1.3 Describe Security Terms 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC receives an alert for a potential data exfiltration via DNS tunneling. The incident response run book specifies steps to isolate the host, capture a memory dump, and review DNS logs. The SOC wants to ensure these steps are executed consistently and quickly. Which approach best achieves this?

   • AEmail the run book to all analysts and ask them to follow it manually.
   • BUse a security orchestration, automation, and response (SOAR) platform to execute the run book steps automatically upon alert trigger.
   • CWait for the alert to occur multiple times before acting to confirm it is not a false positive.
   • DAssign the alert to the most senior analyst to handle it ad hoc.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC manager has a small team and limited budget. The team receives threat intelligence about a new fileless attack that uses PowerShell to inject code into running processes. The manager wants to proactively identify if any hosts are compromised, but the EDR does not log PowerShell script blocks. The team has access to Windows Event Logs (including Sysmon) and network flow data. Which approach is the most effective given these constraints?

   • AWait for the EDR vendor to release a signature update that detects the fileless technique.
   • BDeploy a new EDR agent that captures PowerShell script blocks to all endpoints immediately.
   • CSearch Sysmon logs for process creation events involving PowerShell with suspicious command-line patterns, and correlate with network flows to known C2 domains from the threat intel.
   • DUse sliding window anomaly detection on network flows to identify any host with unusual DNS queries, regardless of threat intel.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of malware analysis?

   • ATo understand the behavior and impact of malicious software
   • BTo create a new antivirus signature
   • CTo identify the author of the malware
   • DTo delete malware from infected systems
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A regional bank has been hit by a series of targeted phishing emails that use the bank's own branding and reference recent local events. The emails are sent only to employees in the finance department, and the payload is a macro-enabled document that downloads a known remote access trojan. The bank's threat intelligence team has identified the attacker as a financially motivated group operating from a neighboring country. The CISO wants to prioritize defenses against this specific threat. Which combination of actions best aligns with the threat intelligence and threat modeling concepts?

   • AIncrease the frequency of full-disk backups for the finance department's workstations.
   • BConduct a threat model of the finance department's email workflow, then apply email filtering rules and user training tailored to the observed TTPs.
   • CBlock all inbound email from the neighboring country and disable macros for all users.
   • DImmediately deploy a new endpoint detection and response tool to all endpoints without prior testing.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A financial services company is developing a new mobile banking application. The security team is conducting a threat model and has identified that the application will store sensitive user data on the device. The team is considering two mitigations: encrypting the data at rest and implementing certificate pinning to prevent man-in-the-middle attacks. The development team is concerned about the performance impact of encryption and the operational overhead of certificate pinning. The company's risk appetite is low, and it must comply with data protection regulations. Which approach best balances security and development constraints?

   • AImplement certificate pinning only, because it prevents interception of data in transit and has less performance impact than encryption.
   • BImplement both encryption at rest and certificate pinning, and accept the performance and operational overhead as necessary for the low-risk appetite.
   • CDefer both mitigations until after the application is released and a penetration test identifies actual vulnerabilities.
   • DImplement encryption at rest only, because it directly protects the stored data and has less operational overhead than certificate pinning.
   Reveal Solution Discussion Select an answer first