1.3 Describe Security Terms 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A SOC analyst receives a threat intelligence report that includes a new malware family's hashes and C2 domains. The analyst wants to determine if any of the organization's systems have already been compromised by this malware. Which action is most appropriate?

   • AAdd the hashes to a blocklist and assume the organization is safe if no alerts are triggered.
   • BSearch the organization's logs and endpoint data for matches against the hashes and C2 domains.
   • CShare the report with other organizations and wait for them to confirm if the malware is present.
   • DUse the C2 domains to launch a passive DNS lookup to see if they are still active.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company discovers that its industrial control system (ICS) was accessed by an unknown party who stole proprietary process diagrams. The investigation reveals the attacker used a zero-day vulnerability in a legacy controller and exfiltrated data slowly over several months. Which threat actor profile best matches this behavior?

   • AA cybercriminal gang aiming to deploy ransomware for financial gain.
   • BA hacktivist group seeking to publicize the company's environmental record.
   • CA nation-state actor with advanced capabilities and a focus on intellectual property theft.
   • DAn insider with legitimate access to the ICS network.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst has obtained a suspicious executable file that was found on a compromised workstation. The analyst needs to determine what the malware does, including any network indicators and persistence mechanisms, without executing it on the production network. The organization has a policy that all malware analysis must be performed in a controlled environment. Which approach is the most appropriate first step?

   • AImmediately delete the executable and rely on endpoint protection logs to understand the infection.
   • BRun the executable in a sandbox and capture its network traffic and registry changes.
   • CPerform static analysis using a disassembler and inspect the strings and imports for suspicious indicators.
   • DUpload the executable to a public online malware analysis service to get a quick report.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is analyzing a ransomware sample in a controlled sandbox. The analyst observes that the malware encrypts files and then attempts to delete volume shadow copies. Which additional analysis step would provide the most useful information for incident response?

   • ACount the number of files encrypted during the sandbox run.
   • BCheck the malware's digital signature to see if it is signed by a legitimate vendor.
   • CRecord the malware's file size and compile timestamp.
   • DIdentify the encryption algorithm and whether a decryption tool exists.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary goal of threat hunting?

   • ATo proactively search for threats that may have evaded existing security controls
   • BTo respond to an active security incident as quickly as possible
   • CTo patch vulnerabilities in software before they are exploited
   • DTo replace automated security monitoring tools
   Reveal Solution Discussion Select an answer first