ASU Test Training

What is the main purpose of the foundational training path?

Build foundational cybersecurity knowledge

Which behavior best demonstrates deliberate practice?

Repeating a skill in a valid environment and using timely feedback

A learner needs an official source for internal learning content. Which resource is most appropriate?

The approved enterprise learning or knowledge platform

Why should a learner verify training facts before using them in a client engagement?

To ensure the information is accurate and appropriate for the client context

A participant misses a session and needs guidance. What is the best first action?

Contact the designated training administrator or program point of contact

Which approach best supports mastery of a cybersecurity topic?

Combine instruction, hands-on exercises, repetition, and feedback

Why is access control important for internal training materials?

It helps prevent unauthorized disclosure of company information

A learner receives two versions of the same deck. What should the learner do?

Use the approved latest version and validate differences

Which action best reflects professional conduct during training?

Attend on time, follow instructions, and communicate issues early

What is the best way to use an answer key during preparation?

Review mistakes and understand why the correct option is right

What is the primary function of a Security Operations Center?

Continuously monitor, detect, investigate, and respond to security threats

Which item is an indicator of compromise?

A malicious file hash

What does a tactic represent in MITRE ATT&CK?

An adversary's high-level objective

An endpoint repeatedly connects to attacker-controlled infrastructure. Which ATT&CK tactic best applies?

Command and Control

A SIEM alert shows encoded PowerShell launched by a word processor. What should the analyst do first?

Validate the alert and collect relevant process, command-line, user, and host evidence

What is the main goal of containment?

Limit damage and stop further malicious activity

Why are forensic copies created before eradication?

To preserve evidence for investigation

Which Cyber Kill Chain stage follows Delivery?

Exploitation

A rule detects nearly every administrative script and floods the queue. What should be improved?

Detection fidelity

After recovery, which activity best supports improvement?

Document lessons learned and update controls or playbooks

Which artifact is volatile?

Running processes in memory

Why should RAM be collected early during a live investigation?

Its contents may be lost when the system is powered off

Which Windows tool is useful for examining running processes and parent-child relationships?

Process Explorer

A suspicious executable copies itself into an auto-start location. What behavior does this suggest?

Persistence

What does an unusual parent process launching PowerShell most strongly justify?

Further investigation of process ancestry and command-line details

Which Windows component commonly stores configuration and persistence-related values?

Registry

What is the best practice when collecting Windows evidence?

Document actions and preserve integrity with hashes

An investigator finds many svchost.exe processes. What is the most appropriate conclusion?

Count alone is insufficient, paths, signatures, services, and behavior must be checked

Which evidence can help identify account usage?

Authentication and logon events

Why is process path important during triage?

Malware may imitate legitimate names but run from unusual locations

Which command lists files in a directory?

ls

Which command displays the contents of a text file?

cat

Which command shows the current working directory?

pwd

A suspicious process runs under an unusual account. What is the best first step?

Use ps or pstree to inspect the process and its parent

Which command is commonly used to search text for a pattern?

grep

Why should investigators avoid rebooting a compromised Linux host too early?

Volatile evidence such as processes and connections may be lost

Which command can show active network connections on many Linux systems?

ss

A file begins with a dot in Linux. What does that usually indicate?

It is hidden from normal directory listings

Which command shows the current user's identity?

whoami

What should be recorded when collecting a suspicious Linux file?

Path, timestamps, ownership, permissions, and hash

What type of address is 192.168.11.3?

Private IPv4

Which protocol provides secure remote shell access?

SSH

An attacker abuses ICMP directed broadcasts to amplify traffic. What attack is this?

Smurf attack

Which email headers are useful when investigating sender spoofing?

From, Return-Path, Received, and Reply-To

A message uses urgency and a look-alike domain to request payment. What is the most likely threat?

Business Email Compromise or phishing

What is email thread hijacking?

Abusing a legitimate conversation to send deceptive messages in context

A URL contains a misspelled brand name and requests credentials. What should an analyst suspect?

Phishing impersonation

Which network detail identifies a service endpoint on a host?

Port number

What does DNS tunneling abuse?

DNS queries and responses to carry hidden data or commands

Before interacting with a suspicious URL, what is the safest approach?

Use approved analysis methods and avoid opening it directly on a production workstation

How does threat hunting differ from alert-only monitoring?

