Detecting Modern Attacks GEIR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Mapping an attacker's technique to the 'Lateral Movement' stage of the MITRE ATT&CK framework helps analysts primarily to:

   • APredict the attacker's next target based on the kill chain stage
   • BAssign a severity score to the initial phishing email
   • CDetermine the specific detection opportunities at that stage of the attack
   • DIdentify which security controls were bypassed during initial access
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   During an incident, the IR team discovers that the attacker has been using a compromised service account to authenticate to multiple servers and has created a new domain admin account. The team needs to contain the incident while minimizing downtime for business-critical applications that depend on the service account. Which containment strategy is most effective?

   • AIsolate all affected servers from the network and then reset the accounts.
   • BImmediately disable the compromised service account and the new domain admin account.
   • COnly remove the new domain admin account and leave the service account active for monitoring.
   • DReset the service account password and remove the new domain admin account, then monitor for anomalies.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An organization is trying to detect C2 traffic that uses HTTPS to blend in with normal web traffic. They have a web proxy that can decrypt and inspect HTTPS traffic, but doing so requires installing a root certificate on all endpoints and may cause privacy concerns. Which approach would best balance detection capability with operational impact?

   • ADecrypt all HTTPS traffic at the proxy and inspect for malicious content
   • BRely on endpoint detection and response (EDR) to detect C2 by monitoring process behavior
   • CUse TLS fingerprinting and JA3 hashes to identify known C2 tools without decrypting traffic
   • DBlock all HTTPS traffic to unknown domains to prevent C2
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC is investigating a potential breach. Alerts show: (1) a user reported a phishing email, (2) the same user's account logged in from a foreign IP, (3) the account then accessed a file share containing sensitive data, and (4) a new scheduled task was created on the user's workstation. The team has limited resources and must decide which alert to investigate first. Which alert should be prioritized?

   • AThe file share access, because it indicates data breach.
   • BThe scheduled task creation, because it indicates the attacker is actively maintaining access.
   • CThe phishing email report, because it is the initial attack vector.
   • DThe foreign IP login, because it indicates account takeover.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An incident responder notices that a security tool on a critical server has been stopped, and the Windows Event Log for the service has been cleared. The server is also running a scheduled task that was not present before. Which detection method would have been most likely to catch this defense evasion activity?

   • AA scheduled task that runs a script to check the status of security tools
   • BA network intrusion detection system that monitors outbound traffic
   • CCentralized logging that forwards security events to a SIEM in real time
   • DA host-based intrusion detection system that monitors file integrity
   Reveal Solution Discussion Select an answer first