Attack Vectors and Threat Modeling Questions

Demonstrate knowledge of common attacker techniques and how to reason about attacker goals and likely paths. Topics include phishing and social engineering, credential stuffing and brute force attacks, malware and malicious binaries, privilege escalation and lateral movement, network based tunneling and data exfiltration patterns, and how to construct and analyze threat models and attack surfaces. Candidates should be able to map attack vectors to defensive controls, assess risk, and describe mitigation strategies.