The Security Operations Center receives two alerts in security information and event management about two separate possible attacks. The first alert concerns brute force attempts on a domain controller, and the second attack concerns the flooding of a network. After an initial investigation, the team confirms that both alerts are valid and begins a detailed investigation.
According to the CAPEC model, which vulnerability criteria should the team prioritize in the investigation?
Aquickest mitigation actions
Bhighest probability of attack
Chighest typical severity
Dmost discovered weaknesses
0
Question 2
Threat Modeling Techniques
0
Question 3
Threat Hunting Fundamentals
0
Question 4
Threat Hunting Fundamentals
0
Question 5
Threat Modeling Techniques
0
That's the end of the Preview
This exam has 60 community-verified practice questions. Create a free account to access all questions, comments, and explanations.
Which threat hunting methodology aims to understand how adversaries think?
Aintel-driven
Bhybrid
Centity-driven
DTTP-driven
What is a characteristic of a memory-resident attack?
AThe attack is file independent.
BThe execution continues after a system restart.
CPrograms must be closed to be infected.
DMalware is installed in the virtual memory.
What should be considered when using machine learning for data analysis in a SOC?
AMore professionals are needed to maintain the system.
BSecurity gaps can occur during the early stages of development.
CMachine learning is unsuited for small organizations.
DConstant tuning is required for data analysis to be effective.
According to the MITRE ATT&CK framework, how is the password spraying technique classified?
Ainitial access
Bcredential access
Clateral movement
Dprivilege escalation
Question 6
Threat Hunting Fundamentals
0
Question 7
Threat Hunting Fundamentals
Question 8
Threat Hunting Processes
Question 9
Threat Hunting Fundamentals
Question 10
Threat Modeling Techniques
Question 11
Threat Hunting Techniques
Question 12
Threat Hunting Outcomes
Question 13
Threat Hunting Techniques
Question 14
Threat Hunting Techniques
Question 15
Threat Hunting Techniques
Question 16
Threat Actor Attribution Techniques
Question 17
Threat Hunting Outcomes
Question 18
Threat Actor Attribution Techniques
Question 19
Threat Hunting Techniques
Question 20
Threat Hunting Techniques
Question 21
Threat Hunting Techniques
Question 22
Threat Hunting Processes
Question 23
Threat Hunting Techniques
Question 24
Threat Hunting Techniques
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ad
Want a break from the ads?
Become a Supporter and enjoy a completely ad-free experience, plus unlock Learn Mode, Exam Mode, AstroTutor AI, and more.
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
How does multiproduct integration enhance data visibility and analysis in a corporate environment?
ADifferent teams use different tools so that they can crosscheck their results.
BA central data visualizer is integrated into the APIs of the products to correlate input.
CBackup tools are in place for use when the main tools are unavailable.
DDifferent GUIs are used to get different views of the same events.
What is a limitation of automated dynamic malware analysis tools?
AThey produce false positives and false negatives.
BThey are time consuming when performed manually.
CVulnerabilities in runtime environments cannot be found.
DAll programming languages are not supported.
What triggers unstructured threat hunting?
Aindicators of attack
Bindicators of compromise
Ctactics, techniques, and procedures
Dcustomized threat identification
Refer to the exhibit.
An increase in company traffic is observed by the SOC team. After they investigate the spike, it is concluded that the increase is due to ongoing scanning activity. Further analysis reveals that an adversary used Nmap for OS fingerprinting.
Which type of indicators used by the adversary sits highest on the Pyramid of Pain?
AUDPs
Bnetwork/host artifacts
CIP addresses
Dport probes
What is the classification of the pass-the-hash technique according to the MITRE ATT&CK framework?
Acredential access
Blateral movement
Cprivilege escalation
Dpersistence
A task has been assigned to enhance defenses against APT actors within a mid-sized technology company. Attacks by the adversaries are sophisticated and prolonged, and they use various tactics to infiltrate and persist within target networks. The company is focusing on the tactics used by the adversaries to significantly improve overall security posture. A review of the Pyramid of Pain model has been conducted, highlighting different levels of threat indicators, from simple hash values to complex TTPs. The objective is to enhance detection capabilities.
Which approach should be taken to detect APT activity at the Tactics level of the Pyramid of Pain?
Amonitoring all available network logs for specific IPs linked to known APT activities
Bblocking newly registered domains that have not been accessed before by company personnel
Canalyzing logs to identify patterns of behavior matching APT tactics from MITRE ATT&CK
Dusing hash values to identify known malware files used in previous APT campaigns
Refer to the exhibit.
The Security Operations team is reviewing firewall logs and decrypts this HTTP request coming one of finance team member’s endpoints.
Which stage of the Cyber Kill Chain does the evidence point to?
ACommand and Control: establishing persistent C2 channels
BInstallation: installing malware on endpoints
CExfiltration: transferring data to remote server
DDelivery: transmitting malicious payload to target
A hacking group targets a construction company by sending emails that contain a malicious macro. An employee at the company executes the macro, and a PowerShell command is executed that downloads a file with further instructions from a website. The malware installs a keylogger on the employee’s computer and reports keystrokes to a C2 server.
What is being used according to the MITRE ATT&CK framework?
