A company is migrating its on-premises applications to a public cloud provider. The security team is concerned about the new attack surface. They have identified that the cloud environment exposes management APIs, storage buckets, and virtual machines to the internet. Which of the following is the most critical attack surface to secure first?

Network firewalls, because they control traffic flow

Management APIs, because they provide administrative control over cloud resources

Storage buckets, because they may contain sensitive data

Virtual machines, because they are directly accessible

A SOC analyst notices that a user's workstation is sending a large volume of outbound traffic to an external IP address that is not on any known threat list. The traffic is encrypted, and the workstation shows no signs of a traditional virus or trojan. The analyst also sees that the workstation is making repeated DNS queries to a domain that was recently registered. Which type of malware behavior is most consistent with these observations?

A ransomware payload that is encrypting files and waiting for payment

A worm that is self-propagating across the network

A keylogger that is capturing credentials and sending them via email

A remote access trojan (RAT) that is establishing command-and-control communication

A SOC team is evaluating threat intelligence sources to improve their detection capabilities. They have a limited budget and need to prioritize. They have identified a commercial threat intelligence feed that provides real-time IOCs, an open-source feed that provides historical data, and internal intelligence from past incidents. Which combination of sources would provide the most comprehensive and actionable intelligence?

Only the commercial feed, as it is the most up-to-date

Only internal intelligence, as it is most relevant to the organization

Commercial feed for real-time IOCs, internal intelligence for context, and open-source for historical trends

Only the open-source feed, as it is free and covers a wide range of threats

Which of the following is considered an attack surface?

A USB drive left in a parking lot

An organization's public-facing web application

EC-CouncilCertified SOC Analyst

Domain 2Objective 1

Understanding Cyber Threats and Attacks CSA Practice Questions (Page 5)

Part of the Cyber Threats and Attack Methodology domain, which makes up ~21% of our current practice bank.

54questions here

11free pages

10concepts

Questions 21–25

21foundation · easy
Which type of threat intelligence focuses on specific threats targeting an organization's industry or technology stack?
Select an answer first
22expert · hard
A company is migrating its on-premises applications to a public cloud provider. The security team is concerned about the new attack surface. They have identified that the cloud environment exposes management APIs, storage buckets, and virtual machines to the internet. Which of the following is the most critical attack surface to secure first?
Select an answer first
23application · medium
A SOC analyst notices that a user's workstation is sending a large volume of outbound traffic to an external IP address that is not on any known threat list. The traffic is encrypted, and the workstation shows no signs of a traditional virus or trojan. The analyst also sees that the workstation is making repeated DNS queries to a domain that was recently registered. Which type of malware behavior is most consistent with these observations?
Select an answer first
24expert · hard
A SOC team is evaluating threat intelligence sources to improve their detection capabilities. They have a limited budget and need to prioritize. They have identified a commercial threat intelligence feed that provides real-time IOCs, an open-source feed that provides historical data, and internal intelligence from past incidents. Which combination of sources would provide the most comprehensive and actionable intelligence?
Select an answer first
25foundation · easy
Which of the following is considered an attack surface?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Understanding Cyber Threats and Attacks CSA Practice Questions (Page 5)

Questions 21–25

Which type of threat intelligence focuses on specific threats targeting an organization's industry or technology stack?

Which of the following is considered an attack surface?

Keep studying — Cyber Threats and Attack Methodology