Understanding Cyber Threats and Attacks CSA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A SOC analyst is reviewing threat intelligence reports and notices that a known threat actor group has been observed performing extensive reconnaissance on organizations in the same industry as the analyst's company. The reports indicate the group typically uses spear-phishing with malicious attachments as their initial entry vector. Which stage of the cyber kill chain is the group currently in?

   • AWeaponization
   • BActions on Objectives
   • CDelivery
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary behavior of ransomware?

   • AIt records keystrokes to steal credentials
   • BIt replicates itself across the network
   • CIt encrypts files and demands payment for decryption
   • DIt hides inside legitimate programs
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A SOC team is investigating a data breach where sensitive customer data was exfiltrated. The investigation shows that the data was accessed using a legitimate employee's credentials during business hours. The employee has a history of accessing customer data as part of their job, and they have no prior security incidents. The employee claims they did not download the data, but they did click on a link in a phishing email the previous day. Which conclusion is most likely?

   • AThe employee's account was compromised by an external attacker via phishing
   • BThe employee accidentally leaked the data through a misconfigured application
   • CThe employee is a malicious insider who intentionally stole the data
   • DThe employee is a negligent insider who ignored security policies
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC analyst receives an alert about a user who clicked a link in an email that appeared to be from the company's IT department, asking them to verify their password. The email originated from an external domain that closely resembles the company's domain. The user entered their credentials on the linked page. Which combination of techniques best describes this attack?

   • AWhaling with a CEO impersonation and vishing call
   • BPhishing with a lookalike domain and credential harvesting
   • CSpear phishing with a malicious attachment and payload execution
   • DPretexting with a false IT identity and baiting with a fake login page
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary purpose of the reconnaissance stage in the attack lifecycle?

   • ATo deliver the malicious payload
   • BTo establish command and control
   • CTo exfiltrate sensitive data
   • DTo gather information about the target
   Reveal Solution Discussion Select an answer first