CASP+ Chapter 3 - Review

What term describes the search for an insider threat or shadow IT, which, until discovered, had been "flying under the radar"?

• Threat hunting

• Threat emulation

• Intelligence

• Targeted attacks

LoJax, Bad Rabbit, and NotPetya are three examples of what?

• Zero-day threats

• Malware

• APTs

• Competitors

You discover log entries that raise suspicion that a security incident might have occurred. You decide more investigation is needed. What describes what you found?

• Vulnerabilities

• ACLs

• Threat Intelligence types

• Indicator of compromise

What is a key strength the disgruntled employee has over an outsider?

• Trust

• time

• Money

• Signature

Your manager asks if you've noticed any abnormal volumes of network traffic or other network issues. What logs might help you answer those concerns?

• FIM logs

• NetFlow logs

• Firewall logs

• Access logs

Which of the following alerts warns the security analyst or administrator of the likelihood that data was exfiltrated out of the network?

• IoC

• FIM

• DLP

• ICE

What intrusion detection processing technique is common for identifying a positive match but struggles to keep up with today's traffic speeds and volumes?

• SIEM

• Regular expressions

• Signature-based

• Anomaly or behavior

Which of the following can block traffic based on the source and destination address?

• The Deep Web

• Script Kiddie

• ICS

• ACL

In the following example of an access control list, which of the following answers is true?

hostname R1

!

Interface ethernet0

Ip access-group102 in

!

access-list 102 deny tcp any any eq 23

access list 102 permit ip any any

• TCP traffic bound for port 102 is permitted

• TCP traffic bound for port 23 is blocked

• TCP traffic bound for port 102 is blocked

• TCP traffic bound for port 23 is permitted

You got an alert that unusual changes were made to files in a customer directory. What type of alert was this?

• DLP

• IDS

• FIM

• IPS