Objective 2.2 Detect Attacks Using Active Monitoring Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A security operations center (SOC) analyst notices that a user's workstation has been communicating with a known malicious IP address at regular 60-second intervals for the past three hours. The analyst wants to determine whether other hosts in the environment are also communicating with this IP and to automatically open a ticket for any additional affected hosts. Which solution should the analyst use to accomplish this task?

   • AConfigure the TIP to ingest the malicious IP and push an indicator of compromise (IOC) to all security tools for automatic blocking.
   • BUse the EDR console to isolate the user's workstation and manually check each endpoint's network connections for the malicious IP.
   • CDeploy a new IDS signature to block the malicious IP at the network perimeter and review the IDS alerts for other affected hosts.
   • DQuery the SIEM for logs containing the malicious IP and create a correlation rule that triggers a SOAR playbook to open tickets for each affected host.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is a method used to inspect packet contents for malicious payloads?

   • AAnalyzing MAC address formats
   • BChecking packet TTL values
   • CSignature matching against known malware patterns
   • DCounting the number of packets per second
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which active monitoring technology is primarily focused on detecting and responding to threats directly on endpoints, such as laptops and servers, by continuously monitoring for malicious activity?

   • ASIEM
   • BIDS
   • CEDR
   • DSOAR
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the primary purpose of File Integrity Monitoring (FIM)?

   • ATo detect unauthorized changes to files and system configurations
   • BTo improve file system performance
   • CTo encrypt sensitive files
   • DTo manage user access permissions
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   Which of the following is a common technique used by FIM to detect file changes?

   • AAnalyzing user login patterns
   • BScanning for malware signatures
   • CComparing cryptographic hashes of files over time
   • DMonitoring network traffic for file transfers
   Reveal Solution Discussion Select an answer first