Proactive Detection and Analysis GSOM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat intelligence feed reports that a specific APT group is currently using PowerShell to download and execute payloads from a set of newly registered domains. The security team wants to proactively search for this activity in their environment. Which hypothesis-driven approach is most effective?

   • ASearch endpoint logs for PowerShell processes that contain download commands referencing the reported domains, and then review the parent processes of those executions.
   • BWait for the EDR to generate alerts based on the new intelligence feed.
   • CSearch firewall logs for any connection to the reported domains, regardless of the process.
   • DBlock all PowerShell execution across the enterprise to prevent the attack.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which outcome is most directly associated with effective proactive detection?

   • AReduced dwell time for adversaries in the network
   • BElimination of all security incidents
   • CGuaranteed prevention of data exfiltration
   • DIncreased number of false positive alerts
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC has a detection rule that has been in place for six months. Over time, the rule's true-positive rate has declined, and the false-positive rate has increased. The team suspects that changes in the environment, such as new applications, are causing the decline. Which action is most appropriate for the continuous improvement loop?

   • ALeave the rule unchanged because it was effective in the past.
   • BDelete the rule because it is no longer effective.
   • CIncrease the rule's threshold to reduce false positives, even if it may miss some true positives.
   • DReview the rule's recent alert history, identify the new benign patterns, and update the rule to exclude them while preserving the original detection intent.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a hunt, an analyst discovers that a legitimate user account is being used to create scheduled tasks that run PowerShell scripts that connect to an external IP address on port 443. The scripts are obfuscated. Which attack pattern is most consistent with these observations?

   • AA brute-force attack against the user's account.
   • BA distributed denial-of-service (DDoS) attack originating from the host.
   • CA ransomware encryption process that is encrypting local files.
   • DPersistence and command-and-control (C2) via scheduled tasks and PowerShell.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A threat hunter is investigating a series of alerts that show a service account running 'whoami' and 'net group' commands on multiple servers. The account is not supposed to have interactive logon rights. The hunter also notices that the commands are being executed via scheduled tasks. Which conclusion is most supported by these observations?

   • AThe scheduled tasks are part of a legitimate patch management process.
   • BThe service account may be compromised and used for lateral movement and privilege escalation reconnaissance.
   • CThe service account is performing routine maintenance tasks.
   • DThe alerts are false positives caused by a misconfigured monitoring tool.
   Reveal Solution Discussion Select an answer first