AI Platform Security Engineer Test

What does the following pseudo code print?

Here are three pseudocodes for calculating the Nth Fibonacci number. Which of the following statements about these codes are true?

A: Time complexity/efficiency of CODE 1, CODE 2, CODE 3 is the same.
B: CODE 2 is more space-efficient than CODE 3.
C: CODE 3 is more space-efficient than CODE 2.
D: CODE 2 is more time-efficient than CODE 1.
E: CODE 3 is more time-efficient than CODE 1.

Go through the following faulty palindrome detection pseudocode and test cases. For which of the test cases would the code return true?

Testcases
A: a
B: aba
C: aaa
D: aac

A new popular app tracks the activities performed by its users and grants them rewards based on each individual's total activities performed in a year. This data is maintained in a database table (activitesinfo), with the following columns: userid, totalactivities, reward. This year, due to fundraising activity, the company has decided to further reward its users by enhancing the reward as per the following formula: If reward < = 4000, increase it by 2%, If 4000 < reward <= 8000, increase it by 4%, If reward > 8000, increase it by 6%.
The tech team has written three different scripts to calculate increment for each slab, each script is to run as a separate transaction. Here are the three scripts:

Script 1:
For users with reward <= 4000, set reward = reward * 1.02

Script 2:
For users with reward > 4000 and reward <= 8000, set reward = reward * 1.04

Script 3:
For users with reward > 8000, set reward = reward * 1.06

Each script is to be executed separately. Which of the following options will update the rewards as expected:

A: Execute Script 1 followed by Script 2 followed by Script 3
B: Execute Script 2 followed by Script 3; Script 1 running concurrently throughout
C: Execute Script 3 followed by Script 2; Script 1 running concurrently throughout
D: Execute Script 3 followed by Script 2 followed by Script 1
E: Execute Script 2 followed by Script 3 followed by Script 1

As a senior DevOps engineer, you are tasked with diagnosing performance issues on a Linux server running Ubuntu 20.04. The server hosts several critical applications, but lately, users have been experiencing significant slowness. Initial monitoring shows that CPU and memory utilization are consistently high. To identify the root cause, you check the output of `top` and `ps` commands, which indicate that a particular process is consuming an unusually high amount of resources. However, the process name is generic and does not clearly indicate which application or service it belongs to. You also examine `/var/log/syslog` for any unusual entries but find nothing out of the ordinary. Based on this situation, which of the following steps would most effectively help you identify and resolve the performance issue?

A: Increase the server's physical memory and CPU capacity.
B: Use the `lsof` command to identify the files opened by the suspect process.
C: Reboot the server to reset all processes.
D: Examine the `/etc/hosts` file for any incorrect configurations.
E: Run the `netstat` command to check for abnormal network activity.
F: Check the crontab for any recently added scheduled tasks.

You are in charge of developing a Bash script for setting up a continuous integration pipeline for a web application. The source code is hosted in a Git repository. The script's goals include:

1. Ensuring the local copy of the repository in /var/www/html is updated to the latest version.
2. Creating a .env file with APP_ENV=production in the project root if it doesn't already exist.
3. Running a test suite with ./run_tests.sh and handling any test failures appropriately.
4. Logging the current timestamp and commit hash in deployment_log.txt in the project root if tests pass.

Which of the following script options would most effectively and safely accomplish these tasks?

You are a cybersecurity officer and a new third-party payment gateway is integrated into your company's e-commerce website. The payment gateway API is hosted on a different domain (pay-gateway.com) than your e-commerce site (my-ecommerce.com). You receive some reports that users are unable to complete their transactions intermittently. 

You obtain the following set of HTTP cookies from an affected user:

1. user_session=1; Domain=my-ecommerce.com; Path=/; Secure; HttpOnly
2. payment_session=xyz123; Domain=pay-gateway.com; Path=/; Secure; HttpOnly
3. cart_id=abcd1234; Domain=my-ecommerce.com; Path=/; Secure
4. csrf_token=efgh5678; Domain=my-ecommerce.com; Path=/; Secure
5. currency=USD; Domain=my-ecommerce.com; Path=/;
6. same_site_test=1; Domain=my-ecommerce.com; Path=/; Secure; SameSite=None
7. payment_verification=; Domain=my-ecommerce.com; Path=/; Secure; HttpOnly

Which of the following configuration modifications would likely solve the intermittent transaction failure issue?

