Security Operations Scenarios

Question 1

What term describes the search for an insider threat or shadow IT, which, until discovered, had been “Flying under the radar?”
A. Threat hunting
B. Threat emulation
C. Intelligence
D. Targeted Attack

Answer 1

A. Threat hunting

Question 1

LoJax, Bad Rabbit, and NotPetya are three examples of what?
A. Zero-day threats
B. Malware
C. APTs
D. Competitors

Answer 1

B. Malware

Question 2

You discover log entries that raise suspicion that a security incident might have occurred. You decide more investigation is needed. What describes what you found?
A. Vulnerabilities
B. ACLs
C. Threat intelligence types
D. Indicators of compromise

Answer 2

D. Indicators of compromise

Question 3

What is a key strength the disgruntled employee has over an outsider?
A. Trust
B. Time
C. Money
D. Signature

Answer 3

A. Trust

Question 4

Your manager asks if you’ve noticed any abnormal volumes of network traffic or other network issues. What logs might help you answer those concerns?
A. FIM logs
B. NetFlow logs
C. Firewall logs
D. Access logs

Answer 4

B. NetFlow logs

Question 5

Which of the following alerts warns the security analyst or administrator of the likelihood that data was exfiltrated out of the network?
A. IoC
B. FIM
C. DLP
D. ICE

Answer 5

C. DLP

Question 6

What intrusion detection processing technique is common for identifying a positive match but struggles to keep up with today’s traffic speeds and volumes?
A. SIEM
B. Regular expression
C. Singature-based
D. Anomaly or behavior

Answer 6

B. Regular expression

Question 7

Which of the following can block traffic based on the source and destination address?
A. The Deep Web
B. Script kiddie
C. ICS
D. ACL

Answer 7

D. ACL

Question 8

In the following example of an access control list, which of the following answers is true?

hostname R1
!
Interface ethernet0
Ip access-group 102 in
!
access-list 102 deny tcp any any eq 23
access-list 102 permit ip any any

A. TCP traffic bound for port 102 is permitted
B. TCP traffic bound for port 23 is blocked
C. TCP traffic bound for port 102 is blocked
D. TCP traffic bound for port 23 is permitted

Answer 8

B. TCP traffic bound for port 23 is blocked

Question 9

You got an alert that unusual changes were made to files in a customer directory. What type of alert was this?
A. DLP
B. IDS
C. FIM
D. IPS

Answer 9

C. FIM

Question 10

Which of the following is not a label for the conceptual Diamond Model of Intrusion Analysis?
A. Capability
B. Attacks
C. Victim
D. Infrastructure

Answer 10

B. Attacks

Question 11

For the purpose of better understanding a company, an employee is tasked with browsing social media, listening to recorded speeches, and reading patents. What type of intelligence gather is this employee performing?
A. HUMINT
B. APT
C. OSINT
D. ATT&CK

Answer 11

C. OSINT

Question 12

A determined security analyst discovered some evidence on a system that warranted more investigation. Ultimately, the analyst identified that advanced malware was resident and difficult to remove. The security analyst recommended the system be rebuilt from scratch. What is it the analyst had discovered?
A. IoC
B. ACL
C. DLP
D. APT

Answer 12

D. APT

Question 13

What intelligence collection method is described as the personal side of spying or collecting intelligence?
A. Lessons learned report
B. Deep Web
C. HUMINT
D. OSINT

Answer 13

C. HUMINT

Question 14

If you needed to find out an organization’s technical contact or registration information about their domain, what OSINT resource might be helpful?
A. DNS records
B. Deep Web
C. TRA
D. WHOIS

Answer 14

D. WHOIS

Question 15

Whether following the Cyber Kill Chain or the ATT&CK framework, which of the following tactics would occur first?
A. Reconnaissance
B. Command and control
C. Exfiltration
D. Discovery

Answer 15

A. Reconnaissance

Question 16

In the ATT&CK framework, which of the following tactics occurs last?
A. Initial access
B. Persistence
C. Discovery
D. Defense evasion

Answer 16

C. Discovery

Question 17

For the purpose of gaining access to a competitor’s property, you are tasked with befriending the competitor’s employees, using social media, conversations, and empathy to build personal trust. What type of intelligence gathering are you performing?
A. HUMINT
B. APT
C. OSINT
D. ATT&CK

Answer 17

A. HUMINT

Question 18

Which dangerous category of bad actors describes those seeking to compromise critical infrastructures such as nuclear power plants, power generation stations, and water treatment plants?
A. Script kiddie
B. Organized crime
C. Insider threat
D. Nation-state

Answer 18

D. Nation-state

Question 19

A few months after the legal firm Dewey, Cheatem, and Howe outsourced their accounts receivable department, the law firm suffered from hacked bank accounts. They are growing suspicious of an attack. Which of the following terms describes what likely happened?
A. Denial-of-service attack
B. SYN flood attack
C. Disgruntled employee
D. Supply chain attack

Answer 19

D. Supply chain attack