312-39 Cyber Threats Iocs And Attack Methodology Practice Test 2 — 15 Questions

Question 1

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

Accepted Answer

Obtaining instructions from the threat actor. Option A is correct because the Command and Control (C2) phase is defined by the compromised host receiving tasking and instructions from the threat actor's C2 infrastructure, enabling the attacker to direct post-exploitation activity. Option C is correct because C2 specifically requires establishing and maintaining a persistent communication channel (often over HTTP/HTTPS, DNS, or other protocols) between the implant and the attacker-controlled server so commands and results can flow reliably. Option B is not a C2 goal; exploiting a zero-day vulnerability belongs to the initial exploitation phase that precedes C2. Option D is not a C2 goal; gathering system information is part of reconnaissance or discovery, which occurs before or alongside C2 but is not its defining objective. Option E is not a C2 goal; encrypting files for ransom is the impact/actions-on-objectives stage of ransomware, distinct from establishing command and control.

Answer

Exploiting a zero-day vulnerability

Answer

Gathering system information

Answer

Encrypting files for ransom

Question 2

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

Accepted Answer

Use of removable media or virtual volumes. Shimcache (AppCompatCache) records metadata about executables that were present on the system, including the volume path from which they executed. An entry referencing a volume that no longer exists (e.g., a drive letter or GUID not currently mounted) strongly suggests the executable ran from removable media (USB drive) or a virtual/mounted volume that has since been detached. This is a classic indicator of tool execution from external media.

Answer

Memory corruption

Answer

Log manipulation

Answer

System update failure

Question 3

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

Accepted Answer

Increased DNS request volume (DNS Tunneling). Option D is correct because DNS tunneling is a classic data exfiltration technique: malware encodes stolen data into DNS queries (often TXT, NULL, or CNAME records) sent to an attacker-controlled authoritative name server, so a sudden spike in DNS request volume—especially long or high-entropy subdomain labels—signals data being smuggled out through port 53. Option E is correct because exfiltration inherently requires outbound transfer, and a high volume of outbound traffic to an unfamiliar or foreign IP address (particularly over common ports like 80/443 or via protocols such as FTP/SMTP) indicates data being sent to an external command-and-control or collection server. Option A does not belong because multiple failed logins indicate a brute-force or password-guessing attempt (an access/authentication attack), not the transfer of data out of the environment. Option B does not belong because system clock synchronization errors point to NTP misconfiguration or time drift, which is a reliability/availability issue rather than evidence of data theft. Option C does not belong because installing new system drivers is a host configuration or persistence/rootkit-related change, not an indicator of outbound data exfiltration.

Answer

Multiple failed login attempts

Answer

System clock synchronization errors

Answer

Installation of new system drivers

Question 4

Which THREE of the following are characteristics of 'Advanced Persistent Threat' (APT) attack methodologies?

Accepted Answer

Custom-tailored malware and tools. Option A is correct because APT actors develop custom-tailored malware, exploits, and tooling specific to the target environment rather than relying solely on commodity or off-the-shelf malware, which helps them evade signature-based detection. Option B is correct because APTs are defined by a long-term commitment to a specific objective, often persisting for months or years while pursuing espionage, intellectual property theft, or strategic access rather than a one-off hit. Option C is correct because APTs emphasize a high degree of stealth and low-and-slow activity, using techniques like living-off-the-land binaries, long dwell times, and minimal footprint to avoid triggering alerts. Option D is not correct because automated mass-scale scanning is characteristic of opportunistic, untargeted attacks (e.g., worms or botnet scanning), not the deliberate, targeted reconnaissance of an APT. Option E is not correct because immediate data destruction is not a defining APT trait; APTs typically prioritize stealthy, prolonged access and exfiltration, and destructive actions (if any) usually come at the end of the campaign.

Answer

Automated mass-scale scanning

Answer

Immediate data destruction

Question 5

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

Accepted Answer

Windows Scheduled Tasks. Windows Scheduled Tasks (B) are a classic persistence artifact because an attacker can register a task that re-executes malware at logon, on a schedule, or at system startup, and defenders monitor task creation (e.g., Event ID 4698 and the \Windows\System32\Tasks folder) to detect it. Registry Run keys (D), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\...\Run, are monitored because any value placed there causes a program to launch automatically at user logon or system boot, a well-known autostart persistence location. System startup folder files (E), in paths like %AppData%\Microsoft\Windows\Start Menu\Programs\Startup and the all-users equivalent, are monitored because shortcuts or executables dropped there execute automatically at logon. Network interface throughput (A) is a performance/availability metric, not a persistence artifact, and browser history logs (C) reflect user web activity rather than mechanisms that ensure code re-executes after reboot or logon.

