Free Threat Vectors and the Supply Chain practice questions

The attack surface is every point an attacker could try to use, so a new internet-facing server enlarges it whether or not anyone ever attacks. A threat vector is the route an actual attack uses, and none has been used yet. Dwell time measures how long an intruder goes undetected, and adding a server doesn't create new attackers.

Disabling an unused service removes a possible route entirely, which shrinks the attack surface. User training, attachment sandboxing and external-sender tags all defend the email vector that remains, making that one route harder to use rather than removing routes.

Real intrusions chain vectors across stages, so a single phishing foothold can be followed by lateral movement to any server the flat network allows; that is why defense in depth closes vectors at each stage. Filtering does raise an attacker's cost, phishing is a vector rather than an attack surface, and lateral movement commonly uses stolen credentials and built-in tools, not only zero-days.

SMS has no sender authentication at all, so an attacker can make a text appear to come from a bank, a courier or the recipient's employer. Carriers don't verify senders this way, phones don't hide senders because a message has a link, and texts travel to personal phones outside the corporate email gateway entirely.

A tracking pixel is embedded content: the user sees nothing unusual while the file quietly reaches out to the attacker's server, and blocking automatic loading of remote content stops it. A QR code hides a link for a phone to open, a fake CAPTCHA talks the user into running a command, and a macro is attachment-based code rather than an image.

SPF, DKIM and DMARC are sender authentication records that let receiving servers detect and reject mail forging a domain, which is why a forged-sender scenario points to them. Link rewriting and sandboxing detonate suspicious links and files, mobile device management controls phones, and extension allow lists govern browser add-ons, so none of them checks who really sent a message.

Branded sender profiles and high-resolution images are RCS features, and the richer format makes a lure more convincing while carrying the same core risk as SMS: an untrusted link on a phone. A branded look doesn't make a link safe to open, these are text messages rather than email the gateway would inspect, and nothing places them inside a collaboration workspace.

The Mark of the Web is a flag the operating system attaches to files that came from the internet, and Office uses it to block those files' macros by default and open them in a restricted mode. It isn't a Microsoft signature on macros, a PDF watermark or a browser cookie.

RTF doesn't use Office macros, but flaws in the software that parses it have been exploited to run code the moment a file is opened, so keeping that application patched is the matching control. No content was enabled, no browser extension was involved, and a replayed session token hijacks a web session rather than running code from a document.

PDF risks come from reader flaws, embedded JavaScript and lures, so the matching defenses are a patched reader, opening untrusted files in protected or sandboxed modes, and turning off PDF JavaScript where it isn't needed. VBA macro blocking targets Office documents, autorun controls target USB media, and token binding protects browser sessions.