Indicators of Malicious Activity Quiz

A type of forensic evidence that can be used to detect unauthorized access attempts or other malicious activities is called:

A) CVE

B) IoC

C) AIS

D) OSINT

B)

An Indicator of Compromise (IoC) is a piece of forensic data used to identify potential malicious activity, such as unauthorized access or malware infection.

An account lockout might indicate which type of malicious activity?

A) Attempt to deliver malicious content

B) DoS attack

C) Account compromise

D) Password brute-forcing attempt

D)

Account lockouts are often caused by repeated failed login attempts, which is a common sign of brute-force attacks.

Which of the terms listed below most accurately describes a situation wherein a single account is being used from multiple locations/devices at the same time?

A) Spraying attack

B) Concurrent session usage

C) Single Sign-On (SSO)

D) Impossible travel

B)

Concurrent session usage occurs when an account is accessed from different locations or devices simultaneously, often indicating unauthorized access.

Which of the following terms refers to a malicious activity indicator in a situation where a firewall or other security measure prevents an attempt to deliver malicious payload or perform an unauthorized action?

A) DoS attack

B) Resource inaccessibility

C) Blocked content

D) Excessive system resource consumption

C)

Blocked content indicates a security mechanism has stopped potentially harmful data or activity, such as malware payloads or intrusion attempts.

Which of the terms listed below most accurately describes a situation wherein an account is accessed from a location that is physically impossible for the user to be in?

A) Login time restrictions

B) Impossible travel

C) Concurrent session usage

D) Out-of-cycle logging

B)

Impossible travel refers to detecting logins from two distant locations within an unrealistic time frame, suggesting potential credential compromise.

The term "Out-of-cycle logging" refers to instances where systems or applications produce logs outside their regular intervals or in abnormal volumes, potentially signaling malicious activity.

A) True

B) False

A)

Out-of-cycle logging can indicate abnormal or malicious behavior by showing unexpected or excessive logging patterns.

Which of the following would indicate an attempt to hide evidence of malicious activity?

A) Account lockout

B) Resource inaccessibility

C) Missing logs

D) Concurrent session usage

C)

Missing logs suggest log tampering or deletion, a tactic often used by attackers to hide traces of their activities.