Blue Team Defense Concepts GSOC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is reviewing threat intelligence that indicates a specific adversary is using a new phishing lure that mimics the company's internal IT helpdesk. The intelligence includes the subject line and a link to a malicious domain. What is the MOST effective way for the blue team to use this intelligence to protect the organization?

   • AAdd the malicious domain to the SIEM as a watchlist and monitor for any traffic to it.
   • BSend a company-wide email warning users about the phishing campaign.
   • CCreate an email security rule to block the malicious domain and alert on the specific subject line.
   • DBlock the malicious domain at the firewall and wait for the campaign to end.
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   A new SOC analyst is joining the blue team. The team lead wants to ensure the analyst understands the core objective of the blue team. Which statement best describes the primary objective?

   • ATo simulate attacks against the organization to identify vulnerabilities before real attackers do
   • BTo manage the organization's public relations and external communications
   • CTo develop and implement new software features for the organization's products
   • DTo proactively defend the organization's systems and networks by detecting, analyzing, and responding to security threats
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which activity is a core function of a blue team?

   • AConducting social engineering campaigns to test employee awareness
   • BAnalyzing security logs to identify indicators of compromise and potential intrusions
   • CDeveloping a new exploit for a zero-day vulnerability
   • DExploiting a newly discovered vulnerability in a web application to demonstrate impact
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations team is reviewing a threat intelligence report that describes a new malware family targeting point-of-sale (POS) systems. The report includes the malware's behavior, such as memory scraping and network communication patterns. The team wants to use this intelligence to improve their detection capabilities. Which action would be MOST effective?

   • ADisable all memory scraping tools on POS systems.
   • BSearch for the malware's file hash in the organization's file system.
   • CBlock all network communication from POS systems to the internet.
   • DCreate behavioral detection rules in the EDR and SIEM based on the described behaviors.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has just experienced a security incident where an attacker gained access to a single user's workstation and is suspected of moving laterally. The incident response team has identified the initial entry point and the affected workstation. The team is now deciding on the next step. The workstation is used by the CEO and contains sensitive, unreplicated data. The team needs to preserve evidence for potential legal action while also preventing the attacker from causing further damage. What is the MOST appropriate immediate action?

   • ADisconnect the workstation and power it off to preserve the RAM for later analysis.
   • BImmediately wipe the workstation and reinstall the operating system from a clean image.
   • CIsolate the workstation from the network while preserving the disk for forensic imaging.
   • DContinue monitoring the workstation to gather more intelligence on the attacker's actions.
   Reveal Solution Discussion Select an answer first