Threat Hunting CAS-005 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Why is sharing Indicators of Compromise (IoCs) using standardized formats like STIX and TAXII important?

   • AIt replaces the need for any other security controls
   • BIt enables automated and interoperable exchange of threat intelligence between organizations
   • CIt guarantees that all threats will be immediately neutralized
   • DIt is required by law in all countries
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A threat intelligence team has set up a TAXII server to share intelligence with its members. A new member organization wants to receive a continuous feed of indicators from the server. What is the primary function of the TAXII protocol in this scenario?

   • AIt is a database schema for storing threat intelligence data.
   • BIt provides a graphical user interface for analysts to manually review and approve each indicator.
   • CIt generates the STIX content that describes the indicators.
   • DIt defines the transport mechanism for securely exchanging STIX data between the server and the member.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which scenario would User Behavior Analytics (UBA) most likely flag as anomalous?

   • AA user changes their password after a scheduled password expiration
   • BA user who normally works 9-to-5 suddenly downloads large volumes of data at 3 AM
   • CA user accesses a shared network drive that they use daily
   • DA user logs in from their usual workstation during normal working hours
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of an external threat intelligence source?

   • AData from the organization's own honeypots
   • BEmployee access logs from the corporate Active Directory
   • CInternal DNS logs from the organization's own servers
   • DOpen Source Intelligence (OSINT) collected from public websites
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What type of threat intelligence might an organization obtain by monitoring dark web marketplaces?

   • AIndicators that its employees' credentials are being sold
   • BThe complete source code of all open-source software
   • COfficial security patches from software vendors
   • DThe organization's internal network diagrams
   Reveal Solution Discussion Select an answer first