Understanding Cyber Threats and Attacks CSA Practice Questions (Page 11)

Questions 51–54

1. 51application · medium

   A SOC analyst is investigating a phishing incident where an employee received an email that appeared to be from the company's IT department. The email urged the employee to 'verify' their account by clicking a link and entering their password. The employee did so, and the credentials were later used to access the corporate VPN. Which social engineering technique is most directly demonstrated in this scenario?

   • APhishing
   • BBaiting
   • CTailgating
   • DPretexting
   Reveal Solution Discussion Select an answer first
2. 52foundation · easy

   Which stage of the APT lifecycle involves establishing a foothold in the target network?

   • ALateral movement
   • BExfiltration
   • CInitial compromise
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A SOC analyst is reviewing threat intelligence and notices that a known threat actor group has been observed using a specific malware family that communicates with a command-and-control (C2) server using a custom protocol over port 443. The group typically uses spear-phishing with malicious attachments as their initial entry vector. The analyst's organization has a strong email filtering solution and up-to-date antivirus. Which additional defensive measure would be most effective in detecting this threat?

   • AUninstalling all PDF readers to prevent the malicious attachments from executing
   • BBlocking all outbound traffic on port 443
   • CImplementing network traffic analysis to detect anomalous C2 communication patterns
   • DDisabling all email attachments in the organization
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   What is a unique risk posed by insider threats compared to external attackers?

   • AThey always operate from outside the network
   • BThey require sophisticated hacking tools
   • CThey are always motivated by financial gain
   • DThey have legitimate access and knowledge of internal systems
   Reveal Solution Discussion Select an answer first