SANS FOR508 EXAM STUDY GUIDE |
(complete solutions) Exam| ASSURED
SUCCESS |GRADE A+!! |Questions & Answers
100% Verified 2027 latest update
Whack-a-mole - ANSWER -The organization blindly chases the attacker
throughout the network, making little overall progress.
What drives the immediate eradication/remediation call to arms? - ANSWER -
Fear of loosing data
data deemed as too valuable, risk too high.
Intelligence Development - ANSWER --Tools, techniques, and procedures
-Understanding adversary intent
-Malware gathering
-IOC Development
-Campaign identification
Containment/Active Defense - ANSWER --Prevent or slow additional access
during monitoring and collection phase
-Full-scale host/network monitoring
-Data decoy
-Bit mangling
Traffic shaping
-Adversary network segmentation "AVOID PLAYING YOUR HAND"
Where is the bulk of response time spent? - ANSWER -Containment/Intelligence
development phase
Indicator of Compromise (IOC) - ANSWER -A set of conditions or evidence that
indicates
a system may have been compromised.
The goal of containment - ANSWER -To degrade the capabilities of an adversary,
denying them the opportunity to achieve their goals.
, Moonlight Maze - ANSWER -One of the earliest nation-state attacks. responders
learned that anytime responders react too quickly to an intruder, the attackers will
have an equal response.
Remediation Event - ANSWER -A massive coordination of groups outside of the
IR team that enact a burst of network changes over a short period of time. Usually
occurs over a weekend when an organization can commit to purging an adversary
from its network.
A remediation event should: - ANSWER --Deny access to the environment
-Eliminate the ability for the adversary to react to the remediation
-Remove the presence of the adversary from the environment
-Degrade the ability of the adversary to return
Remediation consists of three steps: - ANSWER --Posture for remediation
-Execute remediation
-Implement and apply additional security controls
Visibility - ANSWER -With proper visibility, remediation can (and should) begin
on day ne of an incident. Visibility allows responders to initiate these actions much
earlier in the response cycle, actively countering threats as they are found.
Reactive Organization - ANSWER --Incident starts when notification comes in
-Call from government agency
-Vendor /threat information
-Security appliance alert
-'Five-alarm fire" response
Hunting Organization - ANSWER --Actively looking for incidents
-Known malware and variants
-Patterns of activity: evil versus normal
-Threat intelligence
-Security patrols
-Reduce adversary dwell time
Primary goal of incident hunting - ANSWER -Reduce the dwell time of attackers
What's a key component to building a hunt team? - ANSWER -Having a cyber
threat intelligence capability residing inside your security team and feeding
directly to the hunt team.
(complete solutions) Exam| ASSURED
SUCCESS |GRADE A+!! |Questions & Answers
100% Verified 2027 latest update
Whack-a-mole - ANSWER -The organization blindly chases the attacker
throughout the network, making little overall progress.
What drives the immediate eradication/remediation call to arms? - ANSWER -
Fear of loosing data
data deemed as too valuable, risk too high.
Intelligence Development - ANSWER --Tools, techniques, and procedures
-Understanding adversary intent
-Malware gathering
-IOC Development
-Campaign identification
Containment/Active Defense - ANSWER --Prevent or slow additional access
during monitoring and collection phase
-Full-scale host/network monitoring
-Data decoy
-Bit mangling
Traffic shaping
-Adversary network segmentation "AVOID PLAYING YOUR HAND"
Where is the bulk of response time spent? - ANSWER -Containment/Intelligence
development phase
Indicator of Compromise (IOC) - ANSWER -A set of conditions or evidence that
indicates
a system may have been compromised.
The goal of containment - ANSWER -To degrade the capabilities of an adversary,
denying them the opportunity to achieve their goals.
, Moonlight Maze - ANSWER -One of the earliest nation-state attacks. responders
learned that anytime responders react too quickly to an intruder, the attackers will
have an equal response.
Remediation Event - ANSWER -A massive coordination of groups outside of the
IR team that enact a burst of network changes over a short period of time. Usually
occurs over a weekend when an organization can commit to purging an adversary
from its network.
A remediation event should: - ANSWER --Deny access to the environment
-Eliminate the ability for the adversary to react to the remediation
-Remove the presence of the adversary from the environment
-Degrade the ability of the adversary to return
Remediation consists of three steps: - ANSWER --Posture for remediation
-Execute remediation
-Implement and apply additional security controls
Visibility - ANSWER -With proper visibility, remediation can (and should) begin
on day ne of an incident. Visibility allows responders to initiate these actions much
earlier in the response cycle, actively countering threats as they are found.
Reactive Organization - ANSWER --Incident starts when notification comes in
-Call from government agency
-Vendor /threat information
-Security appliance alert
-'Five-alarm fire" response
Hunting Organization - ANSWER --Actively looking for incidents
-Known malware and variants
-Patterns of activity: evil versus normal
-Threat intelligence
-Security patrols
-Reduce adversary dwell time
Primary goal of incident hunting - ANSWER -Reduce the dwell time of attackers
What's a key component to building a hunt team? - ANSWER -Having a cyber
threat intelligence capability residing inside your security team and feeding
directly to the hunt team.
