Proactive Detection and Analysis GSOM Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A threat hunter is reviewing network flow data and notices that a small number of internal hosts are communicating with a newly registered domain that has no historical presence in the environment. The hunter wants to determine if this is malicious. Which next step best applies hypothesis-driven analysis?

   • AImmediately block the domain at the firewall.
   • BIgnore the traffic because the domain is new and may be benign.
   • CFormulate a hypothesis that the domain may be a C2 server, then investigate the hosts' processes and any related DNS queries.
   • DAdd the domain to a threat intelligence blocklist without further analysis.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC analyst is reviewing a series of alerts that show a pattern: an attacker is using a legitimate remote management tool (RMM) to move laterally across the network. The analyst recognizes this as a 'living off the land' technique. Which proactive action is most appropriate?

   • AIncrease the alert severity for all RMM tool usage.
   • BHunt for other instances of the RMM tool being used outside of approved administrative workflows.
   • CBlock the RMM tool entirely to prevent abuse.
   • DWait for more alerts to confirm the pattern before acting.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A detection engineer is designing a rule to detect 'unusual outbound data transfers' from a server that normally sends less than 100 MB per day. The rule must minimize false positives while catching exfiltration. The engineer has access to NetFlow and proxy logs. Which approach best balances fidelity and coverage?

   • ADisable the rule and rely on the proxy's built-in data loss prevention (DLP) features.
   • BCreate a baseline of normal transfer volume per host and alert when the volume exceeds a threshold, then correlate with proxy logs to identify the destination.
   • CAlert on any outbound transfer greater than 100 MB from any host.
   • DAlert only when the destination IP is in a threat intelligence feed.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization wants to improve its proactive detection capabilities by integrating new data sources. Currently, they collect Windows event logs and firewall logs, but they lack visibility into DNS queries and endpoint process command lines. Which data source integration would most directly enhance the ability to detect command-and-control (C2) communication and malicious process execution?

   • AEnable verbose logging on the firewall.
   • BIntegrate DNS query logs and enable command-line auditing on endpoints.
   • CCollect authentication logs from domain controllers.
   • DIntegrate NetFlow data from the core router.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is reviewing a series of alerts that show a user account attempting to log in from multiple geographic locations within a short time period. The analyst also notices that the account recently had its password reset. Which attack pattern is most likely indicated by these observations?

   • ACredential theft and unauthorized access, possibly involving a password reset by the attacker.
   • BA distributed denial-of-service (DDoS) attack against the authentication service.
   • CA misconfigured VPN that is routing traffic through multiple countries.
   • DA malware infection that is encrypting files on the user's workstation.
   Reveal Solution Discussion Select an answer first