Threat Hunting CAS-005 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary function of a Threat Intelligence Platform (TIP)?

   • ATo replace the organization's firewall and intrusion prevention system
   • BTo encrypt all data stored in the organization's databases
   • CTo aggregate and analyze threat data from multiple sources into a unified view
   • DTo automatically patch all vulnerabilities in the organization's software
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security operations team is investigating a data breach where proprietary source code was exfiltrated. During the investigation, they discover a snippet of the stolen code being offered for sale on a dark web marketplace. The team wants to gather more intelligence about the seller and the scope of the leak without alerting the seller or violating any laws. Which approach is the MOST appropriate and effective?

   • AAttempt to purchase the stolen code using the company's credit card to trace the payment and identify the seller.
   • BImmediately contact the dark web marketplace administrator and demand the listing be taken down.
   • CIgnore the dark web listing and focus solely on hardening internal systems to prevent future breaches.
   • DUse a dedicated, anonymous research account to engage with the seller, gather metadata about the listing, and monitor the seller's other listings for additional leaked data.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which activity is an example of using OSINT to enhance threat intelligence?

   • AQuerying the organization's SIEM for past incidents
   • BReviewing the organization's internal authentication logs
   • CMonitoring public social media posts for mentions of a new malware campaign
   • DAnalyzing packet captures from the corporate network
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of deploying a honeypot within an organization's network?

   • ATo attract and study attacker activity in a controlled environment
   • BTo automatically block all malicious IP addresses at the perimeter
   • CTo encrypt all network traffic between internal hosts
   • DTo replace the need for traditional firewalls and intrusion detection systems
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which type of data can a YARA rule be used to scan?

   • ANetwork packets in transit
   • BFiles on disk and memory of running processes
   • CUser authentication events
   • DDNS query logs
   Reveal Solution Discussion Select an answer first