312-85 Cyber Threats And Attack Frameworks Practice Test 3 — 15 Questions

Question 1

A threat intelligence analyst is reviewing a report that describes an adversary's operational approach using a model that maps phases from reconnaissance through to achieving the final mission. The report specifically highlights that the adversary spent weeks performing open-source research on employees and technical infrastructure before any exploitation attempt. In the Lockheed Martin Cyber Kill Chain, which phase is being described?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reconnaissance. Reconnaissance is the correct phase because the adversary is conducting open-source research on employees and technical infrastructure before any exploitation attempt. This phase encompasses all information gathering activities that precede weaponization and delivery. The scenario contains no evidence of payload creation, transmission, or vulnerability exploitation, so the other phases are not applicable.

Answer

Exploitation

Answer

Weaponization

Answer

Delivery

Question 2

A threat intelligence analyst is examining a malware sample that uses a domain generation algorithm (DGA) to create a large number of pseudo-random domain names. The malware queries these domains to locate its command-and-control (C2) server. Which of the following best describes the primary purpose of using a DGA in this context?

Accepted Answer

To evade domain blacklisting by constantly changing the C2 domain. A domain generation algorithm (DGA) produces a large number of domain names that malware uses to find its C2 server. This technique helps adversaries evade domain blacklisting and takedowns because defenders cannot easily predict or block all possible domains. It provides resilience and stealth for command-and-control communications.

Answer

To encrypt command-and-control traffic to avoid network inspection

Answer

To hide the malware's presence by mimicking legitimate domain names

Answer

To distribute malware payloads to multiple victims simultaneously

Question 3

A threat intelligence team is analyzing an adversary's use of the Diamond Model to document an intrusion. The team wants to identify which elements constitute the 'Infrastructure' axis of the Diamond Model. (Choose two.)

Accepted Answer

The adversary's phishing email address and spoofed sender domain. Infrastructure in the Diamond Model comprises the physical and logical communication structures the adversary uses, such as command-and-control domains, IP addresses, and phishing email addresses or spoofed sender domains. These elements enable the adversary to deliver capabilities and maintain control. Malware and exploits are Capability, victim assets are Victim, and adversary personas are Adversary, so those options do not belong to Infrastructure.

Answer

The adversary's social media profile used for reconnaissance

Answer

The victim organization's internal file server hostname

Answer

The specific malware family and exploit code used in the attack

Question 4

A threat intelligence analyst is mapping adversary tactics to the MITRE ATT&CK framework. The analyst observes that an adversary is using scheduled tasks and Windows services to maintain persistence on compromised hosts. Which two ATT&CK techniques are being used? (Choose two.)

Accepted Answer

Scheduled Task/Job. The adversary uses scheduled tasks and Windows services to maintain persistence. In MITRE ATT&CK, these correspond to Scheduled Task/Job and Create or Modify System Process: Windows Service. Both are common persistence techniques that allow adversaries to survive system restarts and maintain long-term access.

Answer

Boot or Logon Autostart Execution: Shortcut Modification

Answer

Registry Run Keys / Startup Folder

Answer

Account Manipulation

Question 5

A security analyst is mapping adversary behavior to the MITRE ATT&CK framework. The analyst observes that the adversary is using the 'Spearphishing Attachment' technique. Under which ATT&CK tactic does this technique fall?

Accepted Answer

Initial Access. Spearphishing Attachment is categorized under the Initial Access tactic in MITRE ATT&CK because it is a method adversaries use to gain an initial foothold into a network. The technique involves sending a phishing email with a malicious attachment, which aligns with the goal of initial access. Other tactics like Execution, Persistence, and Privilege Escalation describe different phases of an attack, not the initial entry point.

Answer

Persistence

Answer

Privilege Escalation

Answer

Execution

Question 6

You are analyzing a threat actor that consistently registers look-alike domains resembling your organization's partners and sends spear-phishing emails from those domains to your finance team. According to the Diamond Model of Intrusion Analysis, how should the adversary's use of these domains be classified?

