Understanding Cyber Threats and Attacks CSA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC analyst is investigating a network anomaly where a server is receiving a large volume of UDP packets from many different source IPs. The packets are small, and the destination port is 53 (DNS). The server is not a DNS server, but it is responding to these packets with larger DNS responses. The analyst suspects a DNS amplification attack. Which defensive measure would be most effective in mitigating this attack?

   • AConfiguring the firewall to rate-limit DNS responses from the server
   • BBlocking all inbound UDP traffic to the server
   • CIncreasing the server's bandwidth to absorb the attack
   • DDisabling recursive DNS resolution on the server
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary goal of a Distributed Denial of Service (DDoS) attack?

   • ATo intercept and modify network traffic
   • BTo overwhelm a target with traffic from multiple sources
   • CTo gain unauthorized access to a network
   • DTo steal confidential data from a server
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC team has been investigating a series of small, seemingly unrelated security incidents over the past six months. The incidents include spear-phishing emails to specific employees, occasional malware detections on a few workstations, and unusual outbound connections from a server that were quickly blocked. The team has not been able to attribute these to a single cause. Which characteristic of an advanced persistent threat (APT) is most clearly demonstrated by this pattern?

   • AThe use of zero-day exploits
   • BThe long-term, stealthy nature of the campaign
   • CThe use of ransomware for financial gain
   • DThe rapid, automated propagation of malware
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which statement best reflects the evolving nature of the current cyber threat landscape?

   • AAttackers are shifting from manual exploitation to automated, AI-driven attack tools
   • BMost attacks now originate from insider threats rather than external actors
   • CCyber attacks are becoming less frequent but more targeted
   • DThreat actors are increasingly using commodity malware that is easy to detect
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A SOC team is investigating a breach that has been ongoing for over a year. The attacker used a zero-day exploit to gain initial access, then moved laterally using legitimate administrative tools. The attacker has been exfiltrating data in small amounts to avoid detection. The team has identified the attacker's command-and-control (C2) infrastructure. Which of the following actions would be the most effective to disrupt the attack while minimizing the risk of alerting the attacker?

   • ABlock the C2 domains at the firewall and monitor for any attempts to connect
   • BImmediately shut down all affected servers to contain the breach
   • CDisconnect the entire network from the internet to prevent further exfiltration
   • DPatch the zero-day vulnerability on all systems immediately
   Reveal Solution Discussion Select an answer first