Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CASP+ Prepare for ISSAP > Chapter 5 Threat and Vulnerability Management Mark B > Flashcards

Chapter 5 Threat and Vulnerability Management Mark B Flashcards

1
Q

Which of the following intelligence types focuses on the threat actor and the reason for the attack?

A. Tactical
B. Strategic
C. Targeted
D. Operational

A

A. Tactical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is used as a common vector to launch a broad range of attacks?

A. Tactical
B. Strategic
C. Commodity Malware
D. Targeted attacks

A

C. Commodity Malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What type of attack would use spear phishing against engineers in the Ukraine electricity supply industry with the goal of gaining user credentials?

A. Deep web
B. Proprietary
C. Commodity Malware
D. Targeted attacks

A

D. Targeted attacks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which of the following intelligence types focuses on the technical and automated discovery of everyday threats, threat actors and the reason for the attack?

A. Tactical
B. Strategic
C. Commodity malware
D. Operational threat intelligence

A

A. Tactical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which of the following intelligence types uses forensics and historical logs to identify threats?

A. Tactical
B. Strategic
C. Commodity malware
D. Operational threat intelligence

A

D. Operational threat intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What framework could a forensic team use to document a specific adversary, victim, capabilities and infrastructure?

A. Threat emulation
B. Threat hunting
C. Diamond model
D. STIX

A

C. Diamond model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the most likely threat actor if your router firmware has been tampered with over a period of two years, without being detected?

A. Advanced persistent threat
B. Insider threat
C. Hacktivist
D. Script kiddie

A

A. Advanced persistent threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the most likely threat actor if your electrical power delivery capabilities are attacked?

A. Nation State
B. Insider threat
C. Hacktivist
D. Script Kiddie

A

A. Nation State

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What threat actor will most likely steal your intellectual property?

A. Advanced persistent threat
B. Competitor
C. Hacktivist
D. Script kiddie

A

B. Competitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the threat when vulnerabilities are present on your network due to misconfiguration by poorly trained technicians?

A. Advanced persistent threat
B. Insider threat
C. Script kiddie
D. Organized Crime

A

B. Insider threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the threat when vulnerabilities are present due to the use of third party libraries in our code base?

A. Advanced persistent threat
B. Supply Chain
C. Insider Threat
D. Organized Crime

A

B. Supply Chain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the likely threat actor when thousands of systems are targeted with crypto malware followed up with a demand for $5,000 in bitcoin?

A. Advanced persistent threat
B. Supply chain
C. Insider threat
D. Organized Crime

A

D. Organized Crime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the public network that hosts unindexed and unsearchable content that may be useful for unlawful activities?

A. World Wide Web
B. Intranet
C. Deep web
D. Proprietary networks

A

C. Deep web

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What type of intelligence gathering would involve DNS record harrvesting?

A. Intelligence feeds
B. Deep Web
C. Open Source Intelligence
D. Human intelligence

A

C. Open Source Intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What type of intelligence gathering would involve physical reconnaissance?

A. Intelligence feeds
B. Deep Web
C. Open Source Intelligence (OSINT)
D. Human intelligence (HUMINT)

A

D. Human intelligence (HUMINT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What framework would be the best choice to build up a picture of threat actors and their tactics and techniques for a water treatment plan?

A. MITRE ATT&CK
B. ATT&CK for industrial analysis
C. Diamond model of intrusion analysis
D. Cyber kill chain

A

B. ATT&CK for industrial analysis

17
Q

What framework would be used to understand the capabilities of APT29 and how they will target your enterprise information systems?

A. MITRE (ATT&CK)
B. ATT&CK for industrial control system (ICS)
C. Scripts/regular expressions
D. SRTM

A

A. MITRE (ATT&CK)

18
Q

What framework uses seven stages, starting with reconnaissance and ending in actions on objectives?

A. MITRE (ATT&CK)
B. ATT&CK for industrial control system (ICS)
C. Diamond model of intrusion analysis
D. Cyber kill chain

A

D. Cyber kill chain

19
Q

What file type allow for the analysis of network traffic captured by Wireshark or tcpdump?

A. Packet capture (PCAP)
B. Vulnerability logs
C. Operating system logs
D. Portable Data Format (PDF)

A

A. Packet capture (PCAP)

20
Q

What can be used to centrally correlate events form multiple sources and raise alerts?

A. FIM Alerts
B. SIEM Alerts
C. DLP Alerts
D. IDS/IPS Alerts

A

B. SIEM Alerts

21
Q

What type of logging can be used for accountability?

A. Vulnerability Logs
B. Operating system logs
C. Access Logs
D. NetFlow Logs

A

C. Access Logs

22
Q

What type of logging can identify the source of most noise on a network?

A. Vulnerability logs
B. Operating system logs
C. Access Logs
D. NetFlow Logs

A

D. NetFlow Logs

23
Q

How will you know if my critical files have been tampered with?

A. FIM Alerts
B. SIEM Alerts
C. DLP Alerts
D. IDS/IPS Alerts

A

A. FIM Alerts

24
Q

George has tried to email his company credit card details to his Gmail account. The security team has contacted him and reminded him this is not acceptable use. How were they informed?

A. FIM alerts
B. SIEM Alerts
C. DLP alerts
D. IDS/IPS alerts

A

C. DLP alerts

25
Q

An attacker has had their session reset after they successfully logged onto the Private Branch Exchange (PDX) after three unsuccessful attempts using SSH. What is the reason for this?

A. FIM Alerts
B. Firewall
C. DLP Rules
D. IPS rules

A

D. IPS rules

26
Q

A company needs to block the exfiltration of United States medical related data due to a new regulatory requirement. What is most likely going to get uploaded?

A. ACL Rules
B. Signature Rules
C. Behavior Rules
D. DLP rules

A

D. DLP rules

27
Q

Bill is the network technician and has been tasked with updating security based upon a threat exchange update. Five known bad actor IP addresses must be blocked. What should be updated?

A. Firewall rules
B. Signature rules
C. Behavior rules
D. DLP Rules

A

A. Firewall rules

28
Q

What is used to search for character strings in my DLP solution?

A. Signature rules
B. Behavior rules
C. Firewall rules
D. Regular expressions

A

D. Regular expressions

29
Q

What type of rule will alert administrators that Colin is deleting significant amounts of sensitive company data?

A. Signature rules
B. Behavior rules
C. Firewall rules
D. Regular expressions

A

B. Behavior rules

30
Q

What will alert the SOC team to IOCs detect in logs of multiple network appliances?

A. SIEM Alerts
B. Behavior alerts
C. DLP alerts
D. Syslog

A

A. SIEM Alerts

31
Q

What type of rule will alert administrators about a known malware variant that has the following checksum?
sha1 checksum 1984859468543578674535

A. ACL Rules
B. Signature rules
C. Behavior rules
D. DLP Rules

A

B. Signature rules

32
Q

Charles notices several endpoints have been infected by a recently discovered malware variant. What has allowed Charles to receive this information?

A. SIEM Alerts
B. Antivirus alerts
C. DLP Alerts
D. Syslog

A

B. Antivirus alerts

CASP+ Prepare for ISSAP (23 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions