Threat Intelligence and Hunting CS0-003 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security analyst is investigating a series of attacks where the attacker used a phishing email to deliver a macro-enabled document, then used PowerShell to download a payload, and finally used scheduled tasks for persistence. The analyst wants to map these actions to the MITRE ATT&CK framework to identify gaps in detection. Which tactic would the analyst NOT find in the ATT&CK framework for these actions?

   • AExecution
   • BExfiltration
   • CPersistence
   • DInitial Access
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team at a hospital has detected a ransomware attack and wants to share indicators of compromise (IOCs) with other healthcare organizations to help them defend against the same campaign. Which method should they use to share this intelligence?

   • APost the IOCs on a public pastebin site
   • BPublish the IOCs on the hospital's website
   • CShare via the Health Information Sharing and Analysis Center (H-ISAC)
   • DEmail the IOCs to every hospital in the country
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   An organization subscribes to a commercial threat intelligence feed that provides real-time indicators of compromise and analysis from a paid vendor. Which type of threat intelligence collection method does this represent?

   • AOpen-source intelligence (OSINT)
   • BProprietary intelligence
   • CTechnical intelligence (TECHINT)
   • DHuman intelligence (HUMINT)
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A threat intelligence analyst at a security operations center is evaluating a new intelligence feed that reports a specific IP address as a command-and-control server. The feed is from a small, newly established vendor with no track record, and the report is based on a single sandbox analysis. The analyst must decide whether to block the IP address. What should the analyst do?

   • AIgnore the feed entirely because it is from a new vendor
   • BAssign a low confidence level and corroborate with other sources before blocking
   • CBlock the IP address only if it is already on a blocklist
   • DBlock the IP address immediately because the feed is a trusted source
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A threat hunter is looking for signs of a specific APT group that is known to use living-off-the-land binaries (LOLBins) and to maintain persistence via WMI event subscriptions. The hunter has access to endpoint logs and wants to proactively search for these TTPs. Which approach should the hunter take?

   • ASearch for WMI event subscription creation events and LOLBin executions
   • BSearch for new user accounts and group memberships
   • CAnalyze DNS logs for unusual domain queries
   • DReview firewall logs for outbound connections to known malicious IPs
   Reveal Solution Discussion Select an answer first