312-39 Cyber Threats Iocs And Attack Methodology Practice Test 1 — 15 Questions

Question 1

During an investigation of an APT, you observe a process executing from C:\Users\Public\ and reaching out to a suspicious domain. Which TTP from the MITRE ATT&CK framework is primarily being demonstrated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

T1547: Boot or Logon Autostart Execution. Running binaries from non-standard user-writable directories is a common technique for persistence or execution within a compromised environment.

Answer

T1059: Command and Scripting Interpreter

Answer

T1105: Ingress Tool Transfer

Answer

T1204: User Execution

Question 2

In a Windows environment, which artifact would provide the best evidence of 'Lateral Movement' using Pass-the-Hash?

Accepted Answer

Security Event ID 4624 (Logon Type 9). Pass-the-Hash relies on NTLM authentication, making Security Event ID 4624 (type 9) the most reliable indicator.

Answer

Registry key creation in RunOnce

Answer

Prefetch file modification

Answer

DNS query logs

Question 3

During an incident response, a SOC analyst observes that a compromised host is periodically resolving a domain that was registered three days ago and has no reputation data. The domain resolves to an IP address that also hosts a legitimate content delivery network (CDN) service. Which technique is the attacker most likely using to evade detection?

Accepted Answer

Domain fronting by leveraging the CDN's TLS SNI and HTTP Host header mismatch. Domain fronting allows an attacker to hide the true destination behind a CDN by using a legitimate domain in the TLS SNI while the HTTP Host header specifies the attacker's domain. The new domain resolving to a CDN IP that also hosts legitimate services is a strong indicator of this technique, as it blends malicious traffic with benign CDN traffic.

Answer

Fast flux by rapidly changing the domain's A records across many IP addresses

Answer

DNS tunneling by encoding command-and-control data in DNS query names

Answer

Use of a domain generation algorithm (DGA) to create many pseudorandom domains

Question 4

During an investigation, an analyst finds that a user's Outlook client spawned a child process of powershell.exe with an encoded command line, and the parent process no longer exists. Which attack technique does this behavior most directly indicate?

Accepted Answer

Spearphishing link exploiting a client-side vulnerability. Outlook directly generating a PowerShell child process with an encoded command is characteristic of a client-side exploit delivered through a phishing link or crafted message, where code execution occurs inside the mail client and then hands off to a scripting interpreter. Macro-based delivery would show an Office application as the parent, and credential dumping or scheduled-task persistence would leave different process and artifact traces.

Answer

Credential dumping from the LSASS process memory

Answer

Scheduled task created for persistence

Answer

Spearphishing attachment delivering a malicious macro

Question 5

A threat hunter notices that on several endpoints, a signed Microsoft binary located in System32 spawned a child process that wrote a file to a user's Startup folder and then exited. The parent process path is legitimate, and the file's signature is valid. Which technique does this most likely represent, and what is the key artifact for confirming it?

Accepted Answer

Signed binary proxy execution, confirmed by correlating the parent process command line with the child process's file creation event. A trusted, signed System32 binary launching a child process that drops a file into a Startup folder fits signed binary proxy execution. The confirming artifact is the linkage between the parent's command line and the child's file creation event, which ties the trusted binary to the persistence action. Other techniques do not match the observed file-write behavior.

Answer

Masquerading via renamed binary, confirmed by comparing the file's hash against a known-good baseline

Answer

Scheduled task creation, confirmed by inspecting the Task Scheduler operational log for task registration events

Answer

Process injection, confirmed by examining the parent process's memory for unbacked executable regions

Question 6

A SOC analyst is investigating a suspected phishing campaign. Which TWO of the following artifacts are most indicative of a malicious document exploiting a client-side vulnerability? (Choose two.)

Accepted Answer

A Windows Event Log entry showing winword.exe spawning cmd.exe. The two artifacts that directly indicate a malicious document exploiting a client-side vulnerability are a Word document with a macro executing PowerShell and a process creation event showing winword.exe spawning cmd.exe. Both demonstrate code execution resulting from opening a document. The other options represent delivery methods or post-exploitation activity, not the exploitation of a document vulnerability itself.

