Cyber Threats And Attack Frameworks

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Which of the following best describes an Advanced Persistent Threat (APT)?

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Which TWO of the following actions are considered 'Defense Evasion' techniques?

Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?

Which TWO items are part of the 'Adversary' vertex in the Diamond Model?

Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?