CSX Surveillance & Intelligence Gathering 2 — Questions and Answers
Question 1: Which passive reconnaissance technique involves capturing and analyzing network packets without sending any traffic to the target?
- DNS zone transfer
- Packet sniffing (Correct answer)
- Port scanning
- Banner grabbing
Correct answer: Packet sniffing
Packet sniffing captures traffic flowing across a network segment without transmitting any probes, making it a purely passive reconnaissance technique.
Question 2: An analyst uses Shodan to identify internet-facing industrial control systems belonging to a target organization. This activity is best described as:
- Active scanning
- OSINT gathering (Correct answer)
- Vulnerability exploitation
- Social engineering
Correct answer: OSINT gathering
Shodan queries publicly indexed data about internet-connected devices, making its use an open-source intelligence (OSINT) gathering technique that requires no direct interaction with the target.
Question 3: What is the primary purpose of a 'canary token' in a threat intelligence program?
- Encrypt sensitive files to prevent exfiltration
- Detect unauthorized access by triggering alerts when accessed (Correct answer)
- Scan endpoints for malware signatures
- Anonymize attacker traffic through proxies
Correct answer: Detect unauthorized access by triggering alerts when accessed
Canary tokens are decoy resources (URLs, documents, credentials) that silently alert defenders when accessed, revealing that an attacker has reached a monitored asset.
Question 4: Which framework specifically categorizes adversary behaviors observed during post-compromise activity, including collection and exfiltration?
- CVE
- MITRE ATT&CK (Correct answer)
- NIST CSF
- ISO 27001
Correct answer: MITRE ATT&CK
MITRE ATT&CK documents real-world adversary tactics, techniques, and procedures (TTPs) across the full attack lifecycle, including collection and exfiltration stages.
Question 5: A threat actor registers domain names that are typographical variations of a target company's domain. This technique is called:
- DNS poisoning
- Typosquatting (Correct answer)
- BGP hijacking
- Subdomain enumeration
Correct answer: Typosquatting
Typosquatting registers misspelled or visually similar domain names to intercept traffic from users who mistype the legitimate domain.
Question 6: During intelligence analysis, which structured analytic technique helps prevent analysts from anchoring on an initial hypothesis by systematically testing alternative explanations?
- Link analysis
- Analysis of Competing Hypotheses (ACH) (Correct answer)
- Kill chain mapping
- Indicator enrichment
Correct answer: Analysis of Competing Hypotheses (ACH)
ACH forces analysts to evaluate evidence against multiple competing hypotheses simultaneously, reducing cognitive bias toward the first plausible explanation.
Question 7: What distinguishes strategic intelligence from tactical intelligence in a cybersecurity context?
- Strategic intelligence covers individual IOCs while tactical covers threat actors
- Strategic intelligence informs long-term decisions while tactical supports immediate response actions (Correct answer)
- Strategic intelligence is classified while tactical is publicly available
- Strategic intelligence uses automated tools while tactical relies on human analysis
Correct answer: Strategic intelligence informs long-term decisions while tactical supports immediate response actions
Strategic intelligence provides high-level insight into threat landscapes and trends to guide policy and resource decisions, whereas tactical intelligence provides actionable details for immediate defensive or incident-response actions.
CSX Surveillance & Intelligence Gathering 2
Which passive reconnaissance technique involves capturing and analyzing network packets without sending any traffic to the target?