Answer

An email attachment with a double extension, such as invoice.pdf.exe

Answer

An email with a link to a legitimate cloud storage service hosting a PDF

Answer

A firewall log showing an outbound connection to a known malicious IP on port 4444

Question 7

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

Accepted Answer

Frequency analysis on connection flow metadata. A beaconing pattern with a consistent 30-second interval and 5% jitter is best detected through frequency analysis on connection flow metadata, since the regularity of the timing is the defining characteristic. Analyzing flow records (NetFlow, Zeek conn.log) for periodic connections to the same destination reveals the beacon regardless of payload encryption. This approach detects the behavior rather than relying on known signatures or IPs.

Answer

Port-based blocking

Answer

Signature-based IDS alert

Answer

Static IP blocklisting

Question 8

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

Accepted Answer

A compromised host attempting to reach a C2. A sinkhole IP is a controlled address that security teams or law enforcement redirect malicious traffic to, typically to neutralize botnet C2 communications. When an internal host repeatedly attempts to contact a known sinkhole IP, it strongly indicates the host is infected with malware that is trying to reach its command-and-control server. This is a classic indicator of compromise (IoC) for a C2 channel.

Answer

An attempted DDoS attack

Answer

A network misconfiguration

Answer

A successful data exfiltration

Question 9

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

Accepted Answer

Unauthorized access attempt. Multiple failed login attempts followed by a successful login from an unknown IP is a textbook indicator of unauthorized access — specifically a brute-force or password-spraying attack that eventually succeeded. This pattern is categorized as an unauthorized access attempt IoC because it shows an attacker gained access without authorization. The sequence of failures then success is the key signature.

Answer

Data exfiltration indicator

Answer

Network anomaly signature

Answer

System resource exhaustion

Question 10

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

Accepted Answer

powershell.exe -enc JABz.... Living off the Land (LotL) techniques use legitimate, pre-installed system tools to carry out attacks, avoiding the need to drop custom malware. 'powershell.exe -enc JABz...' is a classic LotL indicator: it uses the built-in PowerShell interpreter with a Base64-encoded command (-enc) to obfuscate malicious activity. This allows attackers to execute code without introducing foreign binaries.

Answer

malware.exe

Answer

mimikatz.exe

Answer

netcat.exe

Question 11

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

Accepted Answer

Isolate the host from the network. The presence of svchost.exe running from a temp folder is a classic indicator of a process masquerading attack, where malware names itself after a legitimate Windows process to evade detection. The most immediate action is to isolate the host from the network to prevent lateral movement, data exfiltration, or command-and-control communication. Containment must precede any remediation or investigation to avoid tipping off the attacker or allowing further damage.

Answer

Delete the file

Answer

Update antivirus signatures

Answer

Restart the server

Question 12

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

Accepted Answer

Scanning for open ports and services. The Reconnaissance phase of the Cyber Kill Chain (Lockheed Martin's seven-phase model) is the first stage, where the adversary gathers information about the target before launching an attack. Scanning for open ports and services is a classic active reconnaissance technique (e.g., using nmap or masscan) that maps the attack surface and identifies exploitable services. This aligns with the phase's goal of intelligence gathering to inform later weaponization and delivery stages.

Answer

Deploying a remote access trojan

Answer

Exploiting a software vulnerability

Answer

Encrypting data for ransom

Question 13

Which of the following is considered a 'Network-based' IoC?

Accepted Answer

Suspicious domain name. A suspicious domain name is a network-based indicator of compromise because it appears in DNS queries, HTTP/TLS SNI, or proxy logs — artifacts observable on the network. Network IoCs include IPs, domains, URLs, and JA3 hashes.

Answer

Mutex name

Answer

Registry key path

Answer

File hash (SHA-256)

Question 14

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

Accepted Answer

excel.exe. When a user opens an Excel document with a malicious macro, Excel.exe executes the VBA, and any spawned payload (e.g., PowerShell, cmd, or a dropped executable) is a child process of excel.exe. Thus excel.exe is the parent process in the process tree.

Answer

explorer.exe

Answer

wininit.exe

Answer

svchost.exe

Question 15

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

Accepted Answer

Browser Hijacking. Browser hijacking is the class of attack where malicious code or an unwanted extension modifies browser settings — homepage, default search engine, new-tab page, or redirects — without the user's consent. The scenario (changed homepage plus a new unsigned extension) is the textbook signature of browser hijacking. The unsigned extension is the delivery/persistence mechanism, and the homepage change is the observable symptom.

Answer

Man-in-the-Middle (MitM)

Answer

Cross-Site Scripting (XSS)

Answer

SQL Injection