Tools and Techniques CS0-003 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   While analyzing a packet capture in Wireshark, an analyst wants to see only packets that contain the string 'malware' in the payload. Which Wireshark feature should the analyst use?

   • AColorize rules
   • BCapture filter
   • CDecode As
   • DDisplay filter
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A security analyst wants to automate the process of checking a list of IP addresses against a threat intelligence feed. Which Python library is most commonly used for making HTTP requests to the threat intelligence API?

   • Asocket
   • Bpandas
   • Cscapy
   • Drequests
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A security analyst is reviewing network logs and notices a series of failed login attempts from a single IP address occurring at regular intervals. Which pattern recognition technique is most directly applicable to identifying this as a potential brute-force attack?

   • ATemporal pattern recognition
   • BStatistical anomaly detection
   • CSignature-based detection
   • DFrequency analysis
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A user reports receiving an email that appears to be from their bank, asking them to click a link and verify their account. The analyst examines the email header and sees the 'Received' path shows the message originated from an IP address in a foreign country, and the 'Reply-To' address is not the bank's domain. Which conclusion is most supported by this evidence?

   • AThe email is a spear-phishing attempt because it is targeted at a specific user.
   • BThe email is a hoax because the link should be checked with VirusTotal first.
   • CThe email is legitimate because the bank's domain appears in the From field.
   • DThe email is likely a phishing attempt because the header shows a mismatched origin and reply-to address.
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   An analyst is investigating a phishing email that contains a link to a suspicious website. The analyst wants to check if the URL is known to host malware without visiting the site. Which action should the analyst take?

   • ASubmit the URL to VirusTotal and review the URL scan results.
   • BUse Wireshark to capture traffic to the URL's domain.
   • CUse the SIEM to check if the URL has been accessed by other users.
   • DUse a web browser to visit the URL and observe the content.
   Reveal Solution Discussion Select an answer first