Question 230
Two intrusion campaigns use the same public penetration-testing tool and cloud provider. What can the SOC conclude about attribution?
- Both campaigns are definitely run by one named adversary group
- The shared tooling is insufficient for high-confidence identity attribution
- Cloud hosting proves the attacker is physically in the provider's headquarters country
- The tool vendor necessarily authorized the observed attacks
Explanation
Correct Answer
B:Common tools and hosting services are reused widely; attribution needs multiple independent behavioral and infrastructure relationships.
Incorrect Answers
A:Tool overlap can arise from imitation or common availability and does not uniquely identify the operator.
C:Infrastructure location is not the same as human operator location or affiliation.
D:Distribution of a legitimate tool does not mean the vendor approved malicious deployment.
Question 231
In a Diamond Model investigation, what role does the external server used for malware command traffic occupy?
- Infrastructure supporting the adversary's interaction with the victim
- The capability category when no software or technique is described
- The victim category solely because the server communicates with a target
- The adversary identity itself with conclusive certainty
Explanation
Correct Answer
A:The model distinguishes transport and hosted resources from the capability used and the parties involved in the intrusion event.
Incorrect Answers
B:A capability concerns the mechanism used, while a server address is an infrastructure feature.
C:The victim is the targeted entity; an attacker-controlled relay more naturally belongs to infrastructure.
D:A hosting asset does not uniquely identify the controlling person or group and may be rented or compromised.
Question 232
A new report describes malicious scheduled-task persistence. What is an effective way to use it in a threat-intelligence-driven SOC?
- Turn the technique into a locally testable hunt or detection
- Archive the report without assigning any detection or response owner
- Claim the threat is prevented because the report contains an ATT&CK identifier
- Block every system that uses scheduled tasks
Explanation
Correct Answer
A:Operationalizing intelligence connects external observations to available telemetry and validates whether the organization can detect similar behavior.
Incorrect Answers
B:Passive storage may be useful historically but does not address the opportunity to improve coverage.
C:A framework mapping informs detection engineering but does not automatically configure any preventive control.
D:Scheduled execution is common legitimate administration, so a universal ban would be impractical and disruptive.
Question 233
A previously high-confidence malware domain generates hundreds of benign matches after it is reassigned to a CDN. What feedback should be sent to the intel owner?
- Assign every subsequent connection a critical severity regardless of destination use
- Supply current benign context and request expiry reassessment
- Assume all intelligence providers automatically know about the reassignment
- Delete the matches and leave the feed unchanged
Explanation
Correct Answer
B:Intelligence quality improves when SOC outcomes are fed into validation, confidence scoring, and indicator lifecycle controls.
Incorrect Answers
A:Increasing priority worsens workload and disregards evidence that the indicator is no longer discriminating.
C:Feed owners may lack current customer-side observations, so explicit feedback can be valuable.
D:Silent deletion hides data quality problems and allows the same false-positive pattern to recur.
Question 234
A commercial feed and a community report disagree about a domain. How should an analyst choose whether to block it?
- Always trust the report with the longest threat actor name
- Always trust whichever feed is most expensive
- Block all traffic permanently whenever any source disagrees
- Weigh observed evidence, age, source trust, and potential impact
Explanation
Correct Answer
D:A paid subscription is not proof of correctness; operational decisions should reflect corroboration and the cost of false blocking.
Incorrect Answers
A:Naming detail is not a substitute for provenance and independently verifiable observations.
B:Price is a licensing characteristic and does not guarantee current accuracy of an individual indicator.
C:Conflicting classifications call for investigation and possibly time-limited safeguards, not unconditional permanent exclusion.
Question 235
Analysts know an actor frequently creates new mail forwarding rules after account takeover. What proactive detection hypothesis follows?
- Only firewall port scans can reveal mailbox forwarding changes
- Unexpected mail forwarding after risky identity activity
- All mailbox forwarding changes are automatically malicious
- Future mail rules cannot be investigated using historical audit events
Explanation
Correct Answer
B:A hunt can connect mailbox audit events, sign-ins, and recipient domains to validate the described actor behavior locally.
