Sample Questions and Answers
Advanced Persistent Threats (APT)
What is a key characteristic of an Advanced Persistent Threat (APT)?
a) Long-term stealthy access to a network
b) Random, one-time cyber attacks
c) Unskilled hacker activity
d) Automated malware scanning
Answer: a) Long-term stealthy access to a network
Explanation: APTs are sophisticated, stealthy attacks aimed at long-term data exfiltration.
Which method is commonly used to detect APTs?
a) Behavioral analysis of network traffic
b) Simple antivirus scans
c) Public Wi-Fi monitoring
d) Password guessing
Answer: a) Behavioral analysis of network traffic
Explanation: APTs evade traditional detection, making behavioral analysis crucial.
Which stage in an APT attack involves establishing persistence?
a) Command and Control (C2) setup
b) Initial reconnaissance
c) Immediate data exfiltration
d) Public disclosure
Answer: a) Command and Control (C2) setup
Explanation: Attackers set up C2 to maintain long-term access and control over compromised systems.
Forensic Analysis
Which of the following is NOT a step in digital forensic analysis?
a) Evidence tampering
b) Data acquisition
c) Examination
d) Reporting
Answer: a) Evidence tampering
Explanation: Forensics relies on preserving evidence integrity for investigation.
What is the purpose of a forensic disk image?
a) To create an exact, unaltered copy of the disk
b) To permanently delete data
c) To compress files for faster transfer
d) To store passwords securely
Answer: a) To create an exact, unaltered copy of the disk
Explanation: Disk images ensure forensic integrity for analysis.
Which tool is widely used for network forensics?
a) Wireshark
b) Microsoft Word
c) Adobe Photoshop
d) Google Chrome
Answer: a) Wireshark
Explanation: Wireshark captures and analyzes network packets for forensic investigations.
Network Anomaly Detection
What is the main function of anomaly-based intrusion detection?
a) Detecting deviations from normal traffic patterns
b) Blocking all incoming connections
c) Performing scheduled antivirus scans
d) Enhancing internet speed
Answer: a) Detecting deviations from normal traffic patterns
Explanation: Anomaly-based IDS identifies unusual behavior that may indicate attacks.
Which protocol behavior is commonly monitored for anomalies?
a) Sudden spikes in DNS requests
b) Frequent social media logins
c) Large email attachments
d) Slow loading of webpages
Answer: a) Sudden spikes in DNS requests
Explanation: Unusual DNS activity often signals botnet or malware activity.
Which tool is commonly used for network anomaly detection?
a) Zeek (formerly Bro)
b) Microsoft Paint
c) Adobe Acrobat
d) VLC Media Player
Answer: a) Zeek (formerly Bro)
Explanation: Zeek is a powerful network analysis framework used for anomaly detection.
Ransomware Defense
What is a primary method to defend against ransomware?
a) Regular data backups
b) Ignoring software updates
c) Disabling firewalls
d) Clicking suspicious email links
Answer: a) Regular data backups
Explanation: Backups ensure data recovery without paying ransom.
Which tactic do ransomware attackers commonly use?
a) Phishing emails with malicious attachments
b) Posting fake social media updates
c) Redirecting users to official websites
d) Offering free antivirus software
Answer: a) Phishing emails with malicious attachments
Explanation: Ransomware is often delivered through deceptive phishing emails.
What is the best response to a ransomware attack?
a) Isolate affected systems and restore from backups
b) Pay the ransom immediately
c) Contact the attacker for negotiations
d) Ignore the attack and continue operations
Answer: a) Isolate affected systems and restore from backups
Explanation: Isolating affected devices prevents ransomware spread and enables recovery.
Threat Hunting
What is the goal of threat hunting?
a) Proactively identifying hidden security threats
b) Waiting for security alerts to appear
c) Removing legitimate users from the network
d) Randomly blocking IP addresses
Answer: a) Proactively identifying hidden security threats
Explanation: Threat hunting involves actively searching for threats before they cause damage.
Which tool helps security teams perform threat hunting?
a) MITRE ATT&CK framework
b) Microsoft Excel
c) Google Docs
d) Amazon Alexa
Answer: a) MITRE ATT&CK framework
Explanation: MITRE ATT&CK provides a knowledge base for tracking adversary techniques.
What is an indicator of compromise (IOC)?
a) Evidence of malicious activity on a network
b) A method for legal contract negotiation
c) A standard software license agreement
d) A performance benchmark
Answer: a) Evidence of malicious activity on a network
Explanation: IOCs help identify security breaches and guide incident response.
Network Hardening Strategies
Which practice helps harden network security?
a) Disabling unnecessary services
b) Using default passwords
c) Allowing unrestricted remote access
d) Sharing credentials across devices
Answer: a) Disabling unnecessary services
Explanation: Unused services can introduce security vulnerabilities and should be disabled.
Which authentication method enhances network security?
a) Multi-Factor Authentication (MFA)
b) Simple password-only authentication
c) Hardcoded credentials
d) Publicly sharing admin passwords
Answer: a) Multi-Factor Authentication (MFA)
Explanation: MFA requires multiple forms of authentication, increasing security.
Which firewall configuration is most secure?
a) Default deny, explicit allow
b) Default allow, explicit deny
c) Open all ports by default
d) No firewall rules applied
Answer: a) Default deny, explicit allow
Explanation: This configuration blocks all traffic except for explicitly permitted connections.
Reviews
There are no reviews yet.