Cyber Threats And Attack Frameworks

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Which of the following best describes an Advanced Persistent Threat (APT)?

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Which TWO of the following actions are considered 'Defense Evasion' techniques?

Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?

Which TWO items are part of the 'Adversary' vertex in the Diamond Model?

Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?

A threat intelligence analyst is building a report on an advanced persistent threat (APT) group that has been observed targeting a government contractor. The analyst wants to characterize the group's operational infrastructure using the Diamond Model of Intrusion Analysis. Which TWO of the following activities would the analyst classify as belonging to the Infrastructure axis? (Choose two.)

A security operations center analyst is mapping an intrusion to the MITRE ATT&CK framework. The analyst observes that after gaining initial access, the adversary used Windows Management Instrumentation (WMI) to remotely create processes on other hosts in the domain. Under which ATT&CK tactic does this activity fall?

A threat intelligence analyst is reviewing a report that describes an adversary's operational approach using a model that maps phases from reconnaissance through to achieving the final mission. The report specifically highlights that the adversary spent weeks performing open-source research on employees and technical infrastructure before any exploitation attempt. In the Lockheed Martin Cyber Kill Chain, which phase is being described?

A threat intelligence analyst is examining a malware sample that uses a domain generation algorithm (DGA) to create a large number of pseudo-random domain names. The malware queries these domains to locate its command-and-control (C2) server. Which of the following best describes the primary purpose of using a DGA in this context?

A threat intelligence team is analyzing an adversary's use of the Diamond Model to document an intrusion. The team wants to identify which elements constitute the 'Infrastructure' axis of the Diamond Model. (Choose two.)

A threat intelligence analyst is mapping adversary tactics to the MITRE ATT&CK framework. The analyst observes that an adversary is using scheduled tasks and Windows services to maintain persistence on compromised hosts. Which two ATT&CK techniques are being used? (Choose two.)

A security analyst is mapping adversary behavior to the MITRE ATT&CK framework. The analyst observes that the adversary is using the 'Spearphishing Attachment' technique. Under which ATT&CK tactic does this technique fall?

You are analyzing a threat actor that consistently registers look-alike domains resembling your organization's partners and sends spear-phishing emails from those domains to your finance team. According to the Diamond Model of Intrusion Analysis, how should the adversary's use of these domains be classified?

A threat intelligence analyst is investigating an incident where an adversary used a spear-phishing email with a link to a malicious website. The website exploited a browser vulnerability to download and execute a payload. According to the Diamond Model of Intrusion Analysis, which axis represents the malicious website?

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a novel technique to maintain persistence. The group modifies the Windows Registry to add a malicious DLL to the AppInit_DLLs key, which loads the DLL into every process that loads User32.dll. Which MITRE ATT&CK technique is this an example of?

A threat intelligence analyst is reviewing an incident where the adversary used a previously unseen malware family and a novel exploit. The analyst wants to map the adversary's behavior to the MITRE ATT&CK framework. Which of the following best describes the appropriate level of abstraction to use?

During an incident response engagement, a threat intelligence analyst observes that the adversary used a compromised employee's VPN credentials to access the corporate network, and then moved laterally to other systems using legitimate administrative tools. The analyst wants to map these actions to the MITRE ATT&CK framework. Which tactic best describes the initial use of valid VPN credentials?

A security analyst is reviewing threat intelligence reports and notices that an APT group frequently uses zero-day exploits and custom malware to target government agencies. The group maintains long-term access to victim networks and exfiltrates sensitive data over extended periods. Which characteristic best distinguishes this group as an Advanced Persistent Threat (APT)?

A security operations center (SOC) receives an alert about a workstation exhibiting unusual outbound traffic to a known malicious IP address. The analyst suspects the workstation is compromised and communicating with a command-and-control (C2) server. According to the Cyber Kill Chain, which phase does this activity represent?

You are conducting threat intelligence research on a newly discovered APT group. You have collected various data points. Which TWO of the following are considered Tactics, Techniques, and Procedures (TTPs) according to the MITRE ATT&CK framework? (Choose two.)

A threat intelligence analyst is tracking an adversary that has been observed using a unique, custom-built backdoor. The analyst wants to attribute the activity to a known threat group. According to the Diamond Model, which axis should the analyst focus on to link this activity to other events?

A threat intelligence analyst is studying a sophisticated APT group that has been observed using a previously unknown backdoor. The analyst wants to create a detection rule that focuses on the adversary's operational behavior rather than static indicators. Which of the following best describes the type of detection logic the analyst should prioritize?

A threat intelligence analyst is reviewing the Cyber Kill Chain phases for a recent intrusion. The analyst observes that the adversary successfully exploited a vulnerability in a public-facing web server to gain a foothold. Which phase of the Cyber Kill Chain does this activity represent?

An analyst is using the MITRE ATT&CK framework to categorize adversary behaviors observed during an incident. The analyst notes that the attacker used a scheduled task to maintain access and also encrypted files on a file share to disrupt operations. Which two ATT&CK tactics do these behaviors represent? (Choose two.)

A threat intelligence analyst is reviewing a report on a ransomware group that has targeted multiple hospitals. The report states the group uses the 'double extortion' model. Which of the following best describes this tactic?

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a technique called 'domain fronting' to evade detection. Which of the following best describes how domain fronting works?

A threat intelligence analyst is analyzing a cyber attack campaign and wants to apply the Diamond Model of Intrusion Analysis. The analyst has identified the victim and the infrastructure used by the attacker. Which TWO additional core features of the Diamond Model should the analyst identify to complete the model? (Choose two.)

A threat intelligence analyst is reviewing a report that describes an adversary using the 'Pyramid of Pain' model. The analyst wants to prioritize defensive actions based on the model. Which of the following indicators would cause the most pain to the adversary if blocked?

A threat intelligence analyst is assessing an adversary's use of the 'Kill Chain' model. The analyst notes that the adversary has successfully delivered a malicious payload to the target and is now establishing a command-and-control (C2) channel. Which phase of the Cyber Kill Chain does this activity represent?