Blue Team Defense Concepts GSOC Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A manufacturing company's security team is deploying a new monitoring solution for its OT network, which contains legacy PLCs that cannot run any endpoint agent. The team needs to detect known malicious command sequences targeting these PLCs at the network layer, and they also want to see historical traffic patterns for forensic analysis after an incident. Which combination of controls best meets these requirements?

   • AConfigure the existing SIEM to collect syslog from the PLCs and generate alerts based on log patterns.
   • BInstall an EDR agent on the engineering workstations that manage the PLCs and rely on its network telemetry.
   • CDeploy a network-based IDS with signature updates and enable full packet capture to a central storage system.
   • DDeploy a host-based IPS on the network switches and enable NetFlow export to the SIEM.
   Reveal Solution Discussion Select an answer first
2. 37application · easy

   After a malware outbreak is contained and eradicated, the incident response team restores the affected servers from clean backups and verifies that they are functioning normally. Which phase of the incident response lifecycle does this represent?

   • ALessons Learned
   • BRecovery
   • CContainment
   • DEradication
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which incident response phase involves developing and implementing measures to prevent a similar incident from occurring in the future?

   • ALessons Learned
   • BEradication
   • CPreparation
   • DRecovery
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   How does threat intelligence primarily assist a blue team?

   • ABy automatically patching all vulnerabilities in the environment
   • BBy providing information about potential threats that can be used to prioritize defensive actions
   • CBy replacing the need for security monitoring
   • DBy guaranteeing that no attack will succeed
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A threat intelligence analyst provides the SOC with a report indicating that a specific adversary group is actively targeting the organization's industry using a new phishing lure. The report includes the indicators of compromise (IOCs) and the TTPs used. What is the most effective way for the SOC to use this intelligence?

   • AUpdate the SIEM with the IOCs and create detection rules based on the TTPs
   • BWait for the adversary to attack before using the intelligence
   • CShare the report with all employees and ask them to be more careful with emails
   • DStore the report in the ticketing system for future reference
   Reveal Solution Discussion Select an answer first