A replay attack, defeated most directly by adding a nonce to each login request.

A brute-force attack, defeated most directly by using a longer key size for the portal's TLS certificate.

Credential stuffing, defeated most directly by multi-factor authentication.

A dictionary attack, defeated most directly by increasing the minimum password length.

A logic bomb

A rootkit

A backdoor

A worm

It will still be blocked, because rules are evaluated top-down and the default-deny rule matches first.

It will be allowed, because the last rule in the list is the one the firewall applies.

It will be allowed only for established sessions, because default-deny applies to new connections alone.

It will be allowed, because a more specific rule always overrides a broader one regardless of position.

Neither method can help, because detection of unknown code is the exclusive responsibility of the firewall's rule set.

Anomaly-based detection will miss it, because it can only flag behaviour that matches a previously recorded pattern.

Signature-based detection will miss it; anomaly-based detection may catch it, but at the cost of more false positives.

Signature-based detection will catch it, because signatures describe general attack categories rather than specific samples.

Paying the ransom is the recommended first step, since it guarantees the return of the decryption key.

The incident is a confidentiality breach only, since the files themselves were never removed from the server.

The backups are safe, because ransomware encrypts only the local system drive and never network shares.

The backups are likely to have been encrypted too, because a permanently mounted share is reachable by the ransomware; only offline, tested backups reliably survive.

ARP poisoning has redirected traffic through the attacker, who is attempting a man-in-the-middle; TLS certificate validation exposes the interception.

A rogue DHCP server has issued duplicate addresses; the warnings appear because two hosts share one IP.

Passive sniffing is under way; the warnings appear because captured packets are re-sent to the browser out of order.

A DDoS amplification attack is under way; the warnings appear because the gateway is too overloaded to complete the handshake.

A WPA handshake-cracking attack; it is passive, because the handshake is captured off the air.

An evil twin combined with a deauthentication attack; it is passive, because the attacker only advertises a network name.

An evil twin combined with a deauthentication attack; it is active, because the attacker injects frames rather than merely listening.

A DNS cache-poisoning attack; it is active, because false records are injected into the resolver.