312-85 Cyber Threats And Attack Frameworks — All Questions With Answers

Question 1mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

In the Diamond Model, the 'Technology' axis (often associated with the Capability-Infrastructure edge) is used to track what specifically?

Question 2mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing a report on an adversary group that has been observed using spear-phishing emails with malicious attachments to gain initial access. The report states that the group then uses credential dumping to escalate privileges and moves laterally using SMB. According to the Lockheed Martin Cyber Kill Chain, which phase does the use of credential dumping fall into?

Question 3mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

While reviewing an incident, a threat intelligence analyst maps the adversary's behavior and finds that the attacker leveraged a signed, legitimate remote monitoring and management (RMM) tool already present in the environment to execute commands and move laterally. Under the MITRE ATT&CK framework, which tactic does this activity primarily support?

Question 4easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

An analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. The analyst notes that the adversary used a specific spear-phishing email with a malicious attachment to gain initial access. Under the Diamond Model, which core feature does the spear-phishing email represent?

Question 5hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

Question 6mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

Question 7easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

Question 8mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

Question 9hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

Question 10mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

Question 11mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

Question 12mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

Question 13mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Question 14easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

Question 15hardmultiple choice

Read the full VPN explanation →

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Question 16easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

Which of the following best describes an Advanced Persistent Threat (APT)?

Question 17mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Question 18easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

Question 19hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Question 20mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Question 21mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Question 22hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

Question 23mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Question 24hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Question 25mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which TWO of the following actions are considered 'Defense Evasion' techniques?

Question 26hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?

Question 27mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which TWO items are part of the 'Adversary' vertex in the Diamond Model?

Question 28mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?

Question 29hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is building a report on an advanced persistent threat (APT) group that has been observed targeting a government contractor. The analyst wants to characterize the group's operational infrastructure using the Diamond Model of Intrusion Analysis. Which TWO of the following activities would the analyst classify as belonging to the Infrastructure axis? (Choose two.)

Question 30easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security operations center analyst is mapping an intrusion to the MITRE ATT&CK framework. The analyst observes that after gaining initial access, the adversary used Windows Management Instrumentation (WMI) to remotely create processes on other hosts in the domain. Under which ATT&CK tactic does this activity fall?

Question 31mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing a report that describes an adversary's operational approach using a model that maps phases from reconnaissance through to achieving the final mission. The report specifically highlights that the adversary spent weeks performing open-source research on employees and technical infrastructure before any exploitation attempt. In the Lockheed Martin Cyber Kill Chain, which phase is being described?

Question 32hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is examining a malware sample that uses a domain generation algorithm (DGA) to create a large number of pseudo-random domain names. The malware queries these domains to locate its command-and-control (C2) server. Which of the following best describes the primary purpose of using a DGA in this context?

Question 33hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence team is analyzing an adversary's use of the Diamond Model to document an intrusion. The team wants to identify which elements constitute the 'Infrastructure' axis of the Diamond Model. (Choose two.)

Question 34mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is mapping adversary tactics to the MITRE ATT&CK framework. The analyst observes that an adversary is using scheduled tasks and Windows services to maintain persistence on compromised hosts. Which two ATT&CK techniques are being used? (Choose two.)

Question 35easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security analyst is mapping adversary behavior to the MITRE ATT&CK framework. The analyst observes that the adversary is using the 'Spearphishing Attachment' technique. Under which ATT&CK tactic does this technique fall?

Question 36mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are analyzing a threat actor that consistently registers look-alike domains resembling your organization's partners and sends spear-phishing emails from those domains to your finance team. According to the Diamond Model of Intrusion Analysis, how should the adversary's use of these domains be classified?

Question 37hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is investigating an incident where an adversary used a spear-phishing email with a link to a malicious website. The website exploited a browser vulnerability to download and execute a payload. According to the Diamond Model of Intrusion Analysis, which axis represents the malicious website?

