Proactive Detection and Analysis GSOM Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In hypothesis-driven analysis, what is the first step after forming a hypothesis?

   • ADocument the hypothesis in the incident report as a confirmed finding
   • BIdentify relevant data sources and queries to test the hypothesis
   • CImmediately block all traffic from suspicious IP addresses
   • DEscalate the hypothesis to senior management for approval
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations team has observed a recurring pattern in endpoint logs: a legitimate software updater frequently spawns PowerShell with network connections to a known content delivery network. The team suspects that attackers may be abusing this same updater to execute malicious scripts, but the current detection rules treat all updater activity as benign. Which approach best applies a structured threat hunting methodology to uncover hidden malicious activity?

   • AImmediately block all PowerShell executions originating from the software updater to eliminate the risk of abuse.
   • BIncrease the logging level on all endpoints to capture every process creation event, then review the logs at the end of each month.
   • CSearch endpoint logs for PowerShell executions that deviate from the updater's normal command-line arguments, then validate any anomalies against threat intelligence.
   • DCreate a detection rule that alerts on any PowerShell execution from the updater, regardless of command-line arguments.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which tactic is commonly associated with the 'Persistence' phase of the cyber kill chain?

   • ACreating a scheduled task to run a malicious script
   • BDelivering a malicious attachment via email
   • CPerforming network reconnaissance
   • DExfiltrating data to an external server
   Reveal Solution Discussion Select an answer first
5. 4expert · medium

   A security team is integrating new data sources to improve detection of 'insider threat' activity. They have Active Directory logs, endpoint logs, and email logs. Which integration would provide the most comprehensive view of potential data exfiltration by an insider?

   • ACorrelate email logs for large outbound attachments with endpoint logs for file access and network flows for large uploads to external services.
   • BCorrelate email logs with DNS logs to identify phishing attempts.
   • CCorrelate Active Directory logon events with email logs to identify users who log in after hours.
   • DCorrelate endpoint logs with vulnerability scan results to identify unpatched systems.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst notices a pattern in the logs: a user account is being used to create multiple remote PowerShell sessions to different servers in quick succession, followed by the creation of scheduled tasks on those servers. This pattern matches a known adversary TTP for lateral movement and persistence. What is the most proactive action the SOC should take?

   • ACreate a detection rule that alerts on this specific sequence of events and investigate any matches.
   • BIncrease the logging level on all servers to capture more data for future analysis.
   • CDocument the pattern in the incident response plan but take no further action.
   • DImmediately disable the user account to stop the activity.
   Reveal Solution Discussion Select an answer first