Sample Questions and Answers
What is the purpose of “data normalization” in threat intelligence?
To convert different data formats into a common standard for analysis
B. To delete duplicate data
C. To encrypt data
D. To compress files
Answer: A. To convert different data formats into a common standard for analysis
Explanation: Normalization makes threat data easier to analyze and share.
Which of the following best describes “encryption at rest”?
Data encryption while stored on disks or databases
B. Encryption during data transmission
C. Password protection on files
D. Firewall configuration
Answer: A. Data encryption while stored on disks or databases
Explanation: Encryption at rest protects data from unauthorized access if storage is compromised.
What is the role of the Diamond Model in threat intelligence?
To provide a framework for analyzing cyber intrusion events by mapping adversary, capability, infrastructure, and victim
B. To encrypt sensitive data
C. To monitor network traffic
D. To block phishing emails
Answer: A. To provide a framework for analyzing cyber intrusion events by mapping adversary, capability, infrastructure, and victim
Explanation: The Diamond Model helps analysts understand attack characteristics and relationships.
What does “pivoting” refer to in threat intelligence?
Using compromised systems to move deeper into a network
B. Changing encryption keys
C. Blocking IP addresses
D. Updating antivirus software
Answer: A. Using compromised systems to move deeper into a network
Explanation: Pivoting allows attackers to explore internal networks from an initial foothold.
What is a “honeypot” in cybersecurity?
A decoy system designed to lure attackers and gather intelligence about their methods
B. A firewall configuration
C. A virus removal tool
D. An encryption protocol
Answer: A. A decoy system designed to lure attackers and gather intelligence about their methods
Explanation: Honeypots help in detecting and analyzing attacker behavior.
What is the difference between “open source intelligence (OSINT)” and “closed source intelligence”?
OSINT is publicly available data, while closed source intelligence comes from proprietary or confidential sources
B. OSINT requires payment, closed source is free
C. OSINT is always more accurate
D. Closed source is illegal to use
Answer: A. OSINT is publicly available data, while closed source intelligence comes from proprietary or confidential sources
Explanation: Both are valuable, but their sources differ.
What type of attack is characterized by flooding a network or system to disrupt services?
Denial of Service (DoS)
B. Phishing
C. SQL Injection
D. Man-in-the-Middle
Answer: A. Denial of Service (DoS)
Explanation: DoS attacks overwhelm resources to cause outages.
What is the significance of “threat actor attribution”?
Identifying the individual or group responsible for a cyberattack
B. Encrypting files
C. Blocking emails
D. Updating software
Answer: A. Identifying the individual or group responsible for a cyberattack
Explanation: Attribution helps tailor defenses and supports law enforcement.
Which phase of the cyber kill chain involves delivering malicious payloads?
Delivery
B. Reconnaissance
C. Exploitation
D. Command and Control
Answer: A. Delivery
Explanation: Delivery is the step where the attacker transmits malware to the target.
What is a “zero-day vulnerability”?
A previously unknown software flaw that attackers can exploit before a patch is available
B. An outdated antivirus signature
C. A user password that never expires
D. A firewall misconfiguration
Answer: A. A previously unknown software flaw that attackers can exploit before a patch is available
Explanation: Zero-day vulnerabilities pose significant risks due to lack of defenses.
What is “data exfiltration” in the context of cybersecurity?
Unauthorized transfer of data from a system to an external location
B. Encrypting data for protection
C. Blocking malicious IPs
D. Restoring backups
Answer: A. Unauthorized transfer of data from a system to an external location
Explanation: Data exfiltration is a common goal of attackers.
What is the primary function of a “firewall”?
To monitor and control incoming and outgoing network traffic based on security rules
B. To detect malware on endpoints
C. To encrypt email communications
D. To analyze logs
Answer: A. To monitor and control incoming and outgoing network traffic based on security rules
Explanation: Firewalls enforce network access policies.
What is “phishing bait” in social engineering?
Fake emails or messages crafted to lure victims into clicking malicious links or divulging information
B. Antivirus software
C. Firewall rules
D. Network packets
Answer: A. Fake emails or messages crafted to lure victims into clicking malicious links or divulging information
Explanation: Phishing bait tricks users into compromising security.
How does “threat intelligence sharing” benefit organizations?
It improves collective defense by enabling faster identification and response to threats
B. It increases software costs
C. It slows down incident response
D. It replaces firewalls
Answer: A. It improves collective defense by enabling faster identification and response to threats
Explanation: Sharing intelligence helps organizations stay ahead of attackers.
