1.3 Describe Security Terms 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing a series of attacks against a government defense contractor. The attacks involve sophisticated spear-phishing emails with zero-day exploits and are believed to be sponsored by a nation-state. The attacker's goal appears to be stealing classified project information. Which threat actor type best matches this scenario?

   • ACybercriminal
   • BHacktivist
   • CInsider threat
   • DNation-state actor
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC team spends significant time manually responding to repeated phishing alerts. Each alert requires the analyst to check the email headers, block the sender, and notify the affected user. The SOC manager wants to reduce response time and ensure consistency. Which approach best addresses this need?

   • ADisable email filtering to reduce the number of phishing alerts reaching the SOC.
   • BCreate a run book that documents the steps and automate the repetitive actions using a security orchestration platform.
   • CTrain all analysts to handle phishing alerts faster by memorizing the steps.
   • DIncrease the severity of phishing alerts so they are prioritized higher in the queue.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A network monitoring system tracks the number of failed login attempts per minute. The security team wants to detect a brute-force attack that gradually increases the attempt rate over several hours. Which anomaly detection approach would best identify this slow-building pattern?

   • AManually review login logs at the end of each day to spot unusual patterns.
   • BApply a sliding window anomaly detection algorithm that compares the current minute's count to a moving baseline of the past 60 minutes.
   • CUse a fixed threshold of 100 failed attempts per minute, alerting only when that threshold is exceeded.
   • DCalculate the average failed attempts over the entire day and alert if the current minute exceeds that average.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is adopting a DevOps culture and wants to integrate security into its continuous integration/continuous deployment (CI/CD) pipeline. The security team wants to ensure that vulnerabilities are identified and addressed as early as possible without slowing down development. Which approach best aligns with the DevSecOps philosophy?

   • APerform a security review only at the end of each release cycle.
   • BAutomate security checks, such as static code analysis and dependency scanning, and integrate them into the CI/CD pipeline.
   • CDeploy to production first and then run vulnerability scans to identify issues.
   • DHave a dedicated security team manually test every build before deployment.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team receives a threat intelligence report that a specific advanced persistent threat (APT) group is targeting organizations in the same industry. The report includes indicators of compromise (IOCs) such as IP addresses, domain names, and file hashes. The team wants to proactively search for any signs of this APT in their environment. Which action is the most aligned with using threat intelligence?

   • AShare the report with other organizations but take no action internally.
   • BBlock all IP addresses and domains listed in the report at the firewall.
   • CUse the IOCs to search historical logs and endpoint data for any matches, and then investigate any hits.
   • DWait for the next scheduled vulnerability scan to see if any of the IOCs appear.
   Reveal Solution Discussion Select an answer first