Answer

Network interface throughput

Answer

Browser history logs

Question 6

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

Accepted Answer

Newly created service name. Option C (Newly created service name) is a host-based IoC because a new service registered on an endpoint (visible via Windows Service Control Manager, systemd unit files, or registry keys like HKLM\SYSTEM\CurrentControlSet\Services) reflects local system state altered by malware persistence. Option D (MD5 hash of a malicious file) is host-based because the hash identifies a file artifact residing on the host's filesystem, detectable through file integrity monitoring or tools like md5sum and Get-FileHash. In contrast, A (SMTP server response codes) is a network/service-level indicator observed in mail traffic, B (Malicious URL visited) is a network indicator seen in proxy or DNS logs, and E (Source IP address of an attack) is a network indicator captured in firewall, IDS, or packet-capture data — none of which describe artifacts local to an individual host.

Answer

SMTP server response codes

Answer

Malicious URL visited

Answer

Source IP address of an attack

Question 7

A SOC analyst is reviewing EDR telemetry and observes that a user-level process named 'wscript.exe' spawned a child process 'powershell.exe' with the command line 'powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAA...'. The parent process had been launched from an email attachment. Which attack technique is most strongly indicated by this chain of events?

Accepted Answer

Spearphishing attachment delivering a malicious script that uses PowerShell to execute an encoded payload. The combination of an email attachment launching 'wscript.exe', which then spawns PowerShell with hidden window and encoded command, is a hallmark of a spearphishing attachment delivering a script-based payload. This chain indicates initial access via user execution of a malicious document or script, followed by PowerShell used to run an encoded payload.

Answer

Exploitation of a remote service vulnerability to gain initial access

Answer

Credential dumping from LSASS memory using a known tool

Answer

Use of a scheduled task for persistence and privilege escalation

Question 8

A SOC analyst is investigating a suspected malware outbreak and needs to identify host-based indicators of compromise (IoCs) that would support the hypothesis of a compromised endpoint. Which TWO of the following are host-based IoCs that should be prioritized for collection and analysis? (Choose two.)

Accepted Answer

Unusual registry Run key entries that launch a binary from a user's AppData folder. Host-based IoCs include artifacts found on the endpoint, such as registry modifications, suspicious files, and process behaviors. Registry Run keys launching binaries from AppData and double-extension files in user folders are both host-based and commonly associated with malware persistence and execution. The other options describe network-based observations.

Answer

A sudden increase in outbound DNS queries to a newly registered domain

Answer

A spike in SMTP traffic from an internal mail server to an external IP

Answer

Anomalous TLS certificate presented by an external server during a connection

Question 9

A SOC analyst receives an alert from the SIEM showing a workstation repeatedly querying an algorithmically generated set of domain names, most of which resolve to NXDOMAIN, with a handful resolving to short-lived IP addresses. The analyst wants to map this behavior to the most likely stage of the Cyber Kill Chain and the corresponding IOC category. Which of the following best describes this activity?

Accepted Answer

Command and Control (C2) using Domain Generation Algorithm (DGA) domains as network-based IoCs. Algorithmically generated domains with many NXDOMAIN responses and occasional short-lived resolutions indicate a host trying to find its C2 server, which is the Command and Control phase. Because the evidence is DNS traffic, it is a network-based IoC. The other choices misattribute the phase or the IoC category.

Answer

Weaponization using malicious macros as registry-based IoCs

Answer

Exfiltration using DNS tunneling as file-based IoCs

Answer

Reconnaissance using DNS zone transfer attempts as host-based IoCs

Question 10

A SOC analyst is reviewing DNS logs and observes a workstation issuing hundreds of unique subdomain queries under the domain telemetry-sync[.]net, each returning an NXDOMAIN response within seconds. No matching HTTP traffic appears in the proxy logs. Which attack technique is most consistent with this pattern?

Accepted Answer

Domain generation algorithm (DGA) activity. The combination of a high volume of unique subdomain queries, automated rapid timing, and mostly failed resolutions is the signature of domain generation algorithm activity, where malware cycles through algorithmically produced domains seeking a live command-and-control endpoint. DNS tunneling and exfiltration both require successful resolution and encoded payloads, and fast flux manipulates IP rotation rather than subdomain generation.