A: Set SameSite=Strict attribute on all cookies.
B: Set "SameSite=None; Secure" attribute on the payment_session cookie.
C: Change the Domain attribute of payment_session cookie to my-ecommerce.com.
D: Set HttpOnly attribute on cart_id and csrf_token cookies.
E: Remove Secure attribute from user_session cookie.

You are the security analyst for a company and are currently investigating a security incident. You found the following log entries in your HTTP server logs, which appear to be linked to the incident:

1. 192.0.2.4 - - [24/May/2023:13:15:30 +0000] "GET /wp-login.php HTTP/1.1" 200 167 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; yie8)"
2. 192.0.2.4 - - [24/May/2023:13:15:31 +0000] "POST /wp-login.php HTTP/1.1" 302 152 "http://www.example.com/wp-login.php" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; yie8)"
3. 192.0.2.4 - - [24/May/2023:13:15:32 +0000] "GET /wp-admin/install.php HTTP/1.1" 200 125 "http://www.example.com/wp-admin/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; yie8)"

Based on this information, which of the following statements are correct?

A: The attacker was unable to compromise the Wordpress login page but was successful in accessing the installation page.
B: The attacker attempted to login to a Wordpress site and, despite the login failing, was able to access the Wordpress installation page.
C: The attacker was attempting a dictionary attack on the Wordpress site and accessed the Wordpress installation page.
D: The logs indicate that the attacker was able to compromise the Wordpress login and directly access the installation page.
E: The attacker attempted to login to a Wordpress site, succeeded, and then tried to access the Wordpress installation page.

You are a cybersecurity engineer working on a network traffic analysis case. You have been given the following set of observations from network logs of the past 24 hours:

- Observation 1: 1,000,000 DNS requests were recorded, 50% more than the usual daily traffic.
- Observation 2: 85% of these DNS requests have the same subdomain but different domain names.
- Observation 3: For each of these DNS requests, an HTTP POST request follows immediately.
- Observation 4: No other significant anomalies were detected in the system logs.

Given these observations, what would you suspect is happening?

A: The network is experiencing a DNS amplification attack
B: There is a misconfiguration in the DNS settings
C: The system is the source of a SYN flood attack
D: A fast-flux DNS network is in operation
E: The system is infected with a DNS tunneling based malware

You are investigating a possible SQL injection attack on your company's web application. You found the following entries in the HTTP server logs:

Note that each log line contains the following information:

IP Address - Timestamp - Request URI - Request Status - Response Size

Based on the log entries, which of the following statements are correct?

A: The attacker logged in successfully but failed to execute the SQL injection.
B: The attacker failed in the SQL injection attack.
C: The attacker failed to login but successfully accessed the admin page.
D: The attacker performed a successful SQL injection attack that dumped all product information.
E: The attacker was unsuccessful in both the SQL injection attack and the login attempt.

A software company decided to move some of their web services from one cloud provider (Vendor A) to another (Vendor B) for better cost optimization. Initially, their main web application "webapp.company.com" was hosted at IP 192.0.2.1 on Vendor A's infrastructure. As part of this transition, it was moved to IP 203.0.113.1 on Vendor B's setup. Subsequently, a secondary web service previously hosted on "serviceA.company.com" at IP 192.0.2.2 (Vendor A), was migrated and re-hosted at "serviceB.company.com" at IP 203.0.113.2 (Vendor B).

A month post-migration, the SEO team reported an unexpected spike in organic traffic to the "company.com" domain. Upon investigating, the IT team noticed unusual activity related to "serviceA.company.com" in the server access logs, including successful HTTP 200 responses from several requests. A suspicious HTTPS GET request, `GET /explicit-content.html HTTP/1.1`, was also recorded.

Running `dig +short serviceA.company.com` returned IP address 198.51.100.1. Cross-checking this information with the company's DNS records revealed:

Based on the details provided, identify the probable cause for the unexpected increase in organic traffic:

A: The company failed to delete the DNS "A" record for "serviceB.company.com" before migration on vendor A.
B: The company failed to delete the DNS "A" record for "serviceA.company.com" after migration.
C: The company did not configure DNS record for webapp.company.com properly on Vendor B's platform.
D: The DNS configuration for serviceB.company.com is incorrect post migration