312-39 · Question #87
A newly hired SOC analyst at a fast-growing multinational organization must quickly assess the company's external exposure and identify potential security risks. Techniques considered include analyzin
The correct answer is D. Stack counting. Stack counting is less practical for large, diverse infrastructures because it is often a manual, piecemeal method of identifying and categorizing technology stacks across many assets. In complex multinationals, external exposure spans multiple domains, cloud tenants, third parti
Question
A newly hired SOC analyst at a fast-growing multinational organization must quickly assess the company’s external exposure and identify potential security risks. Techniques considered include analyzing publicly available information, scanning exposed services, reviewing DNS records, and gathering external intelligence. Due to the scale across subsidiaries, cloud environments, and third- party integrations, some methods may not scale well and may lead to delays or incomplete insights. Which technique is less practical for handling large or diverse data sets in this scenario?
Options
- ADNS lookup
- BWeb enumeration
- COSINT
- DStack counting
How the community answered
(45 responses)- A2% (1)
- B9% (4)
- C4% (2)
- D84% (38)
Explanation
Stack counting is less practical for large, diverse infrastructures because it is often a manual, piecemeal method of identifying and categorizing technology stacks across many assets. In complex multinationals, external exposure spans multiple domains, cloud tenants, third parties, and business units; a “stack counting” approach can become slow, incomplete, and quickly outdated without automation and authoritative asset inventories. DNS lookups can be automated at scale to map domains, subdomains, and records, making them practical for large environments. Web enumeration can also be scaled using automated scanners and discovery tooling (with appropriate authorization), though it may require careful rate limits and scoping. OSINT can scale through specialized tooling and feeds, though validation is necessary. Compared to these, stack counting is typically the least scalable approach because it relies heavily on manual inference and continuous revalidation. From a SOC standpoint, scalable exposure assessment depends on automated asset discovery, DNS and certificate transparency analysis, cloud inventory, and controlled scanning-methods that can cover breadth without relying on manual “counting stacks” across thousands of assets.
Topics
Community Discussion
No community discussion yet for this question.