NSE Threat Analysis & Vulnerability Management 4

Question 1

Which MITRE ATT&CK tactic covers an attacker's attempts to maintain access across system restarts?

Accepted Answer

Persistence

Answer

The Persistence tactic encompasses techniques adversaries use to maintain their foothold, such as modifying registry keys, scheduled tasks, or startup scripts.

Question 2

What is the role of a threat intelligence platform (TIP) in a SOC environment?

Accepted Answer

Aggregating, normalizing, and sharing threat intelligence across tools and teams

Answer

A TIP centralizes threat intelligence from multiple sources, normalizes formats like STIX/TAXII, and enables sharing with SIEM, firewalls, and analysts.

Question 3

A CVSS v3 vector string shows AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. What base score category does this represent?

Accepted Answer

Critical (9.0–10.0)

Answer

Network-exploitable (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), with full CIA impact yields a CVSS base score of 9.8, which is Critical.

Question 4

In the context of vulnerability management, what is 'patch Tuesday'?

Accepted Answer

Microsoft's scheduled monthly release of security patches on the second Tuesday

Answer

Microsoft releases security patches on the second Tuesday of each month, a cycle known as Patch Tuesday, allowing organizations to plan testing and deployment.

Question 5

Which technique allows malware to hide its network communication by encoding traffic within legitimate protocols like DNS or HTTP?

Accepted Answer

Covert channel / protocol tunneling

Answer

Covert channels and protocol tunneling embed malicious C2 communications within legitimate protocols like DNS queries or HTTP requests to evade detection.

(NSE) Network Security Expert Practice Test

(NSE) Network Security Expert Practice Test

NSE Threat Analysis & Vulnerability Management 4