NSE Threat Analysis & Vulnerability Management 4 — Questions and Answers
Question 1: Which MITRE ATT&CK tactic covers an attacker's attempts to maintain access across system restarts?
- Initial Access
- Persistence (Correct answer)
- Defense Evasion
- Collection
Correct answer: Persistence
The Persistence tactic encompasses techniques adversaries use to maintain their foothold, such as modifying registry keys, scheduled tasks, or startup scripts.
Question 2: What is the role of a threat intelligence platform (TIP) in a SOC environment?
- Replacing firewall rules automatically based on threats
- Aggregating, normalizing, and sharing threat intelligence across tools and teams (Correct answer)
- Performing active exploitation of discovered vulnerabilities
- Acting as a standalone IDS sensor
Correct answer: Aggregating, normalizing, and sharing threat intelligence across tools and teams
A TIP centralizes threat intelligence from multiple sources, normalizes formats like STIX/TAXII, and enables sharing with SIEM, firewalls, and analysts.
Question 3: A CVSS v3 vector string shows AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. What base score category does this represent?
- Medium (4.0–6.9)
- High (7.0–8.9)
- Critical (9.0–10.0) (Correct answer)
- Low (0.1–3.9)
Correct answer: Critical (9.0–10.0)
Network-exploitable (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), with full CIA impact yields a CVSS base score of 9.8, which is Critical.
Question 4: In the context of vulnerability management, what is 'patch Tuesday'?
- A Fortinet-specific patch cycle for FortiOS updates
- Microsoft's scheduled monthly release of security patches on the second Tuesday (Correct answer)
- A CISA mandate requiring all patches within 24 hours
- A common name for emergency out-of-band patches
Correct answer: Microsoft's scheduled monthly release of security patches on the second Tuesday
Microsoft releases security patches on the second Tuesday of each month, a cycle known as Patch Tuesday, allowing organizations to plan testing and deployment.
Question 5: Which technique allows malware to hide its network communication by encoding traffic within legitimate protocols like DNS or HTTP?
- Port scanning
- Covert channel / protocol tunneling (Correct answer)
- ARP poisoning
- SQL injection
Correct answer: Covert channel / protocol tunneling
Covert channels and protocol tunneling embed malicious C2 communications within legitimate protocols like DNS queries or HTTP requests to evade detection.
Question 6: When analyzing a suspicious email attachment, an analyst submits it to a sandbox. The sandbox shows the sample sleeping for 5 minutes before executing. This behavior is an example of:
- Polymorphic code
- Sandbox evasion through timing delay (Correct answer)
- Buffer overflow exploitation
- Living-off-the-land technique
Correct answer: Sandbox evasion through timing delay
Malware uses timing delays to evade sandboxes, which often have short analysis windows and will report the sample as benign if no malicious behavior is observed quickly.
Question 7: What is the difference between a CVE and a CWE?
- CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses (Correct answer)
- CVE is for hardware flaws; CWE is for software flaws
- CVE scores are calculated by CVSS; CWE scores are calculated by CWSS only
- They are interchangeable terms for the same concept
Correct answer: CVE identifies specific vulnerability instances in products; CWE categorizes types of software weaknesses
CVE (Common Vulnerabilities and Exposures) identifies specific vulnerability instances in real products, while CWE (Common Weakness Enumeration) categorizes classes of software weaknesses like buffer overflows or injection flaws.
NSE Threat Analysis & Vulnerability Management 4
Which MITRE ATT&CK tactic covers an attacker's attempts to maintain access across system restarts?