What is the primary goal of “vulnerability management”?
To identify, assess, and remediate security weaknesses before attackers exploit them
B. To encrypt sensitive data
C. To block phishing emails
D. To install antivirus software
Answer: A. To identify, assess, and remediate security weaknesses before attackers exploit them
Explanation: Vulnerability management reduces the attack surface.
What is “social engineering”?
Manipulating people into divulging confidential information or performing actions that compromise security
B. Encrypting data transmissions
C. Installing security patches
D. Blocking IP addresses
Answer: A. Manipulating people into divulging confidential information or performing actions that compromise security
Explanation: Social engineering exploits human psychology.
Which of the following best describes a “botnet”?
A network of compromised computers controlled by an attacker
B. A type of firewall
C. An encryption algorithm
D. A phishing technique
Answer: A. A network of compromised computers controlled by an attacker
Explanation: Botnets are used to launch coordinated attacks like DDoS.
What is “threat modeling”?
The process of identifying, enumerating, and prioritizing potential threats to a system
B. Encrypting files
C. Configuring firewalls
D. Scanning for malware
Answer: A. The process of identifying, enumerating, and prioritizing potential threats to a system
Explanation: Threat modeling helps design effective defenses.
What is an “APT” in cybersecurity?
Advanced Persistent Threat – a prolonged and targeted cyberattack aimed at stealing data or spying
B. Automated Patch Tool
C. Antivirus Protection Technique
D. Active Proxy Tunnel
Answer: A. Advanced Persistent Threat – a prolonged and targeted cyberattack aimed at stealing data or spying
Explanation: APTs are sophisticated threats targeting specific organizations.
What does “IOC” stand for in threat intelligence?
Indicator of Compromise
B. Internet of Computers
C. Internal Operation Center
D. Incident Oversight Committee
Answer: A. Indicator of Compromise
Explanation: IOCs are evidence that an intrusion has occurred.
What is the primary purpose of a “sandbox” in malware analysis?
To safely execute suspicious code in an isolated environment to observe behavior
B. To encrypt files
C. To block network traffic
D. To update antivirus
Answer: A. To safely execute suspicious code in an isolated environment to observe behavior
Explanation: Sandboxes allow safe analysis without risking systems.
What is “credential stuffing”?
Automated injection of stolen usernames and passwords into login forms to gain unauthorized access
B. A type of encryption
C. Firewall configuration
D. A vulnerability scan
Answer: A. Automated injection of stolen usernames and passwords into login forms to gain unauthorized access
Explanation: Credential stuffing exploits reused credentials.
What is the role of a “threat intelligence analyst”?
To collect, analyze, and disseminate actionable intelligence on cyber threats
B. To configure firewalls
C. To install software updates
D. To block spam emails
Answer: A. To collect, analyze, and disseminate actionable intelligence on cyber threats
Explanation: Analysts interpret data to inform defense strategies.
What does “APT group” typically refer to?
A well-funded, organized, and skilled threat actor group conducting sophisticated cyber attacks
B. An antivirus program
C. A firewall rule set
D. A type of phishing email
Answer: A. A well-funded, organized, and skilled threat actor group conducting sophisticated cyber attacks
Explanation: APT groups often have political or financial motives.
What is the significance of “MITRE ATT&CK” framework?
A globally accessible knowledge base of adversary tactics and techniques based on real-world observations
B. A firewall vendor
C. A malware detection tool
D. A type of encryption
Answer: A. A globally accessible knowledge base of adversary tactics and techniques based on real-world observations
Explanation: MITRE ATT&CK helps defenders understand and anticipate attacker behavior.
What is “threat hunting”?
Proactive and iterative search through networks and datasets to detect malicious activities that evade automated detection
B. Installing antivirus software
C. Blocking malicious websites
D. Running system backups
Answer: A. Proactive and iterative search through networks and datasets to detect malicious activities that evade automated detection
Explanation: Threat hunting aims to find hidden threats before they cause damage.
What is a “sandbox evasion technique”?
Methods used by malware to detect and avoid execution in sandbox environments to prevent analysis
B. Encrypting data transmissions
C. Blocking IP addresses
D. Updating firewall rules
Answer: A. Methods used by malware to detect and avoid execution in sandbox environments to prevent analysis
Explanation: Evasion techniques help malware avoid detection by security researchers.
Reviews
There are no reviews yet.