Question 38hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a novel technique to maintain persistence. The group modifies the Windows Registry to add a malicious DLL to the AppInit_DLLs key, which loads the DLL into every process that loads User32.dll. Which MITRE ATT&CK technique is this an example of?

Question 39hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing an incident where the adversary used a previously unseen malware family and a novel exploit. The analyst wants to map the adversary's behavior to the MITRE ATT&CK framework. Which of the following best describes the appropriate level of abstraction to use?

Question 40mediummultiple choice

Read the full VPN explanation →

During an incident response engagement, a threat intelligence analyst observes that the adversary used a compromised employee's VPN credentials to access the corporate network, and then moved laterally to other systems using legitimate administrative tools. The analyst wants to map these actions to the MITRE ATT&CK framework. Which tactic best describes the initial use of valid VPN credentials?

Question 41easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security analyst is reviewing threat intelligence reports and notices that an APT group frequently uses zero-day exploits and custom malware to target government agencies. The group maintains long-term access to victim networks and exfiltrates sensitive data over extended periods. Which characteristic best distinguishes this group as an Advanced Persistent Threat (APT)?

Question 42easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security operations center (SOC) receives an alert about a workstation exhibiting unusual outbound traffic to a known malicious IP address. The analyst suspects the workstation is compromised and communicating with a command-and-control (C2) server. According to the Cyber Kill Chain, which phase does this activity represent?

Question 43hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

You are conducting threat intelligence research on a newly discovered APT group. You have collected various data points. Which TWO of the following are considered Tactics, Techniques, and Procedures (TTPs) according to the MITRE ATT&CK framework? (Choose two.)

Question 44mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is tracking an adversary that has been observed using a unique, custom-built backdoor. The analyst wants to attribute the activity to a known threat group. According to the Diamond Model, which axis should the analyst focus on to link this activity to other events?

Question 45hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is studying a sophisticated APT group that has been observed using a previously unknown backdoor. The analyst wants to create a detection rule that focuses on the adversary's operational behavior rather than static indicators. Which of the following best describes the type of detection logic the analyst should prioritize?

Question 46mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing the Cyber Kill Chain phases for a recent intrusion. The analyst observes that the adversary successfully exploited a vulnerability in a public-facing web server to gain a foothold. Which phase of the Cyber Kill Chain does this activity represent?

Question 47mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

An analyst is using the MITRE ATT&CK framework to categorize adversary behaviors observed during an incident. The analyst notes that the attacker used a scheduled task to maintain access and also encrypted files on a file share to disrupt operations. Which two ATT&CK tactics do these behaviors represent? (Choose two.)

Question 48mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing a report on a ransomware group that has targeted multiple hospitals. The report states the group uses the 'double extortion' model. Which of the following best describes this tactic?

Question 49hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a technique called 'domain fronting' to evade detection. Which of the following best describes how domain fronting works?

Question 50mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is analyzing a cyber attack campaign and wants to apply the Diamond Model of Intrusion Analysis. The analyst has identified the victim and the infrastructure used by the attacker. Which TWO additional core features of the Diamond Model should the analyst identify to complete the model? (Choose two.)

Question 51easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing a report that describes an adversary using the 'Pyramid of Pain' model. The analyst wants to prioritize defensive actions based on the model. Which of the following indicators would cause the most pain to the adversary if blocked?

Question 52mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is assessing an adversary's use of the 'Kill Chain' model. The analyst notes that the adversary has successfully delivered a malicious payload to the target and is now establishing a command-and-control (C2) channel. Which phase of the Cyber Kill Chain does this activity represent?

Question 1mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

In the Diamond Model, the 'Technology' axis (often associated with the Capability-Infrastructure edge) is used to track what specifically?

Question 2mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing a report on an adversary group that has been observed using spear-phishing emails with malicious attachments to gain initial access. The report states that the group then uses credential dumping to escalate privileges and moves laterally using SMB. According to the Lockheed Martin Cyber Kill Chain, which phase does the use of credential dumping fall into?

