CySA Week 2

Connor wants to combine several threat intelligence feeds because of the ridiculous amount of tools that are needed for analysis. What could he use to make this process more productive?

• Single Pane of Glass

• SSO

• SIEM

• Double Pane of Glass

What is the primary difference between SIEM and SOAR?

• SIEM creates defined investigation playbooks to follow based on alerts

• SOAR creates defined investigation playbooks to follow based on alerts

• They both do the same thing

• SOAR can fly

After analyzing CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Which attribute correctly identifies this vulnerability?

• It needs User Interaction

• It does not affect Confidentiality

• It is Network based

• It is very Complex

A SOC Analyst has to look at logs on multiple servers on a daily basis. What will give him the best centralized visibility into the events occurring in the company environment without him having to log on to the servers individually

• Have the servers forward the logs to SIEM

• Forward events to his phone

• Create event subscriptions

• Just watch YouTube instead

What tool is used as a way of enforcing a security policy between cloud customers and cloud services?

• DLP

• SIEM

• SOAR

• CASB

Terry downloads software that contains malware onto his computer that infects other Mycc computers. What has he become?

• Hacktivist

• Insider Threat

• APT

• Nation state

Adrian is looking at events on multiple systems but is having difficulty correlating data points. What is the cause of the issue?

• Lack of sleep

• Permissions

• Time synchronization

• Needs to read the user manual

What do you need to do first thing if one of the web servers in your network is affected by ransomware?

• Update OS

• Shut it down

• Quarantine it

• Cry

What would work to prevent the exposure of PII outside of your company?

• DLP

• IPS

• IDS

• HIDS

A security team is investigating an advanced persistent threat (APT) that has been targeting their organization for months. The attackers have shown a high level of sophistication, using custom malware and avoiding detection. Which type of threat actor is most likely responsible for this type of attack?

• Script kiddie

• Nation-state

• Insider threat

• Hacktivist