Understanding Cyber Threats and Attacks CSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is expanding its attack surface by allowing employees to use personal mobile devices to access corporate email and applications. The security team is concerned about new attack vectors. Which of the following is the most significant new attack vector introduced by this policy?

   • AIncreased risk of distributed denial-of-service (DDoS) attacks
   • BUnmanaged devices with potentially weak security controls
   • CHigher likelihood of SQL injection attacks on the email server
   • DGreater exposure to man-in-the-middle attacks on the corporate network
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following best describes the primary motivation of a financially motivated cybercriminal group?

   • ATo disrupt critical infrastructure for political or ideological reasons
   • BTo gain strategic military advantage over an adversary nation
   • CTo expose corporate wrongdoing and promote social change
   • DTo steal sensitive data or extort money from victims
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A SOC analyst notices that a legitimate user account has been downloading large amounts of sensitive data to a personal USB drive during off-hours. The user has no history of policy violations. Which type of insider threat does this represent, and what is the most appropriate immediate action?

   • ANegligent insider; log a ticket for user awareness training
   • BAccidental insider; send a reminder about data handling policies
   • CMalicious insider; immediately revoke the user's access and escalate to management
   • DCompromised insider; run an antivirus scan on the user's workstation
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC team is investigating a series of incidents over the past year. They have observed: (1) spear-phishing emails sent to a few employees in the finance department, (2) a small number of malware detections on workstations that were quickly contained, (3) unusual outbound connections from a server that were blocked, and (4) a gradual increase in the volume of data being transferred to an external cloud storage service. The team has not been able to attribute these to a single cause, and the incidents have not caused significant disruption. Which hypothesis is most consistent with the observations?

   • AAn insider is accidentally leaking data through cloud storage
   • BAn advanced persistent threat (APT) is conducting a long-term espionage campaign
   • CA cybercriminal group is preparing a ransomware attack
   • DA hacktivist group is conducting a low-impact protest campaign
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst is investigating a data breach where sensitive customer records were exfiltrated. The investigation reveals that the data was accessed using a legitimate employee's credentials during business hours. The employee claims they did not download the data, but they did click on a link in a phishing email the previous day. Which type of insider threat is most likely responsible?

   • AA negligent insider who ignored security policies
   • BA malicious insider who intentionally stole the data
   • CAn external attacker who compromised the employee's account
   • DAn accidental insider who inadvertently caused the breach
   Reveal Solution Discussion Select an answer first