It proactively searches for malicious activity even without a known alert

What should a hunt mission normally begin with?

A testable hypothesis

Which source can help create a hunting hypothesis?

Threat intelligence about relevant adversary TTPs

What is TTP-driven hunting focused on?

Adversary tactics, techniques, and procedures

Which dataset can reveal suspicious process execution?

Endpoint process metadata

A hunter groups events with similar characteristics to identify anomalies. What technique is being used?

Clustering

What does stack counting help identify?

Unusual highs or lows in repeated events

A hypothesis expects credential dumping. Which evidence is most relevant?

Process execution and security events associated with credential access

After a successful hunt finds a new pattern, what should happen next?

Enrich detections, document findings, and share actionable intelligence

Why is situational awareness important in hunting?

It helps analysts recognize meaningful changes in the environment

Which intelligence type provides raw, machine-readable indicators such as hashes and IPs?

Technical intelligence

Which intelligence type focuses on adversary TTPs and MITRE ATT&CK mapping?

Tactical intelligence

Which intelligence type describes an active campaign, infrastructure, and timeline?

Operational intelligence

Which intelligence type is most suitable for executives making long-term risk decisions?

Strategic intelligence

What is OSINT?

Intelligence collected from publicly available sources

Why should defenders perform OSINT against their own organization?

To understand what adversaries can learn from public information

In MITRE ATT&CK, what does a technique describe?

How an adversary may achieve a tactical objective

A report contains an IP address from one unverified post. What should the analyst do?

Corroborate it with reliable sources and context before action

What is the main value of an intelligence lifecycle?

It turns requirements and collected data into analyzed, disseminated, and improved intelligence

Which output is most actionable for a SOC analyst?

Relevant IOCs and TTPs with context and recommended detection actions

What is malware?

Software intended to cause harm or perform unauthorized actions

What is the main goal of static malware analysis?

Examine a sample without executing it

What is the main goal of dynamic analysis?

Observe behavior while the sample executes in a controlled environment

Which item is a host-based indicator?

A suspicious file hash or registry change

Which activity is suspicious during network-focused malware analysis?

Repeated beaconing to an unknown external IP

Why should malware be analyzed in an isolated sandbox?

To reduce risk to production systems and observe behavior safely

A sample produces random-looking domains repeatedly. What behavior might this indicate?

Domain generation for command-and-control communication

Which tool is commonly used to inspect packet-level malware traffic?

Wireshark

What can strings extracted from a binary reveal?

Possible URLs, commands, paths, or other readable clues

Why are malware analysis findings useful to incident response?

They support IOC extraction, containment, eradication, and improved detection

What is a vulnerability?

A weakness that a threat source could exploit or trigger

What makes a zero-day vulnerability especially challenging?

A fix or patch may not yet be available

Which stage identifies assets and weaknesses through scanning and assessment?

Discovery

Why should prioritization consider asset criticality and threat intelligence?

Severity alone may not reflect actual business and exploitation risk

A critical internet-facing flaw is actively exploited. What is the best response?

Prioritize remediation or mitigation and validate the fix

What is the purpose of remediation validation?

Confirm that the vulnerability is fixed or adequately mitigated

What does CTEM emphasize?

Continuous identification, prioritization, validation, and reduction of exposure

A system cannot be patched immediately. What is the best interim approach?

Apply an approved compensating control and track the exception

Why must vulnerabilities be mapped to asset owners?

Owners are needed to coordinate risk decisions and remediation

Which metric best indicates remediation effectiveness?

Validated closure within agreed risk-based timelines

What is the most important prerequisite before penetration testing?

Clear written authorization and defined scope

How does penetration testing differ from a basic vulnerability assessment?

It may actively validate exploitability within an authorized scope

What is reconnaissance?

Gathering information about a target to identify possible entry points

An image posted publicly contains GPS metadata. What can this expose?

The location where the image was created

Which tool is commonly used for port and service discovery?

Nmap

What is SQL injection?

Supplying crafted input that alters a backend SQL query

What is cross-site scripting?

Injecting script content that executes in a user's browser

A tester finds a severe issue outside the agreed scope. What should happen?

Stop that activity and follow the engagement's escalation rules

Why should evidence be collected during a penetration test?

To support reproducible findings, impact analysis, and remediation

What makes a good penetration-test recommendation?

It is specific, risk-based, and includes practical remediation guidance