SANS 515 EXAM QUESTIONS COMPLETE
WITH 100% VERIFIED ANSWERS
Active Defense and the Sliding Scale
1. A defender continuously searches the enterprise for signs of an adversary instead of waiting
for an alert.
A) Active Defense
B) Architecture
C) Offense
D) Passive Defense
Correct Answer: A) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
2. A security team performs threat hunting using hypotheses about adversary behavior inside
its network.
A) Strategic Intelligence
B) Passive Defense
C) Active Defense
D) Architecture
Correct Answer: C) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
3. A response team isolates a compromised endpoint after confirming malicious activity.
A) Architecture
B) ActiveDefense
C) Passive Defense
D) Dissemination
Correct Answer: B) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
4. A defender investigates suspicious lateral movement and adapts controls based on what is
learned.
A) Collection
B) Passive Defense
C) Strategic Intelligence
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
SANS 515 — 350 Practice Exam Questions Page 1
, 5. A security operation is centered on human-led monitoring, response, and learning from
adversaries.
A) Active Defense
B) Passive Defense
C) Planning and Direction
D) Architecture
Correct Answer: A) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
6. A team uses threat hunting to look for an attacker who has evaded automated controls.
A) Architecture
B) ActiveDefense
C) Passive Defense
D) Dissemination
Correct Answer: B) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
7. A defender takes action against an adversary within the defender's own environment.
A) Strategic Intelligence
B) Offense
C) Active Defense
D) Architecture
Correct Answer: C) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
8. A SOC analyst moves from detection to containment after identifying a malicious process.
A) Architecture
B) Passive Defense
C) Active Defense
D) Collection
Correct Answer: C) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
9. Which Sliding Scale category most directly emphasizes human-led response to adversary
activity?
A) Passive Defense
B) Active Defense
C) Intelligence
D) Architecture
Correct Answer: B) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
10. Which category is best represented by threat hunting?
A) Active Defense
SANS 515 — 350 Practice Exam Questions Page 2
, B) Offense
C) Architecture
D) Passive Defense
Correct Answer: A) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
11. A blue team proactively searches for an attacker using a behavioral hypothesis. Which
category fits best?
A) Architecture
B) Passive Defense
C) Offense
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
12. A defender responds to evidence of an intruder already operating inside the network. Which
category applies?
A) Architecture
B) Passive Defense
C) Offense
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
13. A team learns from an adversary's activity and uses that knowledge to improve its
response. Which category is most appropriate?
A) Offense
B) Active Defense
C) Passive Defense
D) Architecture
Correct Answer: B) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
14. Which activity most clearly distinguishes Active Defense from merely building a defensive
architecture?
A) Offense
B) Passive Defense
C) Architecture
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
15. A hunt team examines endpoint telemetry for traces of an attacker that automated detection
missed. This is best classified as:
A) Architecture
SANS 515 — 350 Practice Exam Questions Page 3
, B) ActiveDefense
C) Offense
D) Passive Defense
Correct Answer: B) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
16. Which Sliding Scale category is most closely associated with threat hunting and incident
response?
A) Offense
B) Architecture
C) Passive Defense
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
17. A defender monitors for adversary behavior, investigates it, and takes containment action.
The dominant category is:
A) Offense
B) Active Defense
C) Passive Defense
D) Architecture
Correct Answer: B) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
18. A security team actively searches its own network for an adversary rather than simply
waiting for alarms. This represents:
A) Offense
B) Active Defense
C) Architecture
D) Passive Defense
Correct Answer: B) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
19. Which category involves learning from an adversary after observing its activity?
A) Active Defense
B) Architecture
C) Passive Defense
D) Offense
Correct Answer: A) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
20. Which category is the clearest fit when defenders maneuver against an attacker within their
own territory?
A) Architecture
SANS 515 — 350 Practice Exam Questions Page 4
WITH 100% VERIFIED ANSWERS
Active Defense and the Sliding Scale
1. A defender continuously searches the enterprise for signs of an adversary instead of waiting
for an alert.
