stud
bud
Sign up
Log in
Home
Library
Explore
SAT
More
CyberSecurity Associate. Week 3 (BTF) Flashcards | StudBud
Explore
/
CyberSecurity Associate. Week 3 (BTF)
CyberSecurity Associate. Week 3 (BTF)
30 terms
·
StudBud Administration
·
11 plays
Blue Team Fundamentals
Flashcards
30 cards
F
Practice quiz
P
Host live
L
Questions
30
Answers
1
What is the Pyramid of Pain used for in cybersecurity?
Measuring network latency
Ranking the difficulty of altering IoCs for attackers
Evaluating firewall performance
Classifying malware types
2
Which SOC level is responsible for handling complex threats and root cause analysis?
SOC Level 3
SOC Level 1
SOC Level 2
SOC Level 4
3
What is the primary purpose of the Dark Web in cybersecurity?
To speed up internet browsing
To host legitimate corporate websites
To replace the Surface Web
To provide anonymity for illegal and legal activities
4
Which of the following is NOT a benefit of deception technology?
High false positive rate
Gathering intel on attacker TTPs
Early detection of attackers
Diverting attacks from real systems
5
What is the primary benefit of TOR's onion routing?
Blocking malicious websites
Direct peer-to-peer connections
Faster internet speeds
Anonymity and encryption through multiple nodes
6
Which of the following is an example of a deception technology?
SIEM
Honeypot
EDR
SOAR
7
Which platform provides free threat intelligence and IoCs shared by researchers?
VirusTotal
Abuse.ch
AlienVault OTX
All of the above
8
What are Indicators of Compromise (IoCs)?
Clues or evidence of a cyberattack
Encryption algorithms
Tools used for penetration testing
Firewall rules
9
Which phase of the Cyber Kill Chain involves extracting the information the malicious actor targeted?
Exploitation
Reconnaissance
Installation
Actions on Objectives
10
Which phase of the Cyber Kill Chain involves creating a malicious payload?
Delivery
Reconnaissance
Weaponization
Exploitation
11
What is timestomping?
A type of DDoS attack
Modifying file timestamps to evade detection
Encrypting C2 communications
A technique to speed up malware execution
12
What type of intelligence involves using publicly available data for reconnaissance?
HUMINT
OSINT
Threat Intelligence
SIGINT
13
Which IoC is the easiest for attackers to change?
IP addresses
Domain names
Hash Values
TTPs
14
Which tool is used for automated OSINT scanning to find exposed credentials and open ports?
SpiderFoot
Metasploit
TheHarvester
Wireshark
15
Which tool is used for real-time monitoring and automated response to endpoint threats?
XDR
SOAR
SIEM
EDR
16
Which of the following is an example of a honeytoken?
A legitimate user credential
A fake AWS API key
An encrypted file
A real database entry
17
Which of the following is NOT a key responsibility of the Blue Team?
Penetration Testing
Vulnerability management
Log analysis
Threat hunting
18
What is a honeynet?
A network of honeypots simulating a full environment
A type of malware
A firewall configuration
A single decoy system
19
Which of these software is used to access the Dark Web?
Google Chrome
Tor Browser
Microsoft Edge
Firefox
20
What are Google Dorks?
Specially crafted search queries using advanced operators
A type of phishing attack
A tool for encrypting web traffic
Malware-infected search results
21
Which of the following is NOT a best practice for OSINT researchers?
Erasing traces of research after completion
Using a VPN or TOR
Using privacy extensions like NoScript
Conducting research on a competitor social account without authorization
22
What is the primary role of a Blue Team in cybersecurity?
Performing social engineering attacks
Developing malware for testing
Conducting penetration testing
Protecting systems and data from cyberattacks
23
Which of the following is a legal use of the Dark Web?
Drug trafficking
Stolen data markets
Whistleblowing
Malware distribution
24
What does TTP stand for in the context of threat intelligence?
Tactics, Techniques, and Procedures
Threat Tracking Protocol
Time-To-Patch
Traffic Transfer Protocol
25
What does SIEM stand for?
Secure Internet and Email Management
Security Information and Event Management
System Information and Event Monitoring
Security Intelligence and Encryption Module
26
Which of the following is an example of an EDR solution?
Maltego
Splunk Phantom
Shodan.io
CrowdStrike Falcon
27
What is the main goal of a Security Operations Center (SOC)?
To develop new encryption algorithms
To hack into competitor systems
To identify, evaluate, and address cybersecurity issues
To manage employee payroll systems
28
What is the purpose of SOAR in a SOC environment?
To manage physical security systems
To replace human analysts
To conduct penetration testing
To enable security tools to work together and automate tasks
29
What is the purpose of the Command and Control (C2) phase in the Cyber Kill Chain?
To delete evidence of the attack
To establish communication with the compromised system
To encrypt the victim's data
To gather initial intelligence about the target
30
What is the Hidden Wiki?
A type of honeypot
A search engine for the Surface Web
A tool for decrypting TOR traffic
A directory of notable Dark Web sites
