Threat Intelligence and Hunting CS0-003 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A threat hunter is investigating a potential data exfiltration incident. The hunter notices large outbound data transfers to a cloud storage service that is not commonly used by the organization. The transfers occur during off-hours and from a single workstation. Which hypothesis should the hunter test first?

   • AThe workstation is running a scheduled backup
   • BThe cloud storage service is a legitimate business tool
   • CThe workstation is compromised and is being used to exfiltrate data
   • DThe network is experiencing a misconfiguration
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A threat hunter is reviewing network traffic logs and notices a series of outbound connections to a known malicious domain from several workstations. The connections occur at irregular intervals and use HTTPS. The hunter wants to determine if this is a coordinated attack or isolated infections. Which technique should the hunter use?

   • ACheck for other common indicators of compromise on the workstations, such as unusual processes or registry changes
   • BReview the workstations' DNS cache for other domains
   • CBlock the domain at the firewall and move on
   • DImmediately isolate the workstations from the network
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A security analyst observes a series of distributed denial-of-service (DDoS) attacks and website defacements targeting a government agency. The attacks appear to be politically motivated and are accompanied by public statements criticizing the agency's policies. Which type of threat actor is most likely responsible?

   • AHacktivist
   • BNation-state
   • CInsider threat
   • DCybercriminal
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A threat intelligence analyst is reviewing two reports about a new malware strain. The first report is from a well-known security vendor with a long track record, based on multiple sandbox analyses and real-world observations. The second report is from an anonymous source on a dark web forum, claiming the malware is a state-sponsored tool. The analyst must decide which report to trust more. What should the analyst do?

   • AIgnore both reports because they conflict
   • BTrust the vendor report because of its source reliability and evidence quality
   • CGive equal weight to both reports
   • DTrust the dark web report because it is more specific
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is investigating a breach at a defense contractor. The attacker used a zero-day exploit in a widely used software, moved laterally using legitimate credentials, and exfiltrated data via encrypted channels. The attack was highly sophisticated and targeted specific research documents. Which threat actor type is most likely responsible?

   • ANation-state actor
   • BHacktivist
   • CCybercriminal group
   • DInsider threat
   Reveal Solution Discussion Select an answer first