Reconnaissance, Threat Handling, and Incident Response GDAT Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   An analyst detects a suspicious process on a server that is communicating with an external IP address. The analyst has isolated the server and collected memory and disk images. What is the next step in the threat handling process?

   • AContain the threat by blocking the external IP at the firewall
   • BEradicate the threat by deleting the malicious process
   • CRecover the system by restoring from backup
   • DAnalyze the collected evidence to determine the scope and impact
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A threat intelligence platform provides two feeds: one with high-confidence indicators of compromise (IOCs) for a specific APT group, and another with low-confidence indicators from a broader set of sources. The security team has limited resources and must prioritize detection efforts. What is the most effective approach?

   • AUse both feeds equally and create rules for all IOCs
   • BPrioritize the low-confidence feed because it covers more threats
   • CPrioritize the high-confidence feed and create detection rules for those IOCs first
   • DIgnore both feeds and rely on internal detection
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A post-incident review identifies that the incident response team lacked visibility into cloud-based assets, which delayed detection. The team also found that threat intelligence was not integrated into the SIEM. What is the most effective improvement to implement?

   • ACreate a new incident response plan
   • BHire more incident responders
   • CIntegrate cloud logs into the SIEM and add threat intelligence feeds
   • DConduct more tabletop exercises
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security analyst is reviewing a suspicious process that is making outbound connections to an IP address that is not on any blocklist. The process name is 'svchost.exe' but it is running from the user's Temp directory. Which indicator of compromise is most reliable in confirming malicious activity?

   • AThe process name 'svchost.exe'
   • BThe file path of the executable
   • CThe fact that it is making outbound connections
   • DThe outbound IP address
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A security team is investigating a series of alerts that appear to be related to a known advanced persistent threat (APT) group. The team has access to threat intelligence that includes the group's tactics, techniques, and procedures (TTPs). How should the team use this intelligence to improve its incident response?

   • ABlock all IP addresses associated with the APT group
   • BSearch for indicators of compromise (IOCs) that match the group's known tools and infrastructure
   • CWait for the threat intelligence feed to provide more specific IOCs
   • DIgnore the alerts because the APT group is known to target other industries
   Reveal Solution Discussion Select an answer first