Threat Hunting CAS-005 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which statement correctly describes the relationship between STIX and TAXII?

   • ABoth are interchangeable and can be used independently for the same purpose
   • BTAXII defines the content format, and STIX defines the transport mechanism
   • CSTIX defines the content format, and TAXII defines the transport mechanism
   • DSTIX is a commercial product, and TAXII is an open-source tool
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A hospital's security team has identified a new ransomware variant targeting healthcare-specific software. They want to share the indicators of compromise (IoCs) with other hospitals in their region to help them defend against the same threat. The team is a member of a regional Health Information Sharing and Analysis Center (H-ISAC). What is the MOST effective way to share this intelligence?

   • AWait for the H-ISAC to publish their own advisory on the ransomware before sharing any local findings.
   • BPost the IoCs on a public pastebin site and share the link with the H-ISAC members.
   • CPublish the IoCs in a structured format like STIX and exchange them with the H-ISAC using the TAXII protocol.
   • DSend a detailed email with the file hashes and domain names to the H-ISAC's general contact address.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which task is typically performed by a Threat Intelligence Platform (TIP)?

   • ABlocking malicious IP addresses at the network perimeter
   • BCorrelating indicators of compromise from various feeds to identify relevant threats
   • CResetting user passwords after a suspected breach
   • DConducting forensic analysis of compromised hard drives
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which type of information can be represented in a STIX document?

   • AThe source code of proprietary software applications
   • BThe organization's financial statements
   • CIndicators of compromise, such as malicious IP addresses and file hashes
   • DThe organization's internal employee performance reviews
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team has deployed a honeypot and a User Behavior Analytics (UBA) system. The honeypot is a fake file server that has been accessed by an internal user account. The UBA flags the same user account for accessing a large number of files on the real file server in a short period, which is unusual for that user. The analyst must determine if the honeypot access is related to the UBA alert. Which investigation step would provide the STRONGEST evidence of a link?

   • AIsolate the user's machine from the network to prevent further data exfiltration.
   • BCheck if the user's manager has authorized the bulk file access.
   • CCorrelate the timestamp of the honeypot access with the UBA alert and check if the source IP address and hostname are the same.
   • DReview the user's past performance reviews to see if they are a disgruntled employee.
   Reveal Solution Discussion Select an answer first