300-220 CBRTHD: Conducting Threat Hunting and Defending using Cisco Technologies for Cybersecurity

By Cisco · Question Mode

QuestionQ24

Threat Hunting Outcomes

Refer to the exhibit.

Question Image

The SOC team observes an increase in company traffic. After investigating the spike, it concludes that the increase results from ongoing scanning activity. Further analysis shows that an adversary used Nmap for OS fingerprinting.

Which type of indicator used by the adversary is highest on the Pyramid of Pain?

Explanation

Network and host artifacts rank above IP addresses on the Pyramid of Pain because adversaries must make more substantial changes to their operations to replace them. Scanning behavior and its associated observable artifacts are therefore more costly for an adversary to alter than simply changing an IP address.

Community Discussion

No comments yet. Be the first to start the discussion!