CSX Identify and Assess Cybersecurity Threats 2 — Questions and Answers
Question 1: An organization notices that an attacker has been slowly exfiltrating small amounts of data over several months to avoid detection. Which threat category best describes this behavior?
- Denial of Service
- Advanced Persistent Threat (APT) (Correct answer)
- Script kiddie attack
- Opportunistic ransomware
Correct answer: Advanced Persistent Threat (APT)
APTs are characterized by prolonged, stealthy intrusions where attackers maintain access over extended periods to quietly steal data.
Question 2: Which NIST framework function is most directly associated with identifying cybersecurity threats before they cause harm?
- Respond
- Recover
- Identify (Correct answer)
- Protect
Correct answer: Identify
The NIST 'Identify' function focuses on developing organizational understanding to manage cybersecurity risk, including asset management and risk assessment.
Question 3: A threat intelligence feed reports that a new malware strain uses fileless techniques. What does 'fileless' mean in this context?
- The malware deletes all files on the system
- The malware operates entirely in memory without writing to disk (Correct answer)
- The malware hides inside image files
- The malware is undetectable by antivirus
Correct answer: The malware operates entirely in memory without writing to disk
Fileless malware executes in RAM using legitimate system tools like PowerShell, leaving no traditional file artifacts on disk.
Question 4: When assessing threat likelihood, which factor most directly influences the probability that a specific threat actor will successfully exploit a vulnerability?
- The age of the vulnerability
- The threat actor's capability and motivation relative to existing controls (Correct answer)
- The number of users on the affected system
- The cost of remediation
Correct answer: The threat actor's capability and motivation relative to existing controls
Likelihood is determined by evaluating whether a threat source has the capability and intent to exploit a vulnerability given the current controls in place.
Question 5: Which of the following is an example of a supply chain threat?
- An employee clicking a phishing link
- Malicious code inserted into a software vendor's update package (Correct answer)
- A misconfigured firewall rule
- A brute-force attack on an RDP port
Correct answer: Malicious code inserted into a software vendor's update package
Supply chain threats occur when attackers compromise a trusted third-party vendor or software to gain access to downstream targets, as seen in the SolarWinds attack.
Question 6: A security analyst reviews logs and finds repeated failed login attempts from a single IP followed by one successful login. This pattern most likely indicates what type of threat?
- SQL injection
- Credential stuffing or brute-force attack (Correct answer)
- Man-in-the-middle attack
- DNS poisoning
Correct answer: Credential stuffing or brute-force attack
Repeated failed logins followed by a success is the hallmark pattern of brute-force or credential stuffing attacks targeting authentication systems.
Question 7: In threat modeling, what is the purpose of decomposing an application?
- To uninstall unnecessary software components
- To understand the application's structure, data flows, and entry points for identifying threats (Correct answer)
- To measure application performance under load
- To generate software documentation for compliance
Correct answer: To understand the application's structure, data flows, and entry points for identifying threats
Application decomposition in threat modeling breaks down the system into components, data flows, and trust boundaries to systematically identify where threats could arise.
CSX Identify and Assess Cybersecurity Threats 2
An organization notices that an attacker has been slowly exfiltrating small amounts of data over several months to avoid detection.
Which threat category best describes this behavior?