Perform Threat Hunting Activities NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat hunter is using the Cyber Kill Chain to analyze an intrusion. The hunter has identified that the adversary used a spear-phishing email with a malicious attachment to gain initial access. According to the Cyber Kill Chain, which phase is the adversary currently in?

   • AWeaponization
   • BExploitation
   • CDelivery
   • DInstallation
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is responding to a ransomware incident. The team has identified the ransomware family and has a decryptor available. However, the team is unsure if the decryptor is safe to use because the ransomware may have also exfiltrated data. Which action should the team take first?

   • APreserve forensic evidence before running the decryptor
   • BRun the decryptor immediately to restore access to critical files
   • CDisconnect the system from the network and wait
   • DPay the ransom to ensure data is not leaked
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A threat hunter is analyzing an alert where an attacker used a spear-phishing email to deliver a malicious macro-enabled document. According to the Cyber Kill Chain, which stage does this activity represent?

   • ADelivery
   • BExploitation
   • CWeaponization
   • DInstallation
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's security team notices a sudden increase in file rename operations across multiple file servers. The renamed files have extensions like .encrypted and .locked. Which hunting query would be most effective to confirm a ransomware attack and identify the patient zero?

   • ASearch for files with double extensions like .pdf.exe
   • BSearch for any user who logged in from a new IP address in the last 24 hours
   • CSearch for processes that accessed multiple files in a short time and then attempted to delete shadow copies
   • DSearch for network connections to known command-and-control IP addresses
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a threat hunting exercise, an analyst discovers a PowerShell script that downloads an executable from a remote server and runs it in memory. The script also disables Windows Defender. Which TTPs should the analyst document for this activity?

   • ACredential access via keylogging, lateral movement via SMB, and collection via screen capture
   • BExecution via PowerShell, defense evasion by disabling security tools, and command and control via the remote server
   • CInitial access via phishing, persistence via registry run keys, and exfiltration via FTP
   • DImpact via data encryption, exfiltration via email, and command and control via DNS
   Reveal Solution Discussion Select an answer first