CSS Threat Detection & Prevention 3

Question 1

Which MITRE ATT&CK tactic describes an adversary's efforts to avoid detection after gaining initial access?

Accepted Answer

Defense Evasion

Answer

Defense Evasion is the ATT&CK tactic covering techniques adversaries use to avoid detection and bypass security controls during an intrusion.

Question 2

A security team wants to detect attackers performing internal reconnaissance after a breach. Which control is MOST effective?

Accepted Answer

Internal network traffic monitoring and east-west traffic analysis

Answer

Monitoring east-west (lateral) traffic within the network is critical for detecting internal reconnaissance since perimeter controls miss activity already inside.

Question 3

What is the purpose of a Security Orchestration, Automation, and Response (SOAR) platform in threat prevention?

Accepted Answer

To automate repetitive investigation tasks and coordinate responses across security tools

Answer

SOAR platforms automate routine tasks like alert triage and tool coordination, freeing analysts to focus on complex investigations.

Question 4

Which indicator would MOST strongly suggest a watering hole attack is in progress?

Accepted Answer

Multiple employees from the same organization infected after visiting a legitimate industry website

Answer

Watering hole attacks compromise websites frequently visited by a target group, so multiple victims from the same org infected via the same legitimate site is the telltale sign.

Question 5

In threat detection, what does 'threat hunting' differ from automated monitoring in that it:

Accepted Answer

Is a proactive, hypothesis-driven search for hidden threats that evaded automated controls

Answer

Threat hunting is an active, analyst-led process starting from hypotheses about potential attacker behavior, not waiting for automated alerts.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Threat Detection & Prevention 3