Understanding Cyber Threats and Attacks CSA Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A SOC analyst is investigating a security incident where an employee received a phone call from someone claiming to be from the IT department. The caller said there was a critical security issue and asked the employee to provide their username and password to 'verify' their account. The employee provided the credentials, and they were later used to access the corporate VPN. Which social engineering technique is most directly demonstrated in this scenario?

   • APretexting
   • BPhishing
   • CVishing
   • DBaiting
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which network attack involves intercepting and potentially altering communication between two parties without their knowledge?

   • APort scanning
   • BMan-in-the-Middle (MitM)
   • CDenial of Service (DoS)
   • DPacket sniffing
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A SOC team is dealing with a sophisticated DDoS attack that is targeting the company's public-facing web application. The attack traffic is coming from a botnet and is mixed with legitimate traffic, making it difficult to distinguish. The team has limited resources and must choose a mitigation strategy. Which approach would be the most effective while minimizing impact on legitimate users?

   • AUse a cloud-based DDoS protection service that can analyze traffic patterns and filter malicious traffic
   • BBlock all traffic from the botnet's source IP addresses at the firewall
   • CIncrease the bandwidth of the internet connection to absorb the attack
   • DShut down the web application until the attack subsides
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A SOC team has been tracking a threat actor that gained initial access to a company's network six months ago. The actor has moved laterally, established persistence, and periodically exfiltrates small amounts of data to avoid detection. The activity is highly targeted and uses custom tools. Which characteristic best describes this threat actor?

   • AInsider threat with legitimate credentials
   • BHacktivist with a short-term, disruptive agenda
   • CCybercriminal using commodity malware for financial gain
   • DAdvanced persistent threat (APT) with a long-term, stealthy presence
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   In the cyber kill chain, which stage occurs immediately after weaponization?

   • ADelivery
   • BReconnaissance
   • CExploitation
   • DActions on Objectives
   Reveal Solution Discussion Select an answer first