Threat Hunting CAS-005 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A mid-sized company's User Behavior Analytics (UBA) platform flags a senior accountant who has started accessing the HR payroll database at 2:00 AM on weekends, downloading files, and then deleting the local copies. The user's account has no history of this behavior. The UBA has generated a high-risk score. The security analyst needs to determine if this is a genuine insider threat or a compromised account. Which combination of actions should the analyst take FIRST?

   • AImmediately disable the user's account and escalate to HR for a formal investigation into policy violations.
   • BReview the user's recent authentication logs for impossible travel or new device registrations and correlate with the UBA alerts.
   • CCreate a Sigma rule to detect all future access to the HR payroll database outside business hours and add it to the SIEM.
   • DIgnore the alert because the user has legitimate access rights to the payroll database as part of their role.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A malware analyst has received a suspicious file from an incident response engagement. The analyst suspects it is a variant of a known banking trojan. The analyst has a collection of YARA rules from a public repository. What is the MOST efficient way to determine if the file matches any known malware family?

   • ARun the file against the entire collection of YARA rules using a YARA scanner.
   • BManually read through each YARA rule and compare the strings to the file's contents.
   • CConvert the YARA rules to Sigma rules and run them against the file.
   • DUpload the file to a public online scanner that uses YARA rules.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In which security device or system are Snort rules typically deployed?

   • ADatabase firewall
   • BEndpoint antivirus
   • CSIEM platform
   • DNetwork intrusion detection system (IDS)
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of the Structured Threat Information Expression (STIX) format?

   • ATo encrypt threat intelligence data in transit
   • BTo automatically block malicious traffic based on threat feeds
   • CTo provide a standardized language for representing and sharing threat intelligence
   • DTo replace the need for human analysts in threat detection
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A global enterprise receives threat intelligence from multiple sources: a commercial feed, an ISAC, open-source intelligence (OSINT), and its own internal incident reports. The security team is overwhelmed by the volume and inconsistent formatting of this data and is struggling to identify which threats are relevant to their environment. Which solution would MOST directly address this problem?

   • ADisable all but one threat intelligence source to reduce the volume of data.
   • BAsk each source to send their data in a single, agreed-upon format like CSV.
   • CCreate a new email distribution list and have all threat intel analysts manually forward and summarize each report.
   • DDeploy a Threat Intelligence Platform (TIP) to aggregate, normalize, and correlate the data from all sources into a single view.
   Reveal Solution Discussion Select an answer first