CSX Surveillance & Intelligence Gathering 2

Question 1

Which passive reconnaissance technique involves capturing and analyzing network packets without sending any traffic to the target?

Accepted Answer

Packet sniffing

Answer

Packet sniffing captures traffic flowing across a network segment without transmitting any probes, making it a purely passive reconnaissance technique.

Question 2

An analyst uses Shodan to identify internet-facing industrial control systems belonging to a target organization. This activity is best described as:

Accepted Answer

OSINT gathering

Answer

Shodan queries publicly indexed data about internet-connected devices, making its use an open-source intelligence (OSINT) gathering technique that requires no direct interaction with the target.

Question 3

What is the primary purpose of a 'canary token' in a threat intelligence program?

Accepted Answer

Detect unauthorized access by triggering alerts when accessed

Answer

Canary tokens are decoy resources (URLs, documents, credentials) that silently alert defenders when accessed, revealing that an attacker has reached a monitored asset.

Question 4

Which framework specifically categorizes adversary behaviors observed during post-compromise activity, including collection and exfiltration?

Accepted Answer

MITRE ATT&CK

Answer

MITRE ATT&CK documents real-world adversary tactics, techniques, and procedures (TTPs) across the full attack lifecycle, including collection and exfiltration stages.

Question 5

A threat actor registers domain names that are typographical variations of a target company's domain. This technique is called:

Accepted Answer

Typosquatting

Answer

Typosquatting registers misspelled or visually similar domain names to intercept traffic from users who mistype the legitimate domain.

(CSX) Cybersecurity Nexus Certification Practice Test

(CSX) Cybersecurity Nexus Certification Practice Test

CSX Surveillance & Intelligence Gathering 2