Detecting Modern Attacks GEIR Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which detection method is most effective for identifying initial access via valid accounts?

   • ADisabling all administrative accounts
   • BMonitoring for anomalous authentication behavior, such as impossible travel
   • CScanning for known malware signatures on endpoints
   • DBlocking all external email attachments
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which challenge is most characteristic of detecting modern attacks in enterprise environments?

   • AAttackers always use custom malware that is easily identified by antivirus
   • BAttackers blend in with normal user activity and use legitimate administrative tools
   • CAttackers exclusively use zero-day exploits that have no known patches
   • DSecurity teams have too much visibility into endpoint activity
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   During an incident, the security team identifies that an attacker has used a valid domain admin account to move laterally to several servers and create scheduled tasks. The team must decide whether to immediately reset the domain admin account password or first preserve evidence. The incident response plan requires preserving evidence for potential legal action. Which action is most appropriate?

   • AReset the password and then monitor the network for any further activity
   • BImmediately reset the domain admin password to contain the attack, and then preserve evidence
   • CPreserve evidence first by taking memory images and collecting logs, then reset the password
   • DDisconnect the affected servers from the network to contain the attack, and then reset the password
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An incident responder is mapping an attack to the kill chain. The attacker sent a spear-phishing email to an employee, who clicked the link and downloaded a malicious document. The document then established a C2 beacon. Which stage of the kill chain does the C2 beacon represent?

   • ACommand and control
   • BInitial access
   • CActions on objectives
   • DExecution
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which activity is a potential indicator of data exfiltration?

   • AA large, unexpected outbound transfer of data to an external IP address
   • BA scheduled task running on a server
   • CAn increase in inbound email from a known vendor
   • DA user logging in from a new device
   Reveal Solution Discussion Select an answer first