A SOC analyst is investigating an incident where a contractor accidentally emailed a spreadsheet containing customer PII to the wrong recipient. The contractor had been granted temporary access to the data for a project. Which type of insider threat does this represent, and what is the most important lesson for the organization?

Malicious insider; terminate the contractor's access immediately

Accidental insider; enforce data loss prevention (DLP) and proper access controls

Compromised insider; reset the contractor's password

Negligent insider; provide additional training

A SOC analyst is reviewing a phishing campaign targeting the company. The emails are highly personalized, using the target's name, job title, and recent social media activity. The emails contain a link to a fake login page that mimics the company's single sign-on (SSO) portal. The analyst notices that the emails are only sent to a small group of high-level executives. Which type of social engineering attack is this, and what is the most effective defense?

Pretexting; verify the sender's identity via phone call

Phishing; enable email spam filters

Spear phishing; implement multi-factor authentication (MFA) and conduct targeted security awareness training

Whaling; block the sender's email domain at the gateway

What is the primary role of threat intelligence in a SOC?

To automate all incident response actions

To provide context about threats to improve detection and response

To guarantee prevention of all cyber attacks

To replace the need for security monitoring

What is the primary impact of a Cross-Site Scripting (XSS) attack?

Redirecting users to a fake login page

Executing malicious scripts in a user's browser

Overloading the web server with traffic

A SOC analyst is investigating a report of slow network performance and unusual SSL certificates on an internal web application. The analyst suspects a man-in-the-middle (MITM) attack. Which evidence would most strongly confirm this suspicion?

An SSL certificate that is not issued by the organization's trusted CA

A sudden increase in outbound traffic to a known malicious IP

A new user account with administrative privileges

Multiple failed login attempts on the web application

EC-CouncilCertified SOC Analyst

Domain 2Objective 1

Understanding Cyber Threats and Attacks CSA Practice Questions (Page 2)

Part of the Cyber Threats and Attack Methodology domain, which makes up ~21% of our current practice bank.

54questions here

11free pages

10concepts

Questions 6–10

6application · medium
A SOC analyst is investigating an incident where a contractor accidentally emailed a spreadsheet containing customer PII to the wrong recipient. The contractor had been granted temporary access to the data for a project. Which type of insider threat does this represent, and what is the most important lesson for the organization?
Select an answer first
7expert · hard
A SOC analyst is reviewing a phishing campaign targeting the company. The emails are highly personalized, using the target's name, job title, and recent social media activity. The emails contain a link to a fake login page that mimics the company's single sign-on (SSO) portal. The analyst notices that the emails are only sent to a small group of high-level executives. Which type of social engineering attack is this, and what is the most effective defense?
Select an answer first
8foundation · easy
What is the primary role of threat intelligence in a SOC?
Select an answer first
9foundation · easy
What is the primary impact of a Cross-Site Scripting (XSS) attack?
Select an answer first
10application · medium
A SOC analyst is investigating a report of slow network performance and unusual SSL certificates on an internal web application. The analyst suspects a man-in-the-middle (MITM) attack. Which evidence would most strongly confirm this suspicion?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Understanding Cyber Threats and Attacks CSA Practice Questions (Page 2)

Questions 6–10

What is the primary role of threat intelligence in a SOC?

What is the primary impact of a Cross-Site Scripting (XSS) attack?

A SOC analyst is investigating a report of slow network performance and unusual SSL certificates on an internal web application. The analyst suspects a man-in-the-middle (MITM) attack. Which evidence would most strongly confirm this suspicion?

Keep studying — Cyber Threats and Attack Methodology