1.3 Describe Security Terms 200-201 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A security analyst notices that the organization's EDR solution has not detected any malware in the past six months, despite industry reports of a new campaign using fileless techniques. The analyst suspects the EDR may be missing stealthy threats. Which action best aligns with the concept of threat hunting?

   • ADevelop hypotheses based on the new campaign's techniques and search for anomalous process behaviors, such as PowerShell execution without command-line arguments.
   • BReview EDR alerts from the past six months to identify any missed detections and tune the alert rules.
   • CDisable the EDR temporarily to reduce false positives and allow the analyst to manually review all endpoint activity.
   • DIncrease the frequency of signature updates for the EDR to ensure it can detect the new fileless malware.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A malware analyst is reverse engineering a packed binary that uses anti-debugging techniques. The analyst needs to unpack the binary and understand its behavior, but the binary crashes when run under a standard debugger. Which approach is most likely to succeed?

   • AUse a debugger that is designed to evade anti-debugging checks, such as a stealth debugger or kernel-level debugging.
   • BPerform static analysis only, since the binary is packed and cannot be executed safely.
   • CSubmit the binary to an automated sandbox that uses a standard debugger.
   • DRun the binary in a virtual machine without a debugger and capture network traffic to infer behavior.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security architect is assessing the risk of a new internet-facing application that stores sensitive customer data. The architect has limited budget and must choose between investing in a WAF or conducting a thorough threat modeling exercise. The application is developed in-house and has a history of business logic flaws. Which decision best balances risk and budget?

   • ASkip both and rely on the development team's secure coding practices.
   • BPurchase a WAF because it provides immediate protection against common web attacks.
   • CConduct threat modeling to identify and prioritize potential threats, including business logic flaws, before deciding on controls.
   • DDeploy the application and monitor logs for attacks, then add controls based on observed incidents.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   How does run book automation improve incident response efficiency?

   • ABy automatically executing predefined response steps
   • BBy requiring more analysts to review each incident
   • CBy preventing all security incidents from occurring
   • DBy storing incident data in a central database
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary purpose of threat modeling?

   • ATo identify and prioritize potential threats to a system
   • BTo patch vulnerabilities after they are discovered
   • CTo monitor network traffic in real time
   • DTo respond to an active security incident
   Reveal Solution Discussion Select an answer first