Detecting Modern Attacks GEIR Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A security team is evaluating its detection capabilities for modern attacks. They notice that attackers are using encrypted tunnels to hide their activity, and the team's current detection tools are not effective at inspecting encrypted traffic. Which principle of modern attack detection should guide their improvement efforts?

   • AIncrease the amount of network traffic captured and stored for later analysis
   • BRely on threat intelligence feeds to identify known malicious IP addresses and domains
   • CFocus on detecting the attacker's actions on the host, such as process execution and registry changes, rather than only network traffic
   • DDeploy more firewalls to segment the network and limit lateral movement
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SOC analyst is reviewing three alerts: (1) a phishing email reported by a user, (2) a successful login from a new device for a user who clicked the phishing link, and (3) a PowerShell process creating a scheduled task on the same user's workstation. Which alert should be prioritized for immediate investigation?

   • AThe successful login from a new device, because it indicates account compromise.
   • BThe phishing email report, because it is the earliest indicator of the attack chain.
   • CAll three alerts equally, because they are part of the same attack chain.
   • DThe PowerShell process creating a scheduled task, because it indicates active persistence and execution.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a core principle of modern attack detection in enterprise environments?

   • AAssuming that all attacks will be detected at the point of initial compromise
   • BFocusing on known signatures and indicators of compromise (IOCs) only
   • CLeveraging multiple data sources and behavioral analytics to identify suspicious activity
   • DRelying on a single, comprehensive security tool to detect all attacks
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A security team notices a server sending a large volume of data to an external IP address over HTTPS on port 443. The connection persists for several hours and the data volume is significantly higher than the server's normal baseline. Which detection method would best confirm data exfiltration versus normal encrypted traffic?

   • ACheck the server's DNS cache for recent queries to the external domain.
   • BUse a network proxy with SSL inspection to decrypt and analyze the traffic content.
   • CBlock the external IP address and observe if the server's behavior returns to normal.
   • DInspect the TLS certificate presented by the external server and compare it to known certificates for the organization's business partners.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company has a mature SIEM and wants to improve detection of initial access via valid accounts. They have enabled logging for all successful and failed logons. However, they are overwhelmed by false positives from legitimate remote workers logging in from various locations. Which approach would best reduce false positives while still detecting compromised valid accounts?

   • ACreate a baseline of each user's normal logon times, locations, and devices, and alert on significant deviations
   • BAlert on any logon from an IP address that is not in the company's known VPN egress ranges
   • CRequire multi-factor authentication for all remote logons and alert on any logon that does not use MFA
   • DAlert on any logon that occurs outside business hours
   Reveal Solution Discussion Select an answer first