White Hat Apprentice: From Lab to Professional Report Quiz

Quiz: Detection and Response

Pass mark: 70%. You can retry as many times as you need.

1 Why is time synchronization between systems so important for a SIEM? Single answer It makes the logs smaller Without it, events can appear in the wrong order and correlation rules or timelines become unreliable It is required by the SIEM licence to activate alerts It prevents attackers from reading logs

2 Which statements correctly describe IOCs and TTPs? (several answers) Multiple answers possible A file hash is an IOC that an attacker can change by recompiling the file TTPs describe how an adversary operates, so they usually give more durable detections An IP address from a threat feed stays malicious forever IOCs are always more valuable than behavioral detections

3 What does an ATT&CK identifier such as T1558.003 refer to? Single answer A vulnerability identifier assigned by a CVE program A version of the MITRE ATT&CK matrix A security product certification A documented adversary technique or sub-technique

4 A team colors 100 percent of the ATT&CK matrix green because every technique has a rule, but it has never tested them. What is the most accurate comment? Single answer The team is fully protected against all attacks Coverage maps should never be used Having a rule does not prove it works; detections must be tested and prioritized by relevant threats ATT&CK requires every technique to be green for compliance

5 During an incident, which actions are good practice? (several answers) Multiple answers possible Keep a time-stamped log of what you did and decided Immediately wipe affected machines before collecting anything Preserve relevant logs and evidence before making changes when possible Coordinate on a channel that the adversary may not be able to read