SecurityX Threat Detection & Response Quiz

1. Which detection method compares observed activity against known attack signatures?

Anomaly detection

Signature-based detection

Behavior-based detection

Heuristic detection

2. True or False: Threat modeling should be performed before system deployment to identify vulnerabilities early.

True

False

3. Which type of attack involves an adversary inserting malicious code into legitimate software?

Man-in-the-middle

Supply chain attack

DDoS attack

Phishing attack

Submit

5. Which framework provides guidance for incident response planning and execution?

NIST Cybersecurity Framework

ISO 27001

CIS Controls

SANS Incident Handling

6. True or False: A false positive in security detection occurs when a legitimate activity is flagged as malicious.

True

False

7. Which log source provides the most detailed information about user authentication failures?

Firewall logs

Application logs

Active Directory logs

DNS logs

Submit

9. Which response action is typically performed first during incident handling?

Eradication

Detection and analysis

Recovery

Post-incident review

10. True or False: Threat intelligence sharing between organizations reduces detection time.

True

False

11. Which detection method uses statistical analysis to identify deviations from normal network behavior?

Signature-based detection

Anomaly-based detection

Policy-based detection

Heuristic-based detection

Submit

13. What is the primary purpose of a Security Orchestration, Automation, and Response (SOAR) platform?

Encrypt sensitive data

Automate incident response workflows

Patch operating systems

Monitor physical security

14. True or False: Behavioral analysis is more effective than signature-based detection for detecting zero-day exploits.

True

False

15. Which MITRE ATT&CK matrix phase describes adversary attempts to establish persistence?

Initial Access

Persistence

Discovery

Exfiltration

Submit

17. Which indicator of compromise (IoC) type includes IP addresses known to host malware?

File hash

Email address

Malicious IP

Registry key

18. True or False: Zero-trust architecture assumes all network traffic is inherently trustworthy.

True

False

19. Which of the following best describes a Security Information and Event Management (SIEM) system?

Firewall that blocks malicious traffic

Centralized platform for log aggregation, correlation, and analysis

Vulnerability scanner for identifying weaknesses

Intrusion prevention system that blocks attacks

Submit

SecurityX Threat Detection and Response Coordination Quiz

1. Which detection method compares observed activity against known attack signatures?

2.

What first name or nickname would you like us to use?

2. True or False: Threat modeling should be performed before system deployment to identify vulnerabilities early.

3. Which type of attack involves an adversary inserting malicious code into legitimate software?

4. Endpoint Detection and Response (EDR) solutions focus on monitoring ____.

5. Which framework provides guidance for incident response planning and execution?

6. True or False: A false positive in security detection occurs when a legitimate activity is flagged as malicious.

7. Which log source provides the most detailed information about user authentication failures?

8. A network-based intrusion detection system (NIDS) monitors ____.

9. Which response action is typically performed first during incident handling?

10. True or False: Threat intelligence sharing between organizations reduces detection time.

11. Which detection method uses statistical analysis to identify deviations from normal network behavior?

12. In forensic analysis, chain of custody is maintained to ensure ____.

13. What is the primary purpose of a Security Orchestration, Automation, and Response (SOAR) platform?

14. True or False: Behavioral analysis is more effective than signature-based detection for detecting zero-day exploits.

15. Which MITRE ATT&CK matrix phase describes adversary attempts to establish persistence?

16. During threat hunting, analysts examine logs to discover ____.

17. Which indicator of compromise (IoC) type includes IP addresses known to host malware?

18. True or False: Zero-trust architecture assumes all network traffic is inherently trustworthy.

19. Which of the following best describes a Security Information and Event Management (SIEM) system?

20. In incident response, the containment phase primarily aims to ____.