Threat Intelligence and Hunting CS0-003 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is investigating a breach where the attacker used a previously unknown vulnerability in a web server to gain initial access, then moved laterally using legitimate administrative tools, and finally exfiltrated data via encrypted channels. The analyst wants to categorize the attacker's behavior using a common framework. Which framework should the analyst use?

   • AISO 27001
   • BNIST Cybersecurity Framework
   • COWASP Top 10
   • DMITRE ATT&CK
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A threat hunter wants to proactively search for signs of a specific known adversary group's activity by looking for the unique file hashes and command-line arguments that the group is known to use. Which threat hunting technique does this describe?

   • APerforming a vulnerability scan
   • BAnalyzing network traffic for anomalies
   • CConducting user behavior analytics
   • DSearching for indicators of compromise (IOCs)
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An analyst finds a post on an obscure forum claiming that a specific vulnerability is being actively exploited. The post is anonymous and has no technical details or evidence. No other sources mention this exploitation. How should the analyst rate the confidence of this intelligence?

   • AHigh confidence
   • BLow confidence
   • CMedium confidence
   • DConfirmed
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A threat intelligence report states that a specific adversary group uses PowerShell scripts for execution and often exploits the EternalBlue vulnerability for lateral movement. Which component of the TTP framework does the use of PowerShell scripts represent?

   • AProcedure
   • BIndicator of Compromise (IoC)
   • CTechnique
   • DTactic
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team wants to improve its threat intelligence collection by incorporating both open-source and proprietary sources. They have limited budget and need to prioritize. Which combination of sources would provide the most balanced and cost-effective intelligence?

   • AOnly open-source feeds
   • BOnly proprietary feeds
   • COpen-source feeds and a commercial threat intelligence platform
   • DInternal incident reports and open-source feeds
   Reveal Solution Discussion Select an answer first