• Author / Uploaded
• Semir Seferovic

Citation preview

1. With which of the following utilities can you use Yara rules from APT reports?You have reached the max number of allowed answers YaraScanner Loki Yara Kaspersky Threat Scanner

2. Which services by Kaspersky Lab provide detailed information on hashes of malicious files, including URLs where the file was detected, and its activities in the system?You have reached the max number of allowed answers Threat Data Feeds Threat Lookup APT Reporting Security Assessment

3. To interact with Threat Intelligence Portal API, you can use:You have reached the max number of allowed answers Kaspersky CyberTrace cURL utility ktl_lookup script Any HTTP client

4. Which request types can you send using Threat Intelligence Portal API?You have reached the max number of allowed answers IP Domain URL Hash

CANCELRESETNEXT 5. Which category do Threat Data Feeds pertain to in the Adaptive Security model?

Predict Detect Prevent Respond

6. Which of the following scenarios would benefit most from using Threat Data Feeds? An organization wants to detect APT An organization wants to prevent security incidents An organization wants to detect targeted attacks An organization wants to have an additional protection layer against traditional attacks

7. Which security risks do Threat Data Feeds help to mitigate?You have reached the max number of allowed answers Guest notebooks that do not meet the internal security policy Local privilege escalation A server without antivirus protection Lateral movement Bring Your Own Device

8. Which data are used together with SIEM systems to detect an attack? Yara rules Antivirus signatures IoC Snort signatures

9. A few computers of ABC Inc. have become a part of a botnet. Which Threat Data Feeds can help IS officers to detect bots installed on the workstations and associate them with the botnet? Botnet C&C

Malicious hash feeds Mobile botnet feeds

10. You aim to reduce the load on the mail gateway and improve anti-spam protection. How can Threat Data Feeds help you? You can make the mail gateway block spamming IP addresses listed in the feeds You can make the mail gateway block any addresses that have rating 75 or more according to IP Reputation feeds You can make the mail gateway block addresses that pertain to the spam category according to IP Reputation feeds You can make the mail gateway block addresses that pertain to the spam category and have rating 75 or more according to IP Reputation feeds

11. Which of the following file categories CANNOT be included in Whitelisting Threat Data Feeds? Clean files Potentially dangerous (Riskware) Malicious files Files of undefined status All of the above groups may get in the feeds

12. In which format are Threat Data Feeds supplied? binary json stix csv openioc

13. How to receive Threat Data Feeds in OpenIoC format? Use the KL Feed Utility Threat Data Feeds are supplied in OpenIoC format by default

Use the kl_feed_filter utility Add the ?type=openioc parameter to the Threat Data Feeds URL in download_feeds.py

19. For which SIEM systems are customized distributions of Kaspersky CyberTrace available? RSA NetWitness Splunk MicroFocus ArcSight McAfee ESM IBM Security QRadar LogRhythm

20. How can Kaspersky CyberTrace receive events from external systems? Using RPC Using WMI Using SNMP support Using Syslog protocol

21. Which software must be installed in Linux-like operating systems for correct operation of Kaspersky CyberTrace? more gcc unzip Python 3.5

22. Which data feeds can be loaded to Kaspersky CyberTrace? Data feeds by Kaspersky Lab Data feeds by other vendors

Open-source threat intelligence (OSINT) feeds All of the above

23. The Feed Service component of Kaspersky CyberTrace: Compiles URL masks Receives events from sources Searches the events for indicators from the feeds Provides a management web interface over HTTPS

24. Which of the following can you use when creating normalization rules for incoming events in Kaspersky CyberTrace? Regular expressions Masks JavaScript None of the above

25. By default, Kaspersky CyberTrace web interface is accessible on port: 9999 9998 8080 443