Accepted Answer

As the Infrastructure component of the model, because the domains are resources the adversary uses to deliver the attack and maintain control.. The Diamond Model classifies adversary-controlled resources such as domain names, IP addresses, and servers as Infrastructure. Look-alike domains registered by the threat actor to impersonate partners are used to deliver phishing emails and potentially host command-and-control, making them part of the adversary's infrastructure rather than a capability, victim, or the adversary itself.

Answer

As the Adversary component of the model, because the domains are operated by the threat actor.

Answer

As the Victim component of the model, because the finance team members are the targets who receive the emails.

Answer

As the Capability component of the model, because the domains are the functional tools that enable the phishing attack to succeed.

Question 7

A threat intelligence analyst is investigating an incident where an adversary used a spear-phishing email with a link to a malicious website. The website exploited a browser vulnerability to download and execute a payload. According to the Diamond Model of Intrusion Analysis, which axis represents the malicious website?

Accepted Answer

Infrastructure. In the Diamond Model, Infrastructure includes the physical and logical resources used by the adversary, such as servers, domains, and IP addresses. A malicious website used for exploitation is a logical resource, so it falls under Infrastructure. This axis helps analysts track and attribute adversary infrastructure.

Answer

Victim

Answer

Capability

Answer

Adversary

Question 8

A threat intelligence analyst is studying an advanced persistent threat (APT) group that has been observed using a novel technique to maintain persistence. The group modifies the Windows Registry to add a malicious DLL to the AppInit_DLLs key, which loads the DLL into every process that loads User32.dll. Which MITRE ATT&CK technique is this an example of?

Accepted Answer

AppInit DLLs. The AppInit DLLs technique specifically involves modifying the AppInit_DLLs registry key to load a malicious DLL into processes that load User32.dll. This provides persistence and often privilege escalation because the DLL runs in the context of multiple processes. The scenario describes exactly this behavior, so AppInit DLLs is the correct MITRE ATT&CK technique.

Answer

Registry Run Keys / Startup Folder

Answer

DLL Search Order Hijacking

Answer

Image File Execution Options Injection

Question 9

A threat intelligence analyst is reviewing an incident where the adversary used a previously unseen malware family and a novel exploit. The analyst wants to map the adversary's behavior to the MITRE ATT&CK framework. Which of the following best describes the appropriate level of abstraction to use?

Accepted Answer

Map the adversary's behavior to specific techniques and sub-techniques, such as Spearphishing Attachment or Exploit Public-Facing Application.. The MITRE ATT&CK framework is most useful when adversary behavior is mapped to specific techniques and sub-techniques, which describe concrete actions like Exploit Public-Facing Application or Spearphishing Attachment. This level of detail enables defenders to identify relevant detection strategies and mitigations, whereas higher-level tactics or atomic indicators provide less actionable context.

Answer

Map the adversary to a known threat group profile, such as APT29, based on the use of a novel exploit.

Answer

Map the adversary's actions to the highest-level tactics, such as initial access and execution, without detailing techniques.

Answer

Map the specific malware hashes and exploit file names directly to ATT&CK technique IDs.

Question 10

During an incident response engagement, a threat intelligence analyst observes that the adversary used a compromised employee's VPN credentials to access the corporate network, and then moved laterally to other systems using legitimate administrative tools. The analyst wants to map these actions to the MITRE ATT&CK framework. Which tactic best describes the initial use of valid VPN credentials?

Accepted Answer

Initial Access. The initial use of compromised VPN credentials to access the corporate network is an example of the Valid Accounts technique under the Initial Access tactic. Initial Access describes how adversaries gain an entry point, and using legitimate credentials is a common method. Lateral Movement, Persistence, and Privilege Escalation describe subsequent phases, not the initial entry.

Answer

Persistence

Answer

Privilege Escalation

Answer

Lateral Movement

Question 11

A security analyst is reviewing threat intelligence reports and notices that an APT group frequently uses zero-day exploits and custom malware to target government agencies. The group maintains long-term access to victim networks and exfiltrates sensitive data over extended periods. Which characteristic best distinguishes this group as an Advanced Persistent Threat (APT)?

