CREST Practitioner Threat Intelligence Analyst Sample Questions:

1. Jim works as a security analyst in a large multinational company. Recently, a group of hackers penetrated into their organizational network and used a data staging technique to collect sensitive data. They collected all sorts of sensitive data about the employees and customers, business tactics of the organization, financial information, network infrastructure information and so on.
What should Jim do to detect the data staging before the hackers exfiltrate from the network?

A) Jim should identify the web shell running in the network by analyzing server access, error logs, suspicious strings indicating encoding, user agent strings, and so on.
B) Jim should identify the attack at an initial stage by checking the content of the user agent field.
C) Jim should monitor network traffic for malicious file transfers, file integrity monitoring, and event logs.
D) Jim should analyze malicious DNS requests, DNS payload, unspecified domains, and destination of DNS requests.

2. Tibson works as an incident responder for MNC based in Singapore. He is investigating a web application security incident recently faced by the company. The attack is performed on a MS SQL Server hosted by the company. In the detection and analysis phase, he used regular expressions to analyze and detect SQL meta-characters that led to SQL injection attack.
Identify the regular expression used by Tibson to detect SQL injection attack on MS SQL Server.

A) /exec(\s|\+)+(s|x)p\w+/ix
B) ((\.|%2E)(\.|%2E)(\/|%2F|\\|%5C))
C) ((\.\.\\)|(\.\.\/))
D) ((\%3C)|<)((\%2F)|\/)*(script)((\%3E)|>)

3. Alison, an analyst in an XYZ organization, wants to retrieve information about a company's website from the time of its inception as well as the removed information from the target website.
What should Alison do to get the information he needs.

A) Alison should run the Web Data Extractor tool to extract the required website information.
B) Alison should recover cached pages of the website from the Google search engine cache to extract the required website information.
C) Alison should use SmartWhois to extract the required website information.
D) Alison should use https://archive.org to extract the required website information.

4. James is working as an incident responder at CyberSol Inc. The management instructed James to investigate a cybersecurity incident that recently happened in the company. As a part of the investigation process, James started collecting volatile information from a system running on Windows operating system.
Which of the following commands helps James in determining all the executable files for running processes?

A) top
B) netstat -ab
C) doskey/history
D) cate A &. time ,/t

5. Mr. Bob, a threat analyst, is performing analysis of competing hypotheses (ACH). He has reached to a stage where he is required to apply his analysis skills effectively to reject as many hypotheses and select the best hypotheses from the identified bunch of hypotheses, and this is done with the help of listed evidence. Then, he prepares a matrix where all the screened hypotheses are placed on the top, and the listed evidence for the hypotheses are placed at the bottom.
What stage of ACH is Bob currently in?

A) Evidence
B) Refinement
C) Diagnostics
D) Inconsistency

Solutions: