Module 08 Security Operations

Which of the following is correct about cybersecurity automation?

a. Cybersecurity operations have been more manual than automated for many years.

b. Cybersecurity automation requires both AI and ML.

c. Cybersecurity automation has been used since the very beginning of cybersecurity.

d. Threat hunting relies heavily upon cybersecurity automation.

Cybersecurity operations have been more manual than automated for many years.

Which of the following is NOT true about an SOC?

a. It houses the IT security team.

b. It is responsible for detecting and analyzing cybersecurity incidents.

c. It uses strictly automatic processes.

d. It responds to cybersecurity incidents.

It uses strictly automatic processes.

Which of the following is NOT correct regarding cybersecurity automation?

a. Using manual cybersecurity processes by an SOC will tip the balance in favor of attackers.

b. Modern cyberattacks are highly automated so defenses need to be automated.

c. Cybersecurity automation is now required by most certification bodies.

d. Time spent on manual processes allows threat actors time to spread their malware.

Cybersecurity automation is now required by most certification bodies.

What is data correlation?

a. Finding linkages from multiple data sources

b. A requirement for using ML

c. A dated technology no longer used due to the introduction of SIEMs

d. Using a minimum of three external and three internal data sources to understand a zero-day attack

Finding linkages from multiple data sources.

Which of the following is NOT correct about data enrichment?

a. It is the enhancement of data for cybersecurity analysis.

b. It includes expanding data sources from a single organization and then combining that with similar data from other organizations.

c. It is both broad and deep.

d. It is identical to threat feed combination.

It is identical to threat feed combination.

What is a strict matching of bytes in an AV signature called?

a. Heuristic scanning

b. Skip scanning

c. String scanning

d. Match scanning

String scanning

Which of the following is NOT a disadvantage with digest and byte signature detection?

a. They are considered inaccurate.

b. They cannot always detect a cluster of malware files.

c. They are time intensive.

d. Threat actors can circumvent them by creating an armored virus.

They are considered inaccurate.

Which is an open standard that enables an automated vulnerability management, measurement, and policy compliance evaluation?

a. SORA

b. SCAP

c. SRSR

d. SARC

SCAP

Which of the following are configuration best practice statements?

a. CVE

b. CCE

c. CPE

d. CWE

CCE

Which of the following is NOT correct about scripting?

a. JavaScript, PHP, Python, and Ruby are common scripting languages.

b. The language runtime of a scripting language is usually included in the installation of the OS.

c. Scripting has features not found in formal programming language.

d. Scripting should not be used for automation.

Scripting should not be used for automation.

In which of the following processes do developers merge their changes back to the main branch of code as often as possible, even several times each day?

a. CI

b. CDE

c. CD

d. CX

CI

What is another name for application program interface (API) integration?

a. APIaaS

b. PaaS

c. SaaS

d. iPaaS

iPaas

Which of the following involves automating and combining many tasks and processes?

a. Multitask combination (MTC)

b. Cybersecurity automation

c. Workflow orchestration

d. Autoflow

Workflow orchestration

Which of the following platforms can take immediate action when it detects a malicious action?

a. SIEM

b. SOAR

c. RSOC

d. SAII

SOAR

Which of the following technologies can learn by itself without the continual instructions of a computer programmer?

a. AI

b. RA

c. ML

d. XI

ML

Which of the following is NOT a risk associated with using AI in cybersecurity?

a. Attackers can cloak themselves by attempting to alter the training data that is used by ML to produce false negatives.

b. The time needed for AI to provide indicators of attacks is considered too slow to be useful today.

c. Threat actors may turn to using AI for attacks to circumvent defenses.

d. AI-powered cybersecurity applications and their devices likewise have vulnerabilities that could be attacked and compromised so that the algorithms could be altered by threat actors to ignore attacks.

The time needed for AI to provide indicators of attacks is considered too slow to be useful today.

Which of the following is NOT a characteristic of threat hunting?

a. Recursive

b. Predominately human-oriented

c. Iterative

d. Proactive

Recursive

Which of the following security roles has the goal of securing the environment after an alarm has been raised?

a. Incident responder

b. Penetration tester

c. SOC analyst

d. Threat hunter

Incident responder

Which of the following is NOT the result of successful work performed by a threat hunter?

a. Bundling critical assets

b. Creating a new data enrichment threat feed

c. Reduction of the attack surface area

d. Improvement in detection capabilities

Creating a new data enrichment threat feed

Which level of threat hunting uses a threat hunting team integrated across the SOC?

a. Managed

b. Quantitatively managed

c. Optimized

d. Defined

Optimized