1. Question 1 — Main objective of APT attackers

• ❌ Prioritize target segments

• ❌ Troubleshoot network issues

• ✅ Move laterally within a network undetected and escalate privileges

• ❌ Uncover network structure

Explanation:
APTs focus on long-term, stealthy access to steal data by moving laterally.

---

2. Question 2 — Purpose of packet sniffing

• ❌ Inject harmful code

• ❌ Disrupt network

• ❌ Protect networks

• ✅ Analyze data packets and diagnose network issues

Explanation:
Packet sniffers capture and analyze network traffic.

---

3. Question 3 — Pop-ups & redirects on employees’ machines

• ❌ Egress filtering

• ❌ DDoS

• ❌ MITM

• ✅ Botnet infiltration

Explanation:
Bots often cause hijacked browser behavior such as redirects and pop-ups.

---

4. Question 4 — Unusual text appearing in form fields

• ❌ XSS

• ❌ Integrity violation

• ❌ SQL injection

• ✅ Authorization loss?
  Actually correct:

• ❌ Authorization loss

• ❌ SQL injection

• ❌ Integrity violation

• ✅ Cross-site scripting (XSS) attack

Explanation:
Unexpected characters appearing in a text field often indicate reflected or stored XSS injection.

---

5. Question 5 — Employees using personal email for work

• ✅ Deterrent controls

• ❌ Corrective controls

• ❌ Physical controls

• ❌ Detective controls

Explanation:
Deterrent controls (policies, warnings, mandatory training, penalties) discourage undesirable behavior.

---

6. Question 6 — Why encryption ensures confidentiality

• ✅ Converts information into code obscuring original content

• ❌ First line defense against malware

• ❌ Fixes bugs

• ❌ Inspects packets

---

7. Question 7 — Why combine SIEM + SOAR

• ❌ Just streamline operations

• ❌ Prioritize alerts

• ❌ Increase complexity

• ✅ Automate the identification of sophisticated threats

Explanation:
SIEM correlates logs; SOAR automates response → together they improve threat detection & reaction.

---

8. Question 8 — Why input validation matters

• ❌ Reduces processing time

• ❌ Handles errors

• ❌ Debugging

• ✅ Prevents attackers from injecting malicious code into the application

---

9. Question 9 — Technique that inspects code without running it

• ❌ OpenVAS

• ✅ Static application security testing (SAST)

• ❌ IAST

• ❌ DAST

---

10. Question 10 — Digital forensics role in IR detection & analysis

• ❌ Initiate legal proceedings

• ❌ Post-incident review

• ❌ Document actions

• ✅ Collect and analyze digital evidence

---

🧾 Summary Table

---