Aingress tool transfer
Bfallback channels
Cdrive-by compromise
Dindirect command execution
Refer to the exhibit.
A forensic team must investigate how the company website was defaced. The team isolates the web server, clones the disk, and analyzes the logs.
Which technique was used by the attacker initially to access the website?
Adrive-by compromise
Bexternal remote services
Cexploit public-facing application
Dcommand and scripting interpreter
A threat hunting team tries to classify the IoT malware families based on abnormal patterns of activities.
Which method for IoT malware family classification is described?
Arandom forest
Bdecision tree learning
Crandom number generator
Dgradient boosting
An analyst receives a report that states that the infection chain begins with a phishing email that contains a malicious download link. When the victim downloads the malicious RAR file, the archive needs a specific password to extract, which reveals a fake PDF executable malware and an image printing file. After the malware is decrypted and the fake PDF executable is run, an automatic execution of the embedded LummaC2 or Rhadamanthys information stealer occurs, which then collects the victim’s credentials and data, and sends them back to the C2 server.
Which conclusion should the analyst draw about the threat actor?
AThe threat actor is focused on stealing sensitive information and may also aim to disrupt operations as a secondary objective after achieving the first one.
BThe threat actor is likely engaged in opportunistic attacks without a clear target profile, focusing on broad-based phishing tactics to maximize reach.
CThe threat actor is using a multi-stage attack to bypass security measures and exfiltrate sensitive information as the main objective of the operation.
DThe threat actor is employing sophisticated techniques to gain initial access and uses malware to move laterally and maintain persistence across network.
Refer to the exhibit.
A security engineer observes the Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service traffic with the Wireshark, which may spoof a source for name resolution to force communication with an adversary-controlled system, as well as perform an SMB Relay attack. After the security engineer identifies the traffic as malicious, they must determine the gaps in threat detection.
Which gap would an analyst determine?
AIntercept network traffic for unusual ARP traffic. Gratuitous ARP replies may be suspicious.
BRevoke for API calls associated with polling to intercept keystrokes.
CMonitor for traffic on ports UDP 5355 and UDP 137 if LLMNR/NetBIOS.
DAugment Windows logs (ex: EIDs 1341, 1342, 1020, and 1063) for changes to DHCP settings.
Refer to the exhibit.
What is the difference between the procedures of each APT group?
AThe first APT group used the Plink utility for the inter-beacon communication over the HTTPS, and the second group executed the sc utility to create multistage C2 channels.
BThe first APT group executed the Plink utility for the signed binary proxy execution, and the second group used the sc utility to exfiltrate data over alternative protocols.
CThe first APT group executed the sc utility via PowerShell to enumerate active services on the domain controller, and the second group used the Plink utility to create an SSH tunnel.
DThe first APT group used the Plink utility to create an SSH tunnel, and the second group executed the sc utility via PowerShell to enumerate active services on the domain controller.
A SOC team observed unusual traffic patterns during nonworking hours. Upon further investigation, it was discovered that the traffic is originating from two specific endpoints with outbound connections to the internet. Suspecting potential data exfiltration, the team aims to investigate further based on this hypothesis.
Which two threat indicators support the suspicion of data exfiltration? (Choose two.)
AIntense inbound traffic directed to the endpoints.
BDomain requests related to file-sharing websites.
CIrregular payload sizes during the increased traffic.
DMultiple zip commands executed on endpoints.
EMultiple requests for the same file from the file server.
Refer to the exhibit.
A security analyst receives an alert from Cisco Secure Network Analytics (formerly StealthWatch) with the C2 category.
Which information aids the investigation?
AHost 10.201.3.99 is attempting to contact the C2 server to retrieve the payload.
BIP address 10.201.3.99 is a C2 server.
CThe number of packets shows that a C2 communication occurred.
DThe payload describes the address of the zombie endpoint.
Refer to the exhibit.
The security team at a company reviews the Intrusion Prevention System logs and detects a pass-the-hash attack on a domain controller. After further investigation, the team discovers that the attack originated from an endpoint running the Mimikatz tool. The team must improve the visibility of the company’s endpoint actions and must add additional logging to detect similar attacks in the future.
Which logs should the team leverage?
Aextended audit logs from the domain controller for better visibility
Bcommand logging on the domain controller to detect malicious processes
Cendpoint antivirus logs to monitor the behavior of running processes
Dsysmon logging from all the endpoints to monitor the access processes
Refer to the exhibit.
A SOC team is investigating an endpoint after noticing suspicious communications to a malicious IP address. During the investigation, the team analyzes the running processes of the host.
On which element should the team focus next to continue the investigation?
AID of the running processes
Bcalc.exe process executed from svchost.exe
Carguments of svchost.exe
Dtaskhostw.exe reference key
A security analyst must create a SIEM signature to detect when malware modifies registry keys to establish persistence, which ensures that malware runs every time a user signs in to Windows. The focus must be on specific registry changes associated with this type of persistence mechanism.
Which registry modification must the security analyst target?
After a vulnerability scan is finished in the production environment, a security engineer discovers that several hosts have the CVE-2019-0752 Microsoft Scripting Engine vulnerability. The engineer enables script protection in Cisco AMP to protect hosts from script attacks and to flag script usage.
Which script interpreter works with the script protection feature?