Medium Cybersecurity Analyst questions
34 questions · 10 points each for a correct first answer.
- 1.Tactic vs technique in MITRE ATT&CKmitre-attack, threat-intelligencemedium
- 2.Which vulnerability do you patch first?vulnerability-management, risk-managementmedium
- 3.Failed logons followed by successsiem, alert-triage, windows-logsmedium
- 4.NIST incident response lifecycleincident-response, nistmedium
- 5.Why does a browser trust a certificate?pki, cryptographymedium
- 6.Suspicious process tree in EDRedr, phishing-analysis, alert-triagemedium
- 7.Spot the attack in a web loglog-analysis, owasp-top-10, web-securitymedium
- 8.Unusual DNS trafficnetwork-security, threat-detectionmedium
- 9.Reading the logon typewindows-event-logs, alert-triagemedium
- 10.Splunk query for failed logonssplunk, siem-queriesmedium
- 11.KQL for failed Entra sign-insmicrosoft-sentinel, kql, cloud-identitymedium
- 12.What DMARC p=none doesemail-security, phishing-analysismedium
- 13.Triage an impossible travel alertalert-triage, cloud-identitymedium
- 14.Stopping MFA fatigue attacksidentity-security, mfamedium
- 15.Read a Suricata rulesuricata, network-securitymedium
- 16.Spotting C2 beaconingthreat-hunting, zeek, network-securitymedium
- 17.Wireshark filter for HTTP POSTswireshark, network-fundamentalsmedium
- 18.Security log cleared on a serverwindows-event-logs, mitre-attackmedium
- 19.A suspicious scheduled taskwindows-event-logs, mitre-attack, alert-triagemedium
- 20.CloudTrail logging was stoppedcloud-security, aws-cloudtrailmedium
- 21.When you cannot patch yetvulnerability-management, risk-managementmedium
- 22.Spot the lookalike sender domainphishing-analysis, email-securitymedium
- 23.Why analysts defang URLsincident-reporting, threat-intelligencemedium
- 24.Containing a hijacked Microsoft 365 accountincident-response, cloud-identitymedium
- 25.Why write detections in Sigma?detection-engineering, sigmamedium
- 26.What this YARA rule matchesyara, malware-triagemedium
- 27.The Pyramid of Painthreat-intelligence, detection-engineeringmedium
- 28.Sharing threat intel at scalethreat-intelligence, mispmedium
- 29.What EDR host isolation doesedr, incident-responsemedium
- 30.What evidence to collect firstdigital-forensics, incident-responsemedium
- 31.Decoding -EncodedCommandcyberchef, malware-triagemedium
- 32.Credentialed vs unauthenticated scansvulnerability-management, nessusmedium
- 33.Odd queries in Zeek dns.logzeek, threat-hunting, network-securitymedium
- 34.File integrity alert on a web serverwazuh, incident-responsemedium