NSE Threat Analysis & Vulnerability Management 5 — Questions and Answers
Question 1: Which FortiGate feature uses machine learning to detect anomalous network behavior and potential threats?
- FortiGuard Web Filtering
- FortiAI / AI-based inspection (Correct answer)
- Application Control
- DNS filtering
Correct answer: FortiAI / AI-based inspection
FortiAI leverages machine learning models within the FortiGate to analyze traffic patterns and detect anomalies indicative of threats beyond signature-based detection.
Question 2: An organization discovers a critical vulnerability in a system that cannot be patched immediately. Which compensating control is most appropriate?
- Disable all logging to reduce overhead
- Implement virtual patching via IPS rules to block exploitation attempts (Correct answer)
- Remove the system from asset inventory
- Increase CVSS score in internal documentation
Correct answer: Implement virtual patching via IPS rules to block exploitation attempts
Virtual patching uses IPS signatures to detect and block exploitation attempts against a known vulnerability, providing protection until a formal patch can be applied.
Question 3: What is the primary goal of threat intelligence sharing communities such as ISACs?
- Selling vulnerability data to government agencies
- Enabling sector-specific organizations to share threat data to improve collective defenses (Correct answer)
- Replacing national CERTs in incident response
- Providing penetration testing services to members
Correct answer: Enabling sector-specific organizations to share threat data to improve collective defenses
Information Sharing and Analysis Centers (ISACs) allow organizations within the same industry sector to share threat intelligence, enabling faster collective response to emerging threats.
Question 4: Which type of analysis examines malware by executing it in a controlled environment to observe behavior?
- Static analysis
- Dynamic analysis (Correct answer)
- Code review
- Signature matching
Correct answer: Dynamic analysis
Dynamic analysis executes malware in an isolated sandbox environment and observes its runtime behavior, including file system changes, network connections, and registry modifications.
Question 5: In the PASTA threat modeling framework, what does PASTA stand for?
- Process for Attack Simulation and Threat Analysis (Correct answer)
- Protocol Analysis and Security Threat Assessment
- Proactive Application Security Testing Approach
- Platform Agnostic Security Testing Architecture
Correct answer: Process for Attack Simulation and Threat Analysis
PASTA (Process for Attack Simulation and Threat Analysis) is a risk-centric threat modeling methodology that aligns business objectives with technical security requirements through a seven-stage process.
Question 6: A security analyst notices beaconing traffic from an internal host to an external IP at perfectly regular 60-second intervals. This most likely indicates:
- Normal NTP synchronization
- A compromised host checking in with a C2 server (Correct answer)
- Routine SNMP polling
- Scheduled backup replication
Correct answer: A compromised host checking in with a C2 server
Regular, periodic outbound connections from an internal host to an external IP are a hallmark of C2 beaconing, where malware checks for instructions at predictable intervals.
Question 7: Which standard provides a structured language for describing cyber threat intelligence, commonly used with TAXII for automated sharing?
- OVAL
- STIX (Structured Threat Information eXpression) (Correct answer)
- SCAP
- OpenIOC
Correct answer: STIX (Structured Threat Information eXpression)
STIX is a standardized language for representing CTI objects such as threat actors, campaigns, and indicators, and is typically transported via the TAXII protocol for automated sharing.
NSE Threat Analysis & Vulnerability Management 5
Which FortiGate feature uses machine learning to detect anomalous network behavior and potential threats?