Practice Test #1

THOR.HAMMER is highly exploitable (AV:N/AC:L/PR:N/UI:N) and has High availability impact (A:H) but no confidentiality or integrity impact (C:N/I:N). It is also on an internal system, which the policy deprioritizes relative to external systems. Additionally, the policy states confidentiality is prioritized over availability when a choice must be made, so this ranks below confidentiality-impacting issues like B/D.

LOKI.DAGGER is externally exposed and highly exploitable, which makes it important. However, its impact is only High availability (A:H) with no confidentiality/integrity impact (C:N/I:N). The policy explicitly prioritizes confidentiality over availability when choosing between them. Therefore, despite being external, it is lower priority than an external vulnerability with High confidentiality impact (B).

THANOS.GAUNTLET has the same strong exploitability and High confidentiality impact as option B, but it is on an internal system. The policy states publicly available (external) systems and services are prioritized over internal systems. Therefore, D would be a high priority, but it is second to B because external exposure is the tie-breaker when severity characteristics are otherwise equivalent.

Command and control (C2) refers to attacker infrastructure and communication channels used to remotely manage compromised hosts (e.g., beaconing, tasking, exfiltration coordination). It is associated with malware, botnets, and post-exploitation activity, not legitimate administrative integrations. Using an API to bulk load access requests into IAM is an internal operational workflow, so it does not match C2.

Data enrichment is the process of augmenting existing security data with additional context to improve detection and triage (e.g., adding threat intelligence reputation, asset owner, business criticality, vulnerability context, or geo-location). While enrichment often uses APIs, the described action is not adding context to records; it is performing bulk provisioning/requests, which is automation rather than enrichment.

Single sign-on (SSO) is an authentication/authorization architecture that allows users to authenticate once and access multiple applications using federation protocols (e.g., SAML, OpenID Connect) or centralized authentication (e.g., Kerberos). Bulk inserting access requests into an identity management system is about provisioning and workflow automation, not about federated login or session/token reuse across services.

Transfer means shifting or sharing risk with another party, such as purchasing cyber insurance, using contractual indemnification, or outsourcing a service with defined SLAs. While a third party might help manage patches, the scenario specifically describes implementing a patch management program to remediate vulnerabilities, which is applying a control to reduce risk rather than transferring it.

Accept means acknowledging the risk and choosing not to implement additional controls, typically because the cost or operational impact of remediation outweighs the benefit. Acceptance is usually documented with risk sign-off and monitoring. Since the company is actively implementing patch management to remediate vulnerabilities, it is not accepting the risk; it is taking corrective action.

Avoid means eliminating the risk by discontinuing the activity that creates it, such as removing the vulnerable application, decommissioning the system, disabling a risky feature, or blocking an entire service. Patch management does not eliminate the underlying business activity; it keeps the system in use while reducing exposure. Therefore, it is mitigation, not avoidance.

An external scan assesses systems from outside the network perimeter and is useful for understanding internet-facing exposure. However, it is typically unauthenticated and limited to what is reachable externally. It will not reliably identify internal patch or configuration issues and therefore will not resolve the problem of incomplete findings in vulnerability reports for internal assets. It improves perimeter visibility, not host-level scan completeness.

A differential scan compares results against a previous baseline and reports only changes, often to reduce scan time and reporting noise. If the baseline scan was incomplete due to lack of authentication or access issues, the differential scan will inherit that limitation and still miss vulnerabilities. It is useful for tracking changes over time, but it does not improve the depth or completeness of vulnerability discovery. Therefore, it is not the right method to fix incomplete findings.

A network scan focuses on discovering live hosts, open ports, and reachable services across the environment. While it can improve asset discovery and identify exposed services, it does not provide the same depth as authenticated host checks. If reports are incomplete because the scanner cannot inspect local vulnerabilities such as missing patches or insecure configurations, a network scan alone will not solve that problem. It helps map the environment, but not fully enumerate host-based weaknesses.

An MOU (Memorandum of Understanding) documents an understanding or intent to cooperate between parties. It is often less formal and may be non-binding, focusing on roles and coordination rather than enforceable performance metrics. While an MOU might mention desired timelines, it typically does not function as the primary mechanism to require remediation within a strict, measurable time frame.

Best-effort patching means attempting remediation when feasible without committing to a specific deadline or measurable target. This approach lacks enforceability and is generally considered weak from a security and audit perspective because it cannot guarantee risk reduction within required windows. The question specifically asks about requiring remediation within a given time frame, which best-effort explicitly does not ensure.

