CSX Identify and Assess Cybersecurity Threats 3 — Questions and Answers
Question 1: Which open-source framework provides a structured knowledge base of adversary tactics and techniques based on real-world observations?
- OWASP Top 10
- MITRE ATT&CK (Correct answer)
- CVE Database
- NIST SP 800-53
Correct answer: MITRE ATT&CK
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques derived from real-world attack observations, used for threat modeling and detection.
Question 2: A zero-day vulnerability is particularly dangerous primarily because:
- It only affects outdated operating systems
- No patch or mitigation exists at the time of its exploitation (Correct answer)
- It requires physical access to exploit
- Antivirus software can always detect it
Correct answer: No patch or mitigation exists at the time of its exploitation
Zero-day vulnerabilities are dangerous because they are unknown to the vendor, meaning no patch exists and defenders have no advance warning to prepare.
Question 3: When performing a threat assessment, an analyst categorizes threats by their potential impact and likelihood. This process is best described as:
- Vulnerability scanning
- Risk prioritization (Correct answer)
- Penetration testing
- Security auditing
Correct answer: Risk prioritization
Risk prioritization involves ranking threats based on the combination of their likelihood of occurrence and the potential impact they would have if realized.
Question 4: Which threat actor type is typically motivated by financial gain and tends to use ransomware or banking trojans?
- Hacktivist
- Nation-state actor
- Cybercriminal (Correct answer)
- Insider threat
Correct answer: Cybercriminal
Cybercriminals are primarily motivated by financial gain and commonly deploy ransomware, banking malware, and fraud schemes to generate profit.
Question 5: What does IoC stand for in cybersecurity threat identification?
- Index of Compromise
- Indicator of Compromise (Correct answer)
- Instance of Cyberattack
- Integrity of Controls
Correct answer: Indicator of Compromise
Indicators of Compromise (IoCs) are forensic artifacts such as malicious IPs, file hashes, or registry keys that suggest a system has been breached.
Question 6: An organization identifies that a former employee still has active VPN credentials. In threat assessment terms, this represents:
- A threat agent with no access vector
- A vulnerability that increases the likelihood of an insider threat being realized (Correct answer)
- An acceptable residual risk
- A deterrent control weakness
Correct answer: A vulnerability that increases the likelihood of an insider threat being realized
Active credentials for a former employee create a vulnerability — an exploitable weakness — that could be used by a malicious insider or someone who obtains those credentials.
Question 7: Which technique do attackers use to map an organization's external attack surface before launching an attack?
- Lateral movement
- Reconnaissance (Correct answer)
- Privilege escalation
- Data exfiltration
Correct answer: Reconnaissance
Reconnaissance is the initial phase where attackers gather information about targets using passive (OSINT) or active techniques to identify vulnerabilities and entry points.
CSX Identify and Assess Cybersecurity Threats 3
Which open-source framework provides a structured knowledge base of adversary tactics and techniques based on real-world observations?