Incorrect Answers
A:Mailbox administrative events are control-plane activity that packet-scan counts cannot directly capture.
C:Legitimate delegation and routing exist, so an analytic requires authorization and destination context.
D:With appropriate audit retention, mailbox configuration changes and delivery activity can be reconstructed.
Question 236
A feed contains an IP observed in a phishing campaign six months ago. The IP now serves multiple legitimate tenants. What is the safest SOC use?
- Treat it as a permanent universal malware indicator
- Erase the indicator from all prior incident records
- Require new corroboration before enforcing historical indicators
- Assume every domain on the same address belongs to the original attacker
Explanation
Correct Answer
C:Age and multi-tenant hosting reduce the value of an unconditional block while the past association may still aid chronology.
Incorrect Answers
A:The address can change ownership or serve benign content; indiscriminate blocking risks collateral damage.
B:Historical enrichment remains relevant to understanding the earlier phishing campaign and should not be silently rewritten.
D:Shared hosting commonly maps unrelated customers to one IP, defeating that attribution shortcut.
Question 237
No alert has fired, but a hunter suspects attackers are abusing remote management tools to reach finance servers. What characterizes the next activity?
- A passive wait for a signature to trigger before any investigation
- A compliance audit that verifies only document formatting
- A hypothesis-driven proactive search through relevant telemetry
- An immediate network shutdown based only on conjecture
Explanation
Correct Answer
C:Threat hunting tests a plausible adversary behavior without waiting for a preexisting alert and should record evidence and outcomes.
Incorrect Answers
A:Reactive alert triage is valuable but differs from the proactive investigation described in the scenario.
B:Policy documentation does not test whether suspicious remote-management behavior occurred in host and network records.
D:A hunt hypothesis initiates evidence collection; disruptive response requires corroboration and proper authorization.
Question 238
A hunt searches the last 30 days for suspicious use of legitimate remote execution tools. Which prerequisite most affects whether a negative result is meaningful?
- Check process and session telemetry coverage for the whole period
- The number of threat-intelligence subscriptions purchased
- Document the hunt hypothesis precisely but omit source coverage and retention validation
- Rely on centralized threat-intelligence watchlists without checking process-level logs
Explanation
Correct Answer
A:Absence of matches is weak evidence if hosts were not monitored or the required events have aged out.
Incorrect Answers
B:Feed count does not guarantee local visibility of remote process and session behavior.
C:A well-written hypothesis does not make absence of matching records conclusive if half the relevant endpoints did not generate or retain the required telemetry.
D:Indicator lists can support a hunt but cannot validate negative results for abuse of legitimate tools when execution and remote-session data are missing.
Question 239
A hunter notices a server contacting a new region at night. What baseline question should be tested before treating the connection as malicious?
- Whether all night traffic should be declared unauthorized
- Whether the destination has a visually complex hostname
- Whether the server model is the newest available hardware
- Check scheduled business traffic to the destination at that time
Explanation
Correct Answer
D:Behavioral hunting depends on distinguishing genuinely novel activity from scheduled business processes and platform changes.
Incorrect Answers
A:Many legitimate systems transfer data or update outside business hours, so timing alone is insufficient.
B:Hostname appearance alone is a weak measure of maliciousness without ownership and behavior context.
C:Hardware generation may affect performance but does not directly explain approved outbound service dependencies.
Question 240
A hunter maps a hypothesis to ATT&CK and wants the required observables. What is the correct next step?
- Map the ATT&CK technique to required local telemetry
- Begin active scanning of production systems without authorization
- Assume an ATT&CK mapping automatically produces a valid SIEM rule
- Use only the adversary group name as a detection criterion
Explanation
Correct Answer
A:Mapping helps translate adversary procedures into testable host, identity, or network artifacts when that telemetry is available.
Incorrect Answers
B:A hunt generally examines evidence; intrusive tests have separate safety and change-control requirements.
C:Framework mapping describes behavior; it does not supply environment-specific detection logic or field normalization.
D:Many actors share techniques and group labels cannot replace observable behavior in local telemetry.