A) Active Defense
B) Architecture
C) Offense
D) Passive Defense
Correct Answer: A) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
2. A security team performs threat hunting using hypotheses about adversary behavior inside
its network.
A) Strategic Intelligence
B) Passive Defense
C) Active Defense
D) Architecture
Correct Answer: C) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
3. A response team isolates a compromised endpoint after confirming malicious activity.
A) Architecture
B) ActiveDefense
C) Passive Defense
D) Dissemination
Correct Answer: B) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
4. A defender investigates suspicious lateral movement and adapts controls based on what is
learned.
A) Collection
B) Passive Defense
C) Strategic Intelligence
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
SANS 515 — 350 Practice Exam Questions Page 1
, 5. A security operation is centered on human-led monitoring, response, and learning from
adversaries.
A) Active Defense
B) Passive Defense
C) Planning and Direction
D) Architecture
Correct Answer: A) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
6. A team uses threat hunting to look for an attacker who has evaded automated controls.
A) Architecture
B) ActiveDefense
C) Passive Defense
D) Dissemination
Correct Answer: B) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
7. A defender takes action against an adversary within the defender's own environment.
A) Strategic Intelligence
B) Offense
C) Active Defense
D) Architecture
Correct Answer: C) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
8. A SOC analyst moves from detection to containment after identifying a malicious process.
A) Architecture
B) Passive Defense
C) Active Defense
D) Collection
Correct Answer: C) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
9. Which Sliding Scale category most directly emphasizes human-led response to adversary
activity?
A) Passive Defense
B) Active Defense
C) Intelligence
D) Architecture
Correct Answer: B) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
10. Which category is best represented by threat hunting?
A) Active Defense
SANS 515 — 350 Practice Exam Questions Page 2
, B) Offense
C) Architecture
D) Passive Defense
Correct Answer: A) Active Defense
Rationale: The best answer is Active Defense. In the supplied SANS 515 material, this activity is
associated with Active Defense, which emphasizes the relevant defensive function.
11. A blue team proactively searches for an attacker using a behavioral hypothesis. Which
category fits best?
A) Architecture
B) Passive Defense
C) Offense
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
12. A defender responds to evidence of an intruder already operating inside the network. Which
category applies?
A) Architecture
B) Passive Defense
C) Offense
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
13. A team learns from an adversary's activity and uses that knowledge to improve its
response. Which category is most appropriate?
A) Offense
B) Active Defense
C) Passive Defense
D) Architecture
Correct Answer: B) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
14. Which activity most clearly distinguishes Active Defense from merely building a defensive
architecture?
A) Offense
B) Passive Defense
C) Architecture
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
15. A hunt team examines endpoint telemetry for traces of an attacker that automated detection
missed. This is best classified as:
A) Architecture
SANS 515 — 350 Practice Exam Questions Page 3
, B) ActiveDefense
C) Offense
D) Passive Defense
Correct Answer: B) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
16. Which Sliding Scale category is most closely associated with threat hunting and incident
response?
A) Offense
B) Architecture
C) Passive Defense
D) Active Defense
Correct Answer: D) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
17. A defender monitors for adversary behavior, investigates it, and takes containment action.
The dominant category is:
A) Offense
B) Active Defense
C) Passive Defense
D) Architecture
Correct Answer: B) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
18. A security team actively searches its own network for an adversary rather than simply
waiting for alarms. This represents:
A) Offense
B) Active Defense
C) Architecture
D) Passive Defense
Correct Answer: B) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
19. Which category involves learning from an adversary after observing its activity?
A) Active Defense
B) Architecture
C) Passive Defense
D) Offense
Correct Answer: A) Active Defense
Rationale: The scenario describes proactive monitoring, hunting, response, or learning within the
defender's environment, which is the defining idea of Active Defense in the supplied material.
20. Which category is the clearest fit when defenders maneuver against an attacker within their
own territory?
A) Architecture
SANS 515 — 350 Practice Exam Questions Page 4