Question 3mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

While reviewing an incident, a threat intelligence analyst maps the adversary's behavior and finds that the attacker leveraged a signed, legitimate remote monitoring and management (RMM) tool already present in the environment to execute commands and move laterally. Under the MITRE ATT&CK framework, which tactic does this activity primarily support?

Question 4easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

An analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. The analyst notes that the adversary used a specific spear-phishing email with a malicious attachment to gain initial access. Under the Diamond Model, which core feature does the spear-phishing email represent?

Question 5hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

Question 6mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

Question 7easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

Question 8mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

Question 9hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

Question 10mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

Question 11mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

Question 12mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

Question 13mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Question 14easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

Question 15hardmultiple choice

Read the full VPN explanation →

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Question 16easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

Which of the following best describes an Advanced Persistent Threat (APT)?

Question 17mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Question 18easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

Question 19hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Question 20mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Question 21mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

An adversary uses a custom script to modify 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. Which MITRE ATT&CK technique is this?

Question 22hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which THREE of the following are primary components (vertices) of the Diamond Model of Intrusion Analysis?

Question 23mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

When applying the Cyber Kill Chain to an organization, which THREE phases are most effectively defended by network-level security controls?

Question 24hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which THREE MITRE ATT&CK tactics are commonly involved in an adversary's effort to maintain a presence on a compromised system?

Question 25mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which TWO of the following actions are considered 'Defense Evasion' techniques?

Question 26hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which THREE criteria are essential when evaluating the quality of an IOC for threat intelligence sharing?

Question 27mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which TWO items are part of the 'Adversary' vertex in the Diamond Model?

Question 28mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

Which THREE phases of the Cyber Kill Chain focus on the attacker's activities before reaching the target environment?

Question 29hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is building a report on an advanced persistent threat (APT) group that has been observed targeting a government contractor. The analyst wants to characterize the group's operational infrastructure using the Diamond Model of Intrusion Analysis. Which TWO of the following activities would the analyst classify as belonging to the Infrastructure axis? (Choose two.)

Question 30easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security operations center analyst is mapping an intrusion to the MITRE ATT&CK framework. The analyst observes that after gaining initial access, the adversary used Windows Management Instrumentation (WMI) to remotely create processes on other hosts in the domain. Under which ATT&CK tactic does this activity fall?

Question 31mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing a report that describes an adversary's operational approach using a model that maps phases from reconnaissance through to achieving the final mission. The report specifically highlights that the adversary spent weeks performing open-source research on employees and technical infrastructure before any exploitation attempt. In the Lockheed Martin Cyber Kill Chain, which phase is being described?

Question 32hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is examining a malware sample that uses a domain generation algorithm (DGA) to create a large number of pseudo-random domain names. The malware queries these domains to locate its command-and-control (C2) server. Which of the following best describes the primary purpose of using a DGA in this context?

Question 33hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence team is analyzing an adversary's use of the Diamond Model to document an intrusion. The team wants to identify which elements constitute the 'Infrastructure' axis of the Diamond Model. (Choose two.)

Question 34mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is mapping adversary tactics to the MITRE ATT&CK framework. The analyst observes that an adversary is using scheduled tasks and Windows services to maintain persistence on compromised hosts. Which two ATT&CK techniques are being used? (Choose two.)

Question 35easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security analyst is mapping adversary behavior to the MITRE ATT&CK framework. The analyst observes that the adversary is using the 'Spearphishing Attachment' technique. Under which ATT&CK tactic does this technique fall?

Question 36mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

You are analyzing a threat actor that consistently registers look-alike domains resembling your organization's partners and sends spear-phishing emails from those domains to your finance team. According to the Diamond Model of Intrusion Analysis, how should the adversary's use of these domains be classified?

