Threat Hunting CAS-005 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A financial services firm has deployed a honeypot in a segmented DMZ that mimics a legacy database server. The honeypot logs all connection attempts and captures the attacker's commands. After two weeks, the security team notices the honeypot has been probed by an IP address that also appears in the organization's SIEM as a source of failed login attempts against the real production database. The team wants to enrich this finding with additional context before escalating. Which action best leverages the honeypot's collected data to support the investigation?

   • ABlock the IP address at the firewall immediately and document the incident as a false positive since the honeypot is not a production asset.
   • BShare the raw honeypot logs with the organization's ISAC without any analysis to quickly warn other members of the IP address.
   • CExport the honeypot's captured commands and correlate them with the failed login timestamps in the SIEM to identify the attacker's toolset and intent.
   • DReconfigure the honeypot to emulate a different service so that the attacker loses interest and moves on to other targets.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst has identified a new malware variant and wants to share the indicators of compromise (IoCs) with a trusted partner organization. The analyst wants to ensure the partner can automatically ingest and act on the IoCs without manual intervention. Which combination of standards and protocols is designed for this purpose?

   • AUse Sigma rules to create a detection rule and post it on a public GitHub repository.
   • BUse STIX to structure the IoC data and TAXII to transport it to the partner's threat intelligence platform.
   • CUse YARA rules to define the malware's characteristics and send them via email as an attachment.
   • DUse Snort rules to describe the network signatures and upload them to a shared FTP server.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which benefit does an organization gain by joining an ISAC?

   • AFree hardware firewalls for all members
   • BAccess to vetted threat intelligence relevant to its industry
   • CGuaranteed immunity from all cyberattacks
   • DDirect control over other members' security operations
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is building a threat intelligence program for a small manufacturing company. The analyst has limited budget and resources but wants to gain visibility into threats targeting the manufacturing sector. Which source of external intelligence would provide the MOST relevant and cost-effective industry-specific information?

   • AMonitor dark web forums for any mention of the company's name.
   • BJoin the Manufacturing Information Sharing and Analysis Center (M-ISAC).
   • CSubscribe to a high-end, commercial threat intelligence feed from a large vendor.
   • DRely solely on free OSINT sources like public blogs and social media.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of Sigma rules?

   • ATo identify malware by matching file content patterns
   • BTo detect network intrusions by matching packet signatures
   • CTo provide a generic format for describing log detection rules that can be converted to SIEM-specific queries
   • DTo encrypt log data at rest in SIEM systems
   Reveal Solution Discussion Select an answer first