Chapter 5 Threat and Vulnerability Management Mark B Flashcards
Which of the following intelligence types focuses on the threat actor and the reason for the attack?
A. Tactical
B. Strategic
C. Targeted
D. Operational
A. Tactical
What is used as a common vector to launch a broad range of attacks?
A. Tactical
B. Strategic
C. Commodity Malware
D. Targeted attacks
C. Commodity Malware
What type of attack would use spear phishing against engineers in the Ukraine electricity supply industry with the goal of gaining user credentials?
A. Deep web
B. Proprietary
C. Commodity Malware
D. Targeted attacks
D. Targeted attacks
Which of the following intelligence types focuses on the technical and automated discovery of everyday threats, threat actors and the reason for the attack?
A. Tactical
B. Strategic
C. Commodity malware
D. Operational threat intelligence
A. Tactical
Which of the following intelligence types uses forensics and historical logs to identify threats?
A. Tactical
B. Strategic
C. Commodity malware
D. Operational threat intelligence
D. Operational threat intelligence
What framework could a forensic team use to document a specific adversary, victim, capabilities and infrastructure?
A. Threat emulation
B. Threat hunting
C. Diamond model
D. STIX
C. Diamond model
What is the most likely threat actor if your router firmware has been tampered with over a period of two years, without being detected?
A. Advanced persistent threat
B. Insider threat
C. Hacktivist
D. Script kiddie
A. Advanced persistent threat
What is the most likely threat actor if your electrical power delivery capabilities are attacked?
A. Nation State
B. Insider threat
C. Hacktivist
D. Script Kiddie
A. Nation State
What threat actor will most likely steal your intellectual property?
A. Advanced persistent threat
B. Competitor
C. Hacktivist
D. Script kiddie
B. Competitor
What is the threat when vulnerabilities are present on your network due to misconfiguration by poorly trained technicians?
A. Advanced persistent threat
B. Insider threat
C. Script kiddie
D. Organized Crime
B. Insider threat
What is the threat when vulnerabilities are present due to the use of third party libraries in our code base?
A. Advanced persistent threat
B. Supply Chain
C. Insider Threat
D. Organized Crime
B. Supply Chain
What is the likely threat actor when thousands of systems are targeted with crypto malware followed up with a demand for $5,000 in bitcoin?
A. Advanced persistent threat
B. Supply chain
C. Insider threat
D. Organized Crime
D. Organized Crime
What is the public network that hosts unindexed and unsearchable content that may be useful for unlawful activities?
A. World Wide Web
B. Intranet
C. Deep web
D. Proprietary networks
C. Deep web
What type of intelligence gathering would involve DNS record harrvesting?
A. Intelligence feeds
B. Deep Web
C. Open Source Intelligence
D. Human intelligence
C. Open Source Intelligence
What type of intelligence gathering would involve physical reconnaissance?
A. Intelligence feeds
B. Deep Web
C. Open Source Intelligence (OSINT)
D. Human intelligence (HUMINT)
D. Human intelligence (HUMINT)
What framework would be the best choice to build up a picture of threat actors and their tactics and techniques for a water treatment plan?
A. MITRE ATT&CK
B. ATT&CK for industrial analysis
C. Diamond model of intrusion analysis
D. Cyber kill chain
B. ATT&CK for industrial analysis
What framework would be used to understand the capabilities of APT29 and how they will target your enterprise information systems?
A. MITRE (ATT&CK)
B. ATT&CK for industrial control system (ICS)
C. Scripts/regular expressions
D. SRTM
A. MITRE (ATT&CK)
What framework uses seven stages, starting with reconnaissance and ending in actions on objectives?
A. MITRE (ATT&CK)
B. ATT&CK for industrial control system (ICS)
C. Diamond model of intrusion analysis
D. Cyber kill chain
D. Cyber kill chain
What file type allow for the analysis of network traffic captured by Wireshark or tcpdump?
A. Packet capture (PCAP)
B. Vulnerability logs
C. Operating system logs
D. Portable Data Format (PDF)
A. Packet capture (PCAP)
What can be used to centrally correlate events form multiple sources and raise alerts?
A. FIM Alerts
B. SIEM Alerts
C. DLP Alerts
D. IDS/IPS Alerts
B. SIEM Alerts
What type of logging can be used for accountability?
A. Vulnerability Logs
B. Operating system logs
C. Access Logs
D. NetFlow Logs
C. Access Logs
What type of logging can identify the source of most noise on a network?
A. Vulnerability logs
B. Operating system logs
C. Access Logs
D. NetFlow Logs
D. NetFlow Logs
How will you know if my critical files have been tampered with?
A. FIM Alerts
B. SIEM Alerts
C. DLP Alerts
D. IDS/IPS Alerts
A. FIM Alerts
George has tried to email his company credit card details to his Gmail account. The security team has contacted him and reminded him this is not acceptable use. How were they informed?
A. FIM alerts
B. SIEM Alerts
C. DLP alerts
D. IDS/IPS alerts
C. DLP alerts
An attacker has had their session reset after they successfully logged onto the Private Branch Exchange (PDX) after three unsuccessful attempts using SSH. What is the reason for this?
A. FIM Alerts
B. Firewall
C. DLP Rules
D. IPS rules
D. IPS rules
A company needs to block the exfiltration of United States medical related data due to a new regulatory requirement. What is most likely going to get uploaded?
A. ACL Rules
B. Signature Rules
C. Behavior Rules
D. DLP rules
D. DLP rules
Bill is the network technician and has been tasked with updating security based upon a threat exchange update. Five known bad actor IP addresses must be blocked. What should be updated?
A. Firewall rules
B. Signature rules
C. Behavior rules
D. DLP Rules
A. Firewall rules
What is used to search for character strings in my DLP solution?
A. Signature rules
B. Behavior rules
C. Firewall rules
D. Regular expressions
D. Regular expressions
What type of rule will alert administrators that Colin is deleting significant amounts of sensitive company data?
A. Signature rules
B. Behavior rules
C. Firewall rules
D. Regular expressions
B. Behavior rules
What will alert the SOC team to IOCs detect in logs of multiple network appliances?
A. SIEM Alerts
B. Behavior alerts
C. DLP alerts
D. Syslog
A. SIEM Alerts
What type of rule will alert administrators about a known malware variant that has the following checksum?
sha1 checksum 1984859468543578674535
A. ACL Rules
B. Signature rules
C. Behavior rules
D. DLP Rules
B. Signature rules
Charles notices several endpoints have been infected by a recently discovered malware variant. What has allowed Charles to receive this information?
A. SIEM Alerts
B. Antivirus alerts
C. DLP Alerts
D. Syslog
B. Antivirus alerts