Accepted Answer

Long-term persistence and stealthy exfiltration. Advanced Persistent Threats (APTs) are defined by their persistence, stealth, and long-term focus. They maintain access to victim networks over extended periods, often exfiltrating data slowly to avoid detection. While zero-days, custom malware, and specific targets are common, the core distinguishing feature is the persistent and stealthy nature of the campaign.

Answer

Use of custom malware

Answer

Targeting government agencies

Answer

Use of zero-day exploits

Question 12

A security operations center (SOC) receives an alert about a workstation exhibiting unusual outbound traffic to a known malicious IP address. The analyst suspects the workstation is compromised and communicating with a command-and-control (C2) server. According to the Cyber Kill Chain, which phase does this activity represent?

Accepted Answer

Command and Control. In the Cyber Kill Chain, Command and Control is the phase where the adversary establishes a communication channel with compromised systems. The outbound traffic to a known malicious IP is a beacon, indicating the workstation is checking in with a C2 server. This activity is distinct from earlier phases like Weaponization or Exploitation, and precedes Actions on Objectives.

Answer

Actions on Objectives

Answer

Weaponization

Answer

Exploitation

Question 13

You are conducting threat intelligence research on a newly discovered APT group. You have collected various data points. Which TWO of the following are considered Tactics, Techniques, and Procedures (TTPs) according to the MITRE ATT&CK framework? (Choose two.)

Accepted Answer

The group uses PowerShell to execute Base64-encoded commands for defense evasion.. TTPs in the MITRE ATT&CK framework refer to the tactics (goals), techniques (methods), and procedures (specific implementations) that adversaries use. Spear-phishing with malicious attachments and PowerShell with Base64 encoding are both techniques, reflecting how the adversary operates. The other options are atomic indicators like hashes, IP addresses, and strings, which are not TTPs.

Answer

The group's C2 server is located at IP address 192.0.2.10.

Answer

The group's malware contains a specific string 'XYZ123'.

Answer

The group uses a specific malware hash (e.g., SHA256: 3a4b...).

Question 14

A threat intelligence analyst is tracking an adversary that has been observed using a unique, custom-built backdoor. The analyst wants to attribute the activity to a known threat group. According to the Diamond Model, which axis should the analyst focus on to link this activity to other events?

Accepted Answer

Capability, because the custom backdoor is a unique tool that can be linked to the adversary's previous operations.. In the Diamond Model, Capability encompasses the adversary's tools and malware. A custom backdoor is a distinctive capability that can be used to correlate activity across incidents, as it is likely unique to the threat group and persists over time. By focusing on Capability, the analyst can pivot to other events where the same tool was used, strengthening attribution.

Answer

Victim, because the targeted organizations can reveal the adversary's intent and help link to other victims.

Answer

Adversary, because the threat group is the entity conducting the attack and should be the focus of attribution.

Answer

Infrastructure, because the backdoor communicates with specific command-and-control servers that can be linked to the adversary.

Question 15

A threat intelligence analyst is studying a sophisticated APT group that has been observed using a previously unknown backdoor. The analyst wants to create a detection rule that focuses on the adversary's operational behavior rather than static indicators. Which of the following best describes the type of detection logic the analyst should prioritize?

Accepted Answer

Behavioral detection using indicators of behavior (IOBs) mapped to MITRE ATT&CK techniques. The analyst should prioritize behavioral detection using IOBs mapped to MITRE ATT&CK techniques. IOBs describe the adversary's actions—such as how the backdoor persists, escalates privileges, or communicates—and are more durable than static indicators. By focusing on behaviors, the analyst can detect the backdoor even if its code changes, because the underlying TTPs remain consistent. This aligns with the goal of detecting a previously unknown backdoor based on its operational patterns.

Answer

Anomaly-based detection focusing on deviations from normal network traffic patterns

Answer

Signature-based detection using file hashes of the backdoor

Answer

Heuristic detection based on file entropy and packing characteristics