CSS Threat Detection & Prevention 2 — Questions and Answers
Question 1: Which behavioral indicator is MOST characteristic of a slow-and-low attack designed to evade detection thresholds?
- High-volume traffic bursts over short periods
- Distributed low-frequency requests spread over days or weeks (Correct answer)
- Immediate exploitation after initial access
- Use of known malware signatures
Correct answer: Distributed low-frequency requests spread over days or weeks
Slow-and-low attacks deliberately spread malicious activity over extended time periods to stay below detection thresholds and avoid triggering alerts.
Question 2: A security analyst notices DNS queries to randomly generated domain names at regular intervals from a workstation. This pattern MOST likely indicates:
- A misconfigured DNS resolver
- Domain Generation Algorithm (DGA) malware communicating with a C2 server (Correct answer)
- Normal Windows Update activity
- A browser cache flushing routine
Correct answer: Domain Generation Algorithm (DGA) malware communicating with a C2 server
DGA malware generates pseudo-random domain names to locate C2 servers, making it harder to block by blacklisting static domains.
Question 3: Which prevention control BEST addresses the risk of credential stuffing attacks against web applications?
- Blocking all international IP addresses
- Implementing rate limiting combined with CAPTCHA and breached-password detection (Correct answer)
- Requiring users to change passwords every 30 days
- Disabling account lockout to prevent denial of service
Correct answer: Implementing rate limiting combined with CAPTCHA and breached-password detection
Combining rate limiting, CAPTCHA, and checking credentials against known breach databases directly counters automated credential stuffing.
Question 4: What does the 'dwell time' metric measure in the context of threat detection?
- Time taken to patch a vulnerability after disclosure
- Duration between initial compromise and detection of an attacker (Correct answer)
- How long a firewall rule has been active
- Time between alert generation and analyst acknowledgment
Correct answer: Duration between initial compromise and detection of an attacker
Dwell time measures how long an attacker remains undetected in an environment after initial compromise, a key indicator of detection effectiveness.
Question 5: An IDS generates an alert for a known exploit signature, but investigation reveals no actual attack occurred. This is classified as a:
- True positive
- False negative
- False positive (Correct answer)
- True negative
Correct answer: False positive
A false positive occurs when a detection system triggers an alert for benign activity that matches a malicious pattern, wasting analyst time.
Question 6: Which technique does a next-generation firewall (NGFW) use that a traditional stateful firewall does NOT?
- Packet header inspection
- TCP three-way handshake tracking
- Application-layer deep packet inspection and user identity awareness (Correct answer)
- IP address-based access control lists
Correct answer: Application-layer deep packet inspection and user identity awareness
NGFWs add application-layer (Layer 7) inspection and can enforce policies based on application type and user identity, beyond what stateful firewalls provide.
Question 7: When deploying honeypots for threat detection, what is the PRIMARY security concern to address?
- Honeypots increase network latency for legitimate users
- Attackers could pivot from the honeypot to compromise production systems (Correct answer)
- Honeypots require expensive hardware investments
- Legal liability from monitoring attacker activity
Correct answer: Attackers could pivot from the honeypot to compromise production systems
Poorly isolated honeypots can be used as launch pads by attackers to reach production systems, so strict network segmentation is essential.
CSS Threat Detection & Prevention 2
Which behavioral indicator is MOST characteristic of a slow-and-low attack designed to evade detection thresholds?