Organizational governance refers to the overall structure of policies, oversight, accountability, and decision-making within an organization. Governance can mandate that remediation SLAs exist and can define risk tolerance and escalation paths, but it is not the specific process/instrument that sets a concrete time-bound remediation requirement. The question is looking for the direct mechanism used to enforce timelines.

Beaconing is periodic, automated communication from an infected host to a command-and-control (C2) server (e.g., regular HTTP/DNS callbacks). The prompt describes emails with concealed URLs targeting administrators, which is indicative of phishing attempts, not an established compromised endpoint calling out repeatedly. Beaconing would be supported by logs showing consistent outbound connections at fixed intervals.

DNS hijacking involves manipulating DNS resolution (poisoning caches, altering resolver settings, or compromising authoritative records) so users are redirected to attacker-controlled destinations. The question does not mention DNS anomalies, incorrect domain resolution, or users being redirected despite typing correct URLs. It specifically highlights a concealed URL in an email, which points more directly to obfuscation and phishing.

An on-path (man-in-the-middle) attack occurs when an attacker intercepts and possibly alters traffic between two parties. Indicators include certificate warnings, unexpected TLS changes, ARP/DNS anomalies, or traffic routing through suspicious intermediaries. The prompt describes email content with a hidden link to an external site, not evidence of traffic interception or modification in transit.

ARP poisoning is a local network technique to redirect traffic by corrupting ARP tables, often enabling on-path attacks within the same broadcast domain. The scenario does not mention ARP anomalies, duplicate IP/MAC mappings, or local traffic interception. The described behavior is email-based targeting with a concealed URL, which is not explained by ARP poisoning.

Credentialed network scanning logs into targets (e.g., via SSH/WinRM/WMI) to enumerate patches, configs, and software, producing very accurate results and fewer false positives than unauthenticated scans. However, it requires providing privileged credentials to the scanning process and often implies broader access to sensitive systems. This conflicts with the question’s goal of reducing access while maintaining accuracy.

Passive scanning monitors network traffic (SPAN/TAP) and uses observed behavior and fingerprints to infer assets and potential vulnerabilities. It is low impact and requires minimal access to endpoints, which is attractive for sensitive environments. However, it is generally less accurate and less complete than credentialed or agent-based methods because it cannot reliably confirm patch/configuration state and may miss dormant services.

Dynamic scanning typically refers to Dynamic Application Security Testing (DAST), which tests running web applications by sending requests and analyzing responses for vulnerabilities (e.g., injection, XSS). It is valuable for application security but does not provide comprehensive host-level vulnerability assessment for OS patches and system configurations. It also doesn’t directly address the access-to-systems concern for infrastructure vulnerability management.

The ftp.active.port field relates to active-mode FTP negotiation details and is not a filter that reveals the transferred file contents by itself. It would only help in understanding how the data connection was negotiated in active mode, not in reconstructing the payload. It also fails entirely if the session used passive mode, which is very common. Therefore, it does not address the analyst's need to view the downloaded file contents.

Filtering on tcp.port==20 assumes the FTP data transfer is using TCP port 20, which is only generally true for active FTP and not for passive FTP. Many FTP sessions use ephemeral ports for the data channel, so this filter can miss the transfer completely. Even if some packets appear, the filter is too narrow and based on an outdated assumption about FTP behavior. It is not the best way to reliably locate and inspect the file contents.

Export Objects -> FTP is useful for extracting transferred files from a capture, but it is not the best answer to the specific problem described. The question asks how to see the packets containing the file transfer and inspect the entire contents after noticing they are absent from the packet list under the ftp filter. Export Objects is a recovery/export feature rather than the direct method for displaying the missing data-channel traffic in the analysis view. The more precise action is to filter on ftp-data and follow the relevant TCP streams.

The Cyber Kill Chain describes the stages of an intrusion, such as reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. While it helps analysts understand the progression of an attack and identify points for disruption, it is not granular enough to compare detailed techniques and procedures across multiple adversaries. MITRE ATT&CK is better suited for TTP comparison because it organizes adversary behavior into specific tactics and techniques rather than broad attack phases.

OWASP is focused on application security, especially web apps (e.g., OWASP Top 10). It provides guidance on common vulnerability classes and secure development/testing practices. It does not serve as a framework for comparing adversary TTPs across threat actors, so it is not the best tool for analyzing and contrasting known adversaries’ behaviors.

STIX/TAXII supports structured threat intelligence representation (STIX) and transport/sharing (TAXII). It’s excellent for exchanging indicators, observables, and threat intel objects between organizations and tools. However, it is not primarily a behavioral TTP comparison framework; it can carry ATT&CK-related data, but ATT&CK is the framework used to compare TTPs.