Understanding Cyber Threats and Attacks CSA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A SOC analyst is analyzing a malware sample that was found on a compromised host. The malware is a file that, when executed, drops a payload that creates a backdoor and also spreads to other hosts by exploiting a network vulnerability. The malware does not require user interaction to spread. Which type of malware is this, and what is the most important containment action?

   • ATrojan; delete the malicious file from the host
   • BVirus; run a full system scan
   • CRansomware; disconnect the host from the network
   • DWorm; isolate the infected host and patch the exploited vulnerability
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes an insider threat?

   • AA competitor stealing trade secrets through cyber espionage
   • BA script kiddie using public exploit tools
   • CA malicious actor who has authorized access to an organization's systems
   • DAn external hacker exploiting a vulnerability
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC analyst is reviewing recent alerts and notices a pattern: a series of phishing emails targeting employees in the finance department, with the goal of convincing them to transfer funds to a specific bank account. The emails are personalized with the employees' names and job titles. Which threat actor profile is most consistent with this activity?

   • AHacktivist group motivated by political ideology
   • BNation-state actor motivated by espionage
   • CCybercriminal group motivated by financial gain
   • DInsider threat with a grudge against the company
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC analyst is reviewing web application logs and sees a series of requests to a search endpoint that include the parameter 'q' with values like "<script>alert(1)</script>". The requests are coming from a single IP address, and the responses include the same script in the page source. The analyst also notices that the application is reflecting the 'q' parameter in the response without sanitization. Which type of web application attack is being attempted, and what is the most likely impact if successful?

   • ACross-site request forgery (CSRF); the attacker could force users to perform unwanted actions
   • BCommand injection; the attacker could execute system commands on the server
   • CSQL injection; the attacker could extract the entire database
   • DCross-site scripting (XSS); the attacker could execute arbitrary JavaScript in other users' browsers
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC team is reviewing threat intelligence feeds and notices that a specific malware family is being distributed via malicious email attachments that use a recently discovered vulnerability in a common PDF reader. The team wants to proactively defend against this threat. Which action is most directly informed by this threat intelligence?

   • ADisabling the PDF reader application across the organization
   • BUpdating antivirus signatures to detect the malware family
   • CBlocking all inbound email attachments
   • DPatching the PDF reader vulnerability and adding email filtering rules for malicious attachments
   Reveal Solution Discussion Select an answer first