CSS Threat Detection & Prevention 3 — Questions and Answers
Question 1: Which MITRE ATT&CK tactic describes an adversary's efforts to avoid detection after gaining initial access?
- Initial Access
- Defense Evasion (Correct answer)
- Lateral Movement
- Collection
Correct answer: Defense Evasion
Defense Evasion is the ATT&CK tactic covering techniques adversaries use to avoid detection and bypass security controls during an intrusion.
Question 2: A security team wants to detect attackers performing internal reconnaissance after a breach. Which control is MOST effective?
- Perimeter firewall rules blocking external scans
- Internal network traffic monitoring and east-west traffic analysis (Correct answer)
- Email filtering for phishing attachments
- Endpoint antivirus signature updates
Correct answer: Internal network traffic monitoring and east-west traffic analysis
Monitoring east-west (lateral) traffic within the network is critical for detecting internal reconnaissance since perimeter controls miss activity already inside.
Question 3: What is the purpose of a Security Orchestration, Automation, and Response (SOAR) platform in threat prevention?
- To replace human analysts entirely with AI decision-making
- To automate repetitive investigation tasks and coordinate responses across security tools (Correct answer)
- To store raw log data for long-term compliance retention
- To perform vulnerability scanning on endpoints
Correct answer: To automate repetitive investigation tasks and coordinate responses across security tools
SOAR platforms automate routine tasks like alert triage and tool coordination, freeing analysts to focus on complex investigations.
Question 4: Which indicator would MOST strongly suggest a watering hole attack is in progress?
- Employees receiving phishing emails with malicious attachments
- Multiple employees from the same organization infected after visiting a legitimate industry website (Correct answer)
- An attacker performing port scans against the organization's DMZ
- Brute force attempts against the VPN gateway
Correct answer: Multiple employees from the same organization infected after visiting a legitimate industry website
Watering hole attacks compromise websites frequently visited by a target group, so multiple victims from the same org infected via the same legitimate site is the telltale sign.
Question 5: In threat detection, what does 'threat hunting' differ from automated monitoring in that it:
- Uses only signature-based detection rules
- Is a passive process that waits for alerts to trigger
- Is a proactive, hypothesis-driven search for hidden threats that evaded automated controls (Correct answer)
- Relies exclusively on external threat intelligence feeds
Correct answer: Is a proactive, hypothesis-driven search for hidden threats that evaded automated controls
Threat hunting is an active, analyst-led process starting from hypotheses about potential attacker behavior, not waiting for automated alerts.
Question 6: A company deploys an allowlist (whitelist) application control policy. Which threat does this MOST effectively prevent?
- SQL injection against web applications
- Execution of unauthorized or malicious software on endpoints (Correct answer)
- Man-in-the-middle attacks on network traffic
- Insider data exfiltration via email
Correct answer: Execution of unauthorized or malicious software on endpoints
Application allowlisting prevents unauthorized software from executing by only permitting explicitly approved applications to run on endpoints.
Question 7: Which log source is MOST valuable for detecting pass-the-hash attacks in a Windows Active Directory environment?
- Web server access logs
- Windows Security Event logs (Event IDs 4624, 4625, 4648) (Correct answer)
- Network flow records from core routers
- DNS query logs from the recursive resolver
Correct answer: Windows Security Event logs (Event IDs 4624, 4625, 4648)
Windows Security Event logs capture authentication events including logon type 3 with NTLM, which is characteristic of pass-the-hash lateral movement.
CSS Threat Detection & Prevention 3
Which MITRE ATT&CK tactic describes an adversary's efforts to avoid detection after gaining initial access?