CSS Threat Detection & Prevention 2

Question 1

Which behavioral indicator is MOST characteristic of a slow-and-low attack designed to evade detection thresholds?

Accepted Answer

Distributed low-frequency requests spread over days or weeks

Answer

Slow-and-low attacks deliberately spread malicious activity over extended time periods to stay below detection thresholds and avoid triggering alerts.

Question 2

A security analyst notices DNS queries to randomly generated domain names at regular intervals from a workstation. This pattern MOST likely indicates:

Accepted Answer

Domain Generation Algorithm (DGA) malware communicating with a C2 server

Answer

DGA malware generates pseudo-random domain names to locate C2 servers, making it harder to block by blacklisting static domains.

Question 3

Which prevention control BEST addresses the risk of credential stuffing attacks against web applications?

Accepted Answer

Implementing rate limiting combined with CAPTCHA and breached-password detection

Answer

Combining rate limiting, CAPTCHA, and checking credentials against known breach databases directly counters automated credential stuffing.

Question 4

What does the 'dwell time' metric measure in the context of threat detection?

Accepted Answer

Duration between initial compromise and detection of an attacker

Answer

Dwell time measures how long an attacker remains undetected in an environment after initial compromise, a key indicator of detection effectiveness.

Question 5

An IDS generates an alert for a known exploit signature, but investigation reveals no actual attack occurred. This is classified as a:

Accepted Answer

False positive

Answer

A false positive occurs when a detection system triggers an alert for benign activity that matches a malicious pattern, wasting analyst time.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Threat Detection & Prevention 2