Hard Cybersecurity Analyst questions

32 questions · 20 points each for a correct first answer.

1. 1.Detecting Kerberoastingactive-directory, windows-logs, threat-detectionhard
2. 2.What zero trust really meanszero-trust, security-architecturehard
3. 3.SSRF and cloud instance metadatacloud-security, aws, web-securityhard
4. 4.Reading static analysis resultsmalware-analysishard
5. 5.A good threat hunting hypothesisthreat-hunting, mitre-attackhard
6. 6.Why a 99% accurate rule floods the SOCdetection-engineering, alert-triagehard
7. 7.Artefacts of PsExec lateral movementwindows-logs, incident-response, threat-detectionhard
8. 8.First move on an encrypting hostincident-response, edr, ransomwarehard
9. 9.Evicting a Golden Ticket attackeractive-directory-security, incident-responsehard
10. 10.Detecting DCSyncactive-directory-security, windows-event-logs, detection-engineeringhard
11. 11.Password reset did not stop the attackercloud-identity, incident-responsehard
12. 12.Phishing that bypasses MFAidentity-security, phishing-analysishard
13. 13.Why the JNDI rule missed attacksdetection-engineering, log-analysishard
14. 14.DNS logs went quietnetwork-security, log-analysishard
15. 15.Why JA4 replaced JA3network-security, threat-huntinghard
16. 16.An impossible timelineincident-response, log-analysishard
17. 17.A living-off-the-land downloadmitre-attack, edr, alert-triagehard
18. 18.Trusting a green ATT&CK heatmapmitre-attack, detection-engineeringhard
19. 19.Exfiltration before encryptionincident-response, ransomware-defensehard
20. 20.Reading an EPSS scorevulnerability-management, risk-managementhard
21. 21.Is this S3 bucket public?cloud-security, aws-iamhard
22. 22.Hidden escalation with PassRoleaws-iam, cloud-securityhard
23. 23.Successful sign-in with no MFAcloud-identity, identity-securityhard
24. 24.Detecting AS-REP roastingactive-directory-security, windows-event-logshard
25. 25.Hardening against NTLM relayactive-directory-security, network-securityhard
26. 26.Suspicious access to LSASSsysmon, edr, mitre-attackhard
27. 27.When a trusted update is maliciousthreat-hunting, detection-engineeringhard
28. 28.Why honeytokens are high fidelitydetection-engineering, deceptionhard
29. 29.Web server spawning a shelledr, incident-responsehard
30. 30.Detecting timestompingdigital-forensicshard
31. 31.GDPR breach notification deadlinecompliance, incident-responsehard
32. 32.rundll32 with no argumentsedr, alert-triage, threat-huntinghard