Threat Intelligence and Hunting CS0-003 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat hunter is looking for signs of a specific advanced persistent threat (APT) group known to use PowerShell scripts for reconnaissance and to maintain persistence via scheduled tasks. The hunter has access to endpoint logs and wants to proactively search for these TTPs. Which approach should the hunter take?

   • ACheck for new user accounts created in the last 30 days
   • BAnalyze DNS logs for unusual domain queries
   • CReview firewall logs for outbound connections to known malicious IPs
   • DSearch for PowerShell execution events and scheduled task creation events
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat hunter is investigating a potential compromise where an attacker is using a legitimate remote management tool to control a server. The hunter has access to network and endpoint logs. Which technique would be most effective in detecting this activity?

   • AReview only firewall logs
   • BBaseline normal remote management tool usage and alert on anomalies
   • CSearch for known malware signatures
   • DBlock all remote management tools
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security team discovers that a competitor has been systematically stealing proprietary research data over several months. The attacks are highly sophisticated, use custom malware, and appear to be funded by a foreign government. Which type of threat actor is most likely responsible?

   • ANation-state
   • BScript kiddie
   • COrganized crime
   • DHacktivist
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A threat intelligence analyst receives a report from a well-known, reputable security vendor about a new malware campaign. The report includes detailed technical indicators and is corroborated by two other independent sources. How should the analyst assess the confidence level of this intelligence?

   • AHigh confidence
   • BLow confidence
   • CUnassessable
   • DMedium confidence
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team at a financial institution has identified a new phishing campaign targeting their customers. They want to share this intelligence with other organizations in their sector to help prevent similar attacks. Which method is most appropriate for sharing this threat intelligence?

   • AEmail the details to all customers directly
   • BShare via an Information Sharing and Analysis Center (ISAC) for the financial sector
   • CPost the details on a public social media platform
   • DPublish the indicators on the company's public website
   Reveal Solution Discussion Select an answer first