Question 37hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is investigating an incident where an adversary used a spear-phishing email with a link to a malicious website. The website exploited a browser vulnerability to download and execute a payload. According to the Diamond Model of Intrusion Analysis, which axis represents the malicious website?

Question 38hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a novel technique to maintain persistence. The group modifies the Windows Registry to add a malicious DLL to the AppInit_DLLs key, which loads the DLL into every process that loads User32.dll. Which MITRE ATT&CK technique is this an example of?

Question 39hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing an incident where the adversary used a previously unseen malware family and a novel exploit. The analyst wants to map the adversary's behavior to the MITRE ATT&CK framework. Which of the following best describes the appropriate level of abstraction to use?

Question 40mediummultiple choice

Read the full VPN explanation →

During an incident response engagement, a threat intelligence analyst observes that the adversary used a compromised employee's VPN credentials to access the corporate network, and then moved laterally to other systems using legitimate administrative tools. The analyst wants to map these actions to the MITRE ATT&CK framework. Which tactic best describes the initial use of valid VPN credentials?

Question 41easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security analyst is reviewing threat intelligence reports and notices that an APT group frequently uses zero-day exploits and custom malware to target government agencies. The group maintains long-term access to victim networks and exfiltrates sensitive data over extended periods. Which characteristic best distinguishes this group as an Advanced Persistent Threat (APT)?

Question 42easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A security operations center (SOC) receives an alert about a workstation exhibiting unusual outbound traffic to a known malicious IP address. The analyst suspects the workstation is compromised and communicating with a command-and-control (C2) server. According to the Cyber Kill Chain, which phase does this activity represent?

Question 43hardmulti select

Read the full Cyber Threats And Attack Frameworks explanation →

You are conducting threat intelligence research on a newly discovered APT group. You have collected various data points. Which TWO of the following are considered Tactics, Techniques, and Procedures (TTPs) according to the MITRE ATT&CK framework? (Choose two.)

Question 44mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is tracking an adversary that has been observed using a unique, custom-built backdoor. The analyst wants to attribute the activity to a known threat group. According to the Diamond Model, which axis should the analyst focus on to link this activity to other events?

Question 45hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is studying a sophisticated APT group that has been observed using a previously unknown backdoor. The analyst wants to create a detection rule that focuses on the adversary's operational behavior rather than static indicators. Which of the following best describes the type of detection logic the analyst should prioritize?

Question 46mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing the Cyber Kill Chain phases for a recent intrusion. The analyst observes that the adversary successfully exploited a vulnerability in a public-facing web server to gain a foothold. Which phase of the Cyber Kill Chain does this activity represent?

Question 47mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

An analyst is using the MITRE ATT&CK framework to categorize adversary behaviors observed during an incident. The analyst notes that the attacker used a scheduled task to maintain access and also encrypted files on a file share to disrupt operations. Which two ATT&CK tactics do these behaviors represent? (Choose two.)

Question 48mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing a report on a ransomware group that has targeted multiple hospitals. The report states the group uses the 'double extortion' model. Which of the following best describes this tactic?

Question 49hardmultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a technique called 'domain fronting' to evade detection. Which of the following best describes how domain fronting works?

Question 50mediummulti select

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is analyzing a cyber attack campaign and wants to apply the Diamond Model of Intrusion Analysis. The analyst has identified the victim and the infrastructure used by the attacker. Which TWO additional core features of the Diamond Model should the analyst identify to complete the model? (Choose two.)

Question 51easymultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is reviewing a report that describes an adversary using the 'Pyramid of Pain' model. The analyst wants to prioritize defensive actions based on the model. Which of the following indicators would cause the most pain to the adversary if blocked?

Question 52mediummultiple choice

Read the full Cyber Threats And Attack Frameworks explanation →

A threat intelligence analyst is assessing an adversary's use of the 'Kill Chain' model. The analyst notes that the adversary has successfully delivered a malicious payload to the target and is now establishing a command-and-control (C2) channel. Which phase of the Cyber Kill Chain does this activity represent?