Practice Test #1

An MOU (Memorandum of Understanding) documents an understanding or intent to cooperate between parties. It is often less formal and may be non-binding, focusing on roles and coordination rather than enforceable performance metrics. While an MOU might mention desired timelines, it typically does not function as the primary mechanism to require remediation within a strict, measurable time frame.

Best-effort patching means attempting remediation when feasible without committing to a specific deadline or measurable target. This approach lacks enforceability and is generally considered weak from a security and audit perspective because it cannot guarantee risk reduction within required windows. The question specifically asks about requiring remediation within a given time frame, which best-effort explicitly does not ensure.

Organizational governance refers to the overall structure of policies, oversight, accountability, and decision-making within an organization. Governance can mandate that remediation SLAs exist and can define risk tolerance and escalation paths, but it is not the specific process/instrument that sets a concrete time-bound remediation requirement. The question is looking for the direct mechanism used to enforce timelines.

Beaconing is periodic, automated communication from an infected host to a command-and-control (C2) server (e.g., regular HTTP/DNS callbacks). The prompt describes emails with concealed URLs targeting administrators, which is indicative of phishing attempts, not an established compromised endpoint calling out repeatedly. Beaconing would be supported by logs showing consistent outbound connections at fixed intervals.

DNS hijacking involves manipulating DNS resolution (poisoning caches, altering resolver settings, or compromising authoritative records) so users are redirected to attacker-controlled destinations. The question does not mention DNS anomalies, incorrect domain resolution, or users being redirected despite typing correct URLs. It specifically highlights a concealed URL in an email, which points more directly to obfuscation and phishing.

An on-path (man-in-the-middle) attack occurs when an attacker intercepts and possibly alters traffic between two parties. Indicators include certificate warnings, unexpected TLS changes, ARP/DNS anomalies, or traffic routing through suspicious intermediaries. The prompt describes email content with a hidden link to an external site, not evidence of traffic interception or modification in transit.

ARP poisoning is a local network technique to redirect traffic by corrupting ARP tables, often enabling on-path attacks within the same broadcast domain. The scenario does not mention ARP anomalies, duplicate IP/MAC mappings, or local traffic interception. The described behavior is email-based targeting with a concealed URL, which is not explained by ARP poisoning.

Credentialed network scanning logs into targets (e.g., via SSH/WinRM/WMI) to enumerate patches, configs, and software, producing very accurate results and fewer false positives than unauthenticated scans. However, it requires providing privileged credentials to the scanning process and often implies broader access to sensitive systems. This conflicts with the question’s goal of reducing access while maintaining accuracy.

Passive scanning monitors network traffic (SPAN/TAP) and uses observed behavior and fingerprints to infer assets and potential vulnerabilities. It is low impact and requires minimal access to endpoints, which is attractive for sensitive environments. However, it is generally less accurate and less complete than credentialed or agent-based methods because it cannot reliably confirm patch/configuration state and may miss dormant services.

Dynamic scanning typically refers to Dynamic Application Security Testing (DAST), which tests running web applications by sending requests and analyzing responses for vulnerabilities (e.g., injection, XSS). It is valuable for application security but does not provide comprehensive host-level vulnerability assessment for OS patches and system configurations. It also doesn’t directly address the access-to-systems concern for infrastructure vulnerability management.

The ftp.active.port field relates to active-mode FTP negotiation details and is not a filter that reveals the transferred file contents by itself. It would only help in understanding how the data connection was negotiated in active mode, not in reconstructing the payload. It also fails entirely if the session used passive mode, which is very common. Therefore, it does not address the analyst's need to view the downloaded file contents.

Filtering on tcp.port==20 assumes the FTP data transfer is using TCP port 20, which is only generally true for active FTP and not for passive FTP. Many FTP sessions use ephemeral ports for the data channel, so this filter can miss the transfer completely. Even if some packets appear, the filter is too narrow and based on an outdated assumption about FTP behavior. It is not the best way to reliably locate and inspect the file contents.

Export Objects -> FTP is useful for extracting transferred files from a capture, but it is not the best answer to the specific problem described. The question asks how to see the packets containing the file transfer and inspect the entire contents after noticing they are absent from the packet list under the ftp filter. Export Objects is a recovery/export feature rather than the direct method for displaying the missing data-channel traffic in the analysis view. The more precise action is to filter on ftp-data and follow the relevant TCP streams.

The Cyber Kill Chain describes the stages of an intrusion, such as reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. While it helps analysts understand the progression of an attack and identify points for disruption, it is not granular enough to compare detailed techniques and procedures across multiple adversaries. MITRE ATT&CK is better suited for TTP comparison because it organizes adversary behavior into specific tactics and techniques rather than broad attack phases.

OWASP is focused on application security, especially web apps (e.g., OWASP Top 10). It provides guidance on common vulnerability classes and secure development/testing practices. It does not serve as a framework for comparing adversary TTPs across threat actors, so it is not the best tool for analyzing and contrasting known adversaries’ behaviors.

STIX/TAXII supports structured threat intelligence representation (STIX) and transport/sharing (TAXII). It’s excellent for exchanging indicators, observables, and threat intel objects between organizations and tools. However, it is not primarily a behavioral TTP comparison framework; it can carry ATT&CK-related data, but ATT&CK is the framework used to compare TTPs.