Answer

Fast flux DNS used to hide phishing infrastructure

Answer

DNS exfiltration of sensitive files

Answer

DNS tunneling used for command and control

Question 11

During triage of a suspected intrusion, a SOC analyst observes that a user account belonging to the finance department successfully authenticated from an IP address geolocated in a country where the company has no operations, at 03:00 local time. The account had no prior logins from that region. Which phase of the attack lifecycle does this most directly represent?

Accepted Answer

Initial Access via valid accounts. An out-of-geography, off-hours successful login to a legitimate account is a valid-accounts Initial Access event. The attacker has entered the environment using stolen credentials. The other phases require additional evidence such as privilege changes, internal pivoting, or data transfers that are not present in the described log.

Answer

Exfiltration over a command and control channel

Answer

Lateral Movement via remote services

Answer

Privilege Escalation via exploitation for privilege escalation

Question 12

A SOC analyst is reviewing DNS logs and sees a host repeatedly querying subdomains like 'a1b2c3d4e5.evil-domain.com' every 60 seconds, with each subdomain being a random 10-character string. The responses are consistently NXDOMAIN. Which attack technique is most likely indicated?

Accepted Answer

Domain Generation Algorithm (DGA) used by malware for C2. The combination of random subdomains under a single parent domain, periodic queries, and NXDOMAIN responses strongly indicates a Domain Generation Algorithm used by malware to locate C2 servers. DGA malware generates many domains and queries them until one resolves, producing exactly this log signature. Other DNS-based attacks like tunneling or fast flux would show different patterns such as data in queries or changing IPs.

Answer

Fast flux DNS used to hide a botnet's C2 infrastructure

Answer

DNS cache poisoning attack against the local resolver

Answer

DNS tunneling for data exfiltration

Question 13

A SOC analyst receives an alert about a workstation making an outbound connection to a known malicious IP address on port 443. The connection is encrypted and occurs every 5 minutes with small, consistent packet sizes. Which phase of the Cyber Kill Chain does this activity most directly represent?

Accepted Answer

Command and Control (C2). The periodic, encrypted, small-packet connections to a known malicious IP are hallmark signs of Command and Control beaconing. In the Cyber Kill Chain, C2 is the phase where compromised hosts communicate with attacker infrastructure to receive commands. This activity typically follows exploitation and installation, and precedes actions on objectives. The regularity and packet size distinguish it from data exfiltration or other phases.

Answer

Exploitation

Answer

Actions on Objectives

Answer

Weaponization

Question 14

During an incident response, a SOC analyst examines a Windows host and finds that the 'Image Path Name' for a service named 'UpdaterSvc' points to 'C:\Windows\Temp\svc.exe'. The service is set to start automatically and runs as LocalSystem. The file 'svc.exe' is unsigned and has a creation timestamp from yesterday. Which persistence technique is most likely in use?

Accepted Answer

New Windows service creation. The service configuration with an ImagePath to an unsigned binary in a Temp directory, set to auto-start as LocalSystem, is a strong indicator of persistence through Windows service creation. Attackers frequently create malicious services to maintain elevated access across reboots. This technique is detectable by monitoring the Services registry key and service creation events. Other persistence methods like Run keys or scheduled tasks would leave different artifacts.

Answer

Scheduled task with a hidden trigger

Answer

Windows Management Instrumentation (WMI) event subscription

Answer

Registry Run key

Question 15

A threat hunter observes that an internal host is sending periodic HTTPS beacons to a rare external IP address at consistent 60-second intervals, with identical packet sizes and no corresponding user browsing activity. The TLS certificate on the destination is self-signed and the JA3 fingerprint does not match any known browser. Which phase of the Cyber Kill Chain does this activity most directly represent?

Accepted Answer

Command and Control. Consistent interval beaconing to an uncommon external address, uniform packet sizes, and TLS traits that do not match a normal browser collectively identify the command-and-control phase, where an implanted agent maintains contact with attacker infrastructure. Weaponization and exploitation precede this and occur without such regular outbound patterns, while actions on objectives would manifest as observable impact rather than heartbeat traffic.

Answer

Exploitation

Answer

Weaponization

Answer

Actions on Objectives