Conducting Threat Hunting and Defending (CBTD)
Read questions, check verified answers and discuss the reasoning. Use reading options to shape your revision, or switch to the simulator for timed practice.
30 questions in this view
An increase in successful domain controller sign-ins for a company has been observed by the security team. The usage of the Mimikatz tool is suspected. After filtering the possibly affected accounts, a focus is placed on pass-the-hash attempts, and logs from the domain controllers are collected for further analysis. Which two behaviors must be searched for? (Choose two.)
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
What should be considered when using machine learning for data analysis in a SOC?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
According to the MITRE ATT&CK framework, how is the password spraying technique classified?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
A company recently suffered multiple breaches from different threat actors using the same approach. A security team now attempts to refine the detection strategies to focus on the approaches used by APT actors. The team investigates a tactic that offers insight into adversary strategic approach. Which tactic provides insight into the adversaries' strategic approach and should be prioritized by the security team?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
A security engineer notices a user locked out of an email account after multiple failed sign-ins. Upon further investigation, it appears other users experienced the same issue. The lockout was caused by using incorrect credentials during authentication. What is the indicator of the attack?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.
A security analyst receives an alert that host A, which has an IP address of 192.168.5.39, has a new browser extension installed. During an investigation of the SIEM tool logs, the analyst discovers that host A made continuous TCP connections to an IP address of 1.25.241.8 via TCP port 80. The 1.25.241.8 IP address is categorized as a C2 server. Which action should the analyst take to mitigate similar connections in the future?
Select an answer above, then submit your vote. Reading or practicing does not cast a vote.