312-85 Cyber Threats And Attack Frameworks — 20 Questions

Question 1

In the Diamond Model, the 'Technology' axis (often associated with the Capability-Infrastructure edge) is used to track what specifically?

Accepted Answer

The software/tools facilitating the link between Capability and Infrastructure. It tracks the technical dependencies and tools that enable the relationship between the adversary's capability and the infrastructure they employ.

Answer

The organizational structure of the security team

Answer

The victim's hardware specifications

Answer

The budget of the threat actor

Question 2

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

Accepted Answer

Weaponization. The Weaponization phase is where the adversary creates the malicious payload or tool, such as a custom Trojan, to exploit the target.

Answer

Exploitation

Answer

Delivery

Answer

Installation

Question 3

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

Accepted Answer

Registry key modification. A Registry key modification is a change made directly to the infected host system, making it a host-based indicator.

Answer

User-Agent string in HTTP header

Answer

Domain name for C2 beaconing

Answer

Source IP address in firewall logs

Question 4

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

Accepted Answer

Data Exfiltration. This is the final phase where the adversary achieves their ultimate goal, such as data exfiltration or system destruction.

Answer

Reconnaissance of the target

Answer

Establishing a backdoor

Answer

Sending phishing emails

Question 5

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

Accepted Answer

Infrastructure. In the Diamond Model, Infrastructure represents the physical and logical communication paths and services, such as IPs and domains, used by the adversary.

Answer

Capability

Answer

Adversary

Answer

Victim

Question 6

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

Accepted Answer

Monitor for anomalous process execution patterns. Because they use legitimate tools, you must focus on behavioral detection (Tactic-Technique-Procedure analysis) rather than signature-based file detection.

Answer

Scan for known malware signatures

Answer

Update firewall rules for all known ports

Answer

Focus on file hash blacklisting

Question 7

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

Accepted Answer

Defense Evasion. Process Hollowing is a form of Defense Evasion, as it allows malicious code to hide inside a legitimate process.

Answer

Lateral Movement

Answer

Credential Access

Answer

Persistence

Question 8

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

Accepted Answer

T1018. T1087 (Account Discovery) or specifically T1018 (Remote System Discovery) are used for reconnaissance; 'net view' is specifically linked to Remote System Discovery.

Answer

T1071

Answer

T1059

Answer

T1027

Question 9

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

Accepted Answer

Execution. While PowerShell can be used for execution, the act of running the script to download the payload is categorized under Execution. The Tactic is the 'why' of the action, and Execution covers running malicious code.

Answer

Discovery

Answer

Persistence

Answer

Command and Control

Question 10

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Accepted Answer

Endpoint Detection and Response (EDR). The Installation phase involves the malware establishing a persistent foothold on the host, which is best detected by host-based security tools like EDR.

Answer

DNS sinkholing

Answer

Email gateway filtering

Answer

Social engineering training

Question 11

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

Accepted Answer

Delivery. Social engineering and phishing attacks occur during the Delivery phase, which is best addressed by human-centric training.

Answer

Weaponization

Answer

Installation

Answer

Actions on Objectives

Question 12

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Accepted Answer

T1572: Protocol Tunneling. This is T1572 (Protocol Tunneling) or T1071.001 (Web Protocols), where the adversary leverages existing network protocols or channels to mask C2 traffic.

Answer

T1204: User Execution

Answer

T1133: External Remote Services

Answer

T1053: Scheduled Task

Question 13

Which of the following best describes an Advanced Persistent Threat (APT)?

Accepted Answer

Sophisticated, long-term, targeted attacks. APTs are characterized by their long-term, targeted, and sophisticated nature, often backed by nation-states.

Answer

Automated script kiddies

Answer

Uncoordinated network scanning

Answer

Short-term ransomware campaigns

Question 14

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Accepted Answer

Command and Control. Beaconing is a primary method for establishing and maintaining Command and Control.

Answer

Exfiltration

Answer

Privilege Escalation

Answer

Collection

Question 15

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

Accepted Answer

A command-line execution sequence. IOCs are static (hashes, IPs), whereas IOAs describe patterns of activity (behavior) that indicate an attack is in progress.

Answer

A known malicious file hash

Answer

A specific registry key for malware persistence

Answer

A blacklisted IP address

Question 16

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Accepted Answer

Pivot to identify the Capability or Adversary. After identifying infrastructure, the next step is to pivot to identify the associated Capability or Adversary, creating a chain of evidence.

Answer

Update the firewall blacklist only

Answer

Change all user passwords

Answer

Close the incident ticket

Question 17

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Accepted Answer

SHA-256 File Hash. IOCs are typically digital forensic artifacts like file hashes or network connection logs.

Answer

Server rack temperature

Answer

Employee behavior patterns

Answer

Project management timeline

Question 18

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Accepted Answer

T1547.001: Registry Run Keys. Modifying Run keys is a standard method for achieving persistence on Windows systems, mapped to T1547.001.

Answer

T1003: OS Credential Dumping

Answer

T1059.001: PowerShell

Answer

T1021: Remote Services

Question 19

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

Accepted Answer

Capability. The four core vertices of the Diamond Model are Adversary, Capability, Infrastructure, and Victim.

Answer

Network Topology

Answer

Payload

Question 20

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Accepted Answer

Reconnaissance. Network security controls (firewalls, IDS/IPS, proxies) are most effective at the stages involving external communication and delivery.

Answer

Installation

Answer

Actions on Objectives