Cybersecurity test (Intermediate)

Sample questions

5 sample questions from the Cybersecurity test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. Which of the following best describes the purpose of SIEM alert suppression rules?

   1. SIEM alert suppression rules are used to prioritize alerts based on their severity and impact.
   2. SIEM alert suppression rules are tuned to reduce false positives by filtering out alerts that match known benign activity patterns.
   3. SIEM alert suppression rules are applied to all alerts to ensure complete suppression of all alerts.
   4. SIEM alert suppression rules are used to block all alerts permanently once they are identified as false positives.

   Answer: B. SIEM alert suppression rules are tuned to reduce false positives by filtering out alerts that match known benign activity patterns.

   SIEM alert suppression rules are designed to filter out alerts that are known to be false positives, such as alerts that match known benign activity patterns. This helps reduce alert fatigue and improves the efficiency of SOC teams by focusing on real threats. Option 1 is correct because it accurately reflects the purpose of suppression rules. Option 2 is incorrect because suppression rules are not used to block alerts permanently but to filter them based on context. Option 3 is incorrect because suppression rules are not applied to all alerts but only to those that match specific criteria. Option 4 is incorrect because suppression rules are not used to prioritize alerts but to suppress them based on known benign activity.

2. What is the primary purpose of registry key monitoring in endpoint security?

   1. Registry key monitoring uses signature-based detection to identify known malware in registry keys.
   2. Registry key monitoring is only useful for detecting ransomware attacks and has no role in threat detection.
   3. Registry key monitoring tracks changes to registry keys to detect unauthorized modifications or malicious activity.
   4. Registry key monitoring is a feature exclusive to next-generation firewalls (NGFW) for application-layer inspection.

   Answer: C. Registry key monitoring tracks changes to registry keys to detect unauthorized modifications or malicious activity.

   Registry key monitoring is a critical component of endpoint security, as it enables detection of unauthorized changes to the Windows registry, which can indicate malicious activity. Other options may describe related concepts, but they do not accurately define registry key monitoring.

3. Which of the following best describes a key technique used in log normalization during SIEM implementation?

   1. Use raw log formats to preserve original details for forensic analysis.
   2. Aggregate all logs into a single database for faster query performance.
   3. Encrypt all log data to ensure confidentiality during transmission and storage.
   4. Normalize log formats to a common schema (e.g., JSON or XML) to enable consistent correlation and analysis across different sources.

   Answer: D. Normalize log formats to a common schema (e.g., JSON or XML) to enable consistent correlation and analysis across different sources.

   Log normalization is the process of converting logs from various sources into a standardized format to facilitate easier correlation, analysis, and integration with SIEM systems. This ensures that logs from different devices, applications, and platforms can be uniformly interpreted, improving the accuracy of threat detection and incident response. Other options may relate to log collection or storage but do not directly address the concept of normalization.

4. Which of the following is a common mistake when using the MITRE ATT&CK framework?

   1. Treating MITRE ATT&CK as a checklist to complete, rather than using it to inform detection and response strategies.
   2. Focusing only on high-severity tactics and ignoring low-severity ones.
   3. Using MITRE ATT&CK only for red team planning and not for defense.
   4. Assuming that every technique in MITRE ATT&CK is equally relevant to all organizations.

   Answer: A. Treating MITRE ATT&CK as a checklist to complete, rather than using it to inform detection and response strategies.

   A common mistake when using the MITRE ATT&CK framework is treating it as a checklist to complete, rather than using it as a knowledge base to guide threat-informed defense, detection coverage mapping, and red/purple team planning. The framework is designed to describe adversary behavior, not to be used as a list of tasks to be checked off. Other options are not accurate representations of this particular mistake.

5. Which security technology actively blocks malicious traffic in real-time by operating inline with network traffic, as opposed to only detecting and alerting on suspicious activity?

   1. Intrusion Prevention System (IPS)
   2. Firewall
   3. Intrusion Detection System (IDS)
   4. SIEM

   Answer: A. Intrusion Prevention System (IPS)

   An Intrusion Prevention System (IPS) operates inline and actively blocks malicious traffic, whereas an Intrusion Detection System (IDS) only detects and alerts without taking action. When immediate blocking is required, an IPS is the appropriate choice, while an IDS is used for monitoring and alerting purposes.