D340 Cyber Defense and Countermeasures - Set 3 - Part 2

Correct Answer: Detection capability improves iteratively during the exercise

Traditional tests report findings at the end. Purple teaming produces immediate feedback, letting defenders build and validate detections as techniques are executed.

Correct Answer: Detailed activity data collected from endpoints for detection and investigation

Endpoint telemetry captures process execution, file changes, network connections, and other activity, providing the visibility needed to detect and reconstruct attacks.

Correct Answer: Most attacker actions ultimately involve executing processes

Attackers must run code to accomplish objectives, so recording process creation with command lines and parent relationships reveals a large share of malicious activity.

Correct Answer: Using legitimate built-in system tools to conduct malicious activity

Attackers abuse legitimate administrative tools already present on systems, avoiding malware files that signature-based defenses would detect.

Correct Answer: The tools used are legitimate and commonly used by administrators

Since the binaries are legitimate and used by administrators, detection must focus on unusual context, parameters, and parent-child relationships rather than the tool itself.

Correct Answer: Malicious code executing in memory without writing an executable to disk

Fileless malware operates in memory, often through scripting or legitimate tools, leaving little disk evidence for traditional file-scanning antivirus.

Correct Answer: Behavioral monitoring of process and memory activity

Since no malicious file exists on disk, detection depends on observing anomalous process behavior, script execution, and memory activity.

Correct Answer: A planted artifact that generates an alert when accessed by an intruder

Deception artifacts such as fake credentials or documents have no legitimate use, so any access is a high-confidence indication of intrusion.

Correct Answer: Legitimate users have no reason to interact with them

Because no legitimate business process touches a decoy, interaction with it is almost certainly malicious, yielding very low false positive rates.

Correct Answer: Anomalous communication patterns such as beaconing or unusual data transfers

Analyzing traffic patterns reveals command and control beaconing, unusual destinations, and abnormal data volumes even when content is encrypted.

Correct Answer: Malware regularly contacting command and control infrastructure

Regular, periodic connections to an external host with consistent timing and small payloads is characteristic of malware checking in with its controller.

Correct Answer: Payload content cannot be inspected without decryption

Encryption conceals payloads, so defenders must rely on metadata such as destinations, timing, volume, and certificate characteristics, or perform controlled inspection.

Correct Answer: Automating repetitive response actions and coordinating workflows

SOAR automates routine investigation and containment steps and coordinates workflow across tools, letting analysts focus on judgment-intensive work.

Correct Answer: Repetitive, well-defined enrichment and containment actions

Automation excels at consistent repetitive tasks such as gathering context or isolating a host, while nuanced judgment remains with human responders.

Correct Answer: Automated containment may disrupt legitimate business operations

Aggressive automated actions triggered by a false positive can disable critical systems, so high-impact responses typically require human confirmation.

Correct Answer: Ongoing observation of security posture rather than periodic assessment

Continuous monitoring maintains ongoing awareness of security state and threats, since point-in-time assessments quickly become outdated in changing environments.

Correct Answer: Objective assessment of whether controls are performing as intended

Metrics provide evidence about control performance and risk trends, enabling informed decisions rather than reliance on assumption.

Correct Answer: Mean time to detect and contain incidents

Detection and containment times measure actual defensive effectiveness, unlike activity counts that indicate effort without demonstrating outcome.

Correct Answer: Attacks occurring in unmonitored areas cannot be detected

Any system, network segment, or application not generating telemetry is a blind spot where intrusion can proceed entirely unobserved.

Correct Answer: Different telemetry sources and provider APIs must be integrated

Cloud platforms expose activity through provider-specific logs and APIs, requiring deliberate configuration and integration rather than traditional network sensors.