300-220

300-220 practice questions, page 2 of 2, with answer review and explanations.

Question 6

Refer to the exhibit.An increase in company traffic is observed by the SOC team. After they investigate the spike, it is concluded that the increase is due to ongoing scanning activity. Further analysis reveals that an adversary used Nmap for OS fingerprinting.Which type of indicators used by the adversary sits highest on the Pyramid of Pain?

  1. UDPs
  2. network/host artifacts
  3. IP addresses
  4. port probes

Question 7

What is a limitation of automated dynamic malware analysis tools?

  1. They produce false positives and false negatives.
  2. They are time consuming when performed manually.
  3. Vulnerabilities in runtime environments cannot be found.
  4. All programming languages are not supported.

Question 8

What triggers unstructured threat hunting?

  1. indicators of attack
  2. indicators of compromise
  3. tactics, techniques, and procedures
  4. customized threat identification

Question 9

What is the classification of the pass-the-hash technique according to the MITRE ATT&CK framework?

  1. credential access
  2. lateral movement
  3. privilege escalation
  4. persistence