Threat Hunting CAS-005 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A large enterprise's security team is monitoring dark web forums for mentions of their company. They find a post where a user is selling what appears to be a database dump of customer records. The team wants to verify if the data is genuine and belongs to them without exposing more data or alerting the seller. Which action is the MOST appropriate?

   • AAnalyze the sample data provided in the post and compare it against known internal data patterns, such as specific customer ID formats or test accounts.
   • BImmediately notify all customers that their data has been breached.
   • CPurchase the data dump using a prepaid card to verify its contents.
   • DContact the seller directly through the forum's private messaging system to ask for a larger sample for verification.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why are honeypots considered a valuable source of threat intelligence despite being decoy systems?

   • AThey replace the need for threat intelligence feeds
   • BThey automatically patch vulnerabilities in production systems
   • CThey capture real attacker activity without exposing production assets
   • DThey block all malicious traffic at the network perimeter
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of YARA rules?

   • ATo detect suspicious log events in SIEM systems
   • BTo block malicious network traffic at the perimeter
   • CTo encrypt files on endpoints
   • DTo identify and classify malware based on patterns in files or memory
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A network administrator is configuring an intrusion detection system (IDS) to monitor for a known exploit that sends a specific string of bytes to a web server on port 80. The administrator wants to create a rule that will generate an alert when this specific traffic pattern is observed. Which rule language is the MOST appropriate for this task?

   • ASTIX
   • BYARA
   • CSnort
   • DSigma
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   An analyst is looking for threat intelligence that is specific to the financial services industry. Which external source would be most appropriate?

   • AThe organization's internal SIEM platform
   • BThe organization's own firewall logs
   • CA general-purpose search engine
   • DAn Information Sharing and Analysis Center (ISAC) for financial services
   Reveal Solution Discussion Select an answer first