Understanding Cyber Threats and Attacks CSA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC team receives a threat intelligence report indicating that a specific threat actor group is using a new phishing technique that bypasses email filters. The report includes indicators of compromise (IOCs) such as malicious domains and file hashes. What is the most effective way to use this intelligence to improve the organization's defenses?

   • ATrain all employees to recognize phishing emails
   • BDisconnect the organization from the internet to prevent the attack
   • CUpdate email filters and block the listed IOCs immediately
   • DWait for the attack to occur before taking action
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A SOC analyst is investigating a web application breach. The logs show that an attacker submitted a crafted input in a search field that caused the application to return an error message containing database table names and SQL syntax. The attacker then used this information to extract customer records. Which attack technique was used, and what is the most effective mitigation?

   • ACross-site request forgery (CSRF); use anti-CSRF tokens
   • BCross-site scripting (XSS); sanitize user input and encode output
   • CMan-in-the-middle (MITM); enforce HTTPS and certificate pinning
   • DSQL injection; use parameterized queries and input validation
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC analyst is reviewing firewall logs and notices that a user's workstation is communicating with an external IP address on port 445 (SMB). The workstation is not a file server, and the user has no business need to use SMB externally. The analyst also sees that the workstation has been making connections to multiple internal IPs on port 445. Which attack vector is most likely being exploited?

   • AA social engineering attack
   • BA web application vulnerability
   • CA network service vulnerability (SMB)
   • DA physical security breach
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of an attack vector?

   • AAn unpatched web server
   • BA misconfigured firewall rule
   • CA phishing email
   • DA weak password policy
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC team is reviewing threat intelligence and sees that a known threat actor group has been observed using a specific malware family that communicates with a command-and-control (C2) server using a custom protocol over port 443. The group typically uses spear-phishing with malicious attachments as their initial entry vector. The analyst's organization has a strong email filtering solution and up-to-date antivirus. Which additional defensive measure would be most effective in detecting this threat?

   • AImplementing network traffic analysis to detect anomalous C2 communication patterns
   • BUninstalling all PDF readers to prevent the malicious attachments from executing
   • CBlocking all outbound traffic on port 443
   • DDisabling all email attachments in the organization
   Reveal Solution Discussion Select an answer first