishing. The control is the same family: training, filtering and MFA.
DoS versus DDoS. One source is DoS; many distributed sources is DDoS. Blocking one IP address can stop a single-source DoS but not a DDoS, which is why scenarios mentioning thousands of sources want upstream filtering or a protection service.
On-path versus replay. On-path means the attacker sits in the live conversation. Replay means a captured valid message or token is sent again later. Nonces, timestamps and short-lived tokens stop replay.
Worked example: reading one scenario
“Users of a retail site report that, after viewing product reviews, their accounts place orders they did not make. The site logs show that the review text of one product contains a script tag.”
- What was abused? A script stored in site content ran in other users’ browsers. That is XSS (stored, in fact, because the script lives in the review).
- Which options are distractors? CSRF also produces unwanted actions, but it needs no script on the page, only a forged request. SQL injection would show up in database errors or leaked records.
- What stops it? Encode output so the review is displayed as text, and validate input.
The same three questions work on every item: what was abused, which lookalikes fit but abuse something else, and which control addresses the abused thing. Controls that sound strong but address a different mechanism, such as encrypting the database against XSS, are the usual wrong answers.
Exam traps and constraint words
- “Without user interaction” rules out phishing and CSRF-style tricks and points to something that exploits a service directly.
- “Legitimate-looking request from an authenticated user” points to CSRF or session abuse.
- “Unvalidated input” is the generic cause behind injection, XSS and traversal; the output or query context decides which one.
- “Most effective control” for credential attacks is almost always MFA, not a longer password policy.
- Newer AI-related attacks, such as prompt injection and data poisoning, appear in SY0-801 objective 2.6 and CY0-001 objective 2.6 and follow the same logic: find what was abused, in this case instructions or training data.
Which exams test this
| Exam | How the topic appears | Where it is covered on this site |
|---|---|---|
| SY0-801 | Threats, Vulnerabilities, and Attacks domain (24%), objective 2.5: indicators of malware, network, social engineering, application and credential attacks, including on-path, DDoS, phishing variants, injection, replay, directory traversal and password spraying; objective 2.6 adds AI threats such as prompt injection and poisoning | SY0-801 threats, vulnerabilities and attacks explained |
| N10-009 | Network Security domain (14%), objective 4.2: summarise network attacks and their impact, including DoS/DDoS, ARP and DNS spoofing or poisoning, rogue DHCP and access points, evil twin, on-path and phishing | N10-009 network security explained |
| 200-901 | Application Deployment and Security domain (15%), objective 4.10: describe the top OWASP threats, naming XSS, SQL injection and CSRF | 200-901 application deployment security explained |
| 200-301 | Minor topic. Layer 2 security features (DHCP snooping, dynamic ARP inspection, port security): objective 5.7 in Security Fundamentals in v1.1 (until Feb 2, 2027), objective 4.7 in Network Services and Security in v2.0 (from Feb 3, 2027). The exam tests the features; the attacks they stop, rogue DHCP and ARP spoofing, are the context | 200-301 network services security explained |
| CY0-001 | Securing AI Systems domain (40%), objective 2.6: analyse evidence of attacks on AI systems, such as prompt injection, poisoning, jailbreaking, model inversion and model theft, and suggest compensating controls | CY0-001 securing AI systems explained |
Two practice questions
Question 1. A security analyst notices that over a weekend one common password was tried once against each of 4,000 accounts, and almost no account reached its lockout threshold. Which attack is this?
- A. Brute force
- B. Credential stuffing
- C. Password spraying
- D. Distributed denial of service
Show answer
Answer: C
One password against many accounts, with few failures per account, is password spraying; it is designed to stay under lockout thresholds. Brute force concentrates many attempts on a single account and would trigger lockout. Credential stuffing uses username and password pairs leaked from another service, not one guessed password. A DDoS aims at availability, not account access.
Question 2. An attacker emails a logged-in customer a link. Opening it makes the customer's browser send a request to the bank site that changes the customer's payout address. The attacker's code never runs on the bank site. Which control best prevents this?
- A. Anti-CSRF tokens on state-changing requests
- B. Output encoding of user-supplied content
- C. Parameterised database queries
- D. Rate limiting for volumetric traffic
Show answer
Answer: A
The bank site accepted a forged request because the browser carried a valid session; this is CSRF. Anti-CSRF tokens, which a forged request cannot supply, stop it. Output encoding defends against XSS, where script runs in the page. Parameterised queries defend against SQL injection. Rate limiting addresses volumetric traffic and availability, not forged requests.
Go deeper
- OWASP Top 10
- MITRE ATT&CK, a catalogue of attacker tactics and techniques
- Related guides: incident response lifecycle, MFA, passwordless and passkeys, cryptography basics and Zero Trust explained.