312-85 Cyber Threats And Attack Frameworks — Timed 20 Questions

Question 1

In the Diamond Model, the 'Technology' axis (often associated with the Capability-Infrastructure edge) is used to track what specifically?

Accepted Answer

The software/tools facilitating the link between Capability and Infrastructure. It tracks the technical dependencies and tools that enable the relationship between the adversary's capability and the infrastructure they employ.

Answer

The organizational structure of the security team

Answer

The victim's hardware specifications

Answer

The budget of the threat actor

Question 2

A threat intelligence analyst is reviewing a report on an adversary group that has been observed using spear-phishing emails with malicious attachments to gain initial access. The report states that the group then uses credential dumping to escalate privileges and moves laterally using SMB. According to the Lockheed Martin Cyber Kill Chain, which phase does the use of credential dumping fall into?

Accepted Answer

Actions on Objectives. Credential dumping is a post-exploitation technique used to extract credentials from a compromised system. In the Cyber Kill Chain, it falls under Actions on Objectives, where the adversary pursues their ultimate goals, including privilege escalation and lateral movement. This phase occurs after earlier stages like delivery, exploitation, and installation.

Answer

Exploitation

Answer

Weaponization

Answer

Installation

Question 3

While reviewing an incident, a threat intelligence analyst maps the adversary's behavior and finds that the attacker leveraged a signed, legitimate remote monitoring and management (RMM) tool already present in the environment to execute commands and move laterally. Under the MITRE ATT&CK framework, which tactic does this activity primarily support?

Accepted Answer

Defense Evasion. The adversary used a trusted, signed RMM tool already present to execute commands and move laterally, which is a classic Defense Evasion technique. By leveraging an existing legitimate application, the attacker avoids introducing malicious binaries, bypasses application allowlisting, and blends into normal administrative activity. This behavior is mapped to Defense Evasion in MITRE ATT&CK, specifically under Trusted Developer Utilities Proxy Execution or similar sub-techniques.

Answer

Persistence

Answer

Lateral Movement

Answer

Execution

Question 4

An analyst is documenting an intrusion using the Diamond Model of Intrusion Analysis. The analyst notes that the adversary used a specific spear-phishing email with a malicious attachment to gain initial access. Under the Diamond Model, which core feature does the spear-phishing email represent?

Accepted Answer

Capability. In the Diamond Model, the spear-phishing email with a malicious attachment is a Capability. Capabilities are the tools and techniques the adversary uses to exploit the victim, including malware, exploits, and social engineering lures. The email serves as the weaponized payload delivery mechanism. Documenting it as Capability helps analysts understand the adversary's tradecraft and link it to other events in the intrusion.

Answer

Adversary

Answer

Victim

Answer

Infrastructure

Question 5

During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?

Accepted Answer

Weaponization. The Weaponization phase is where the adversary creates the malicious payload or tool, such as a custom Trojan, to exploit the target.

Answer

Exploitation

Answer

Delivery

Answer

Installation

Question 6

You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?

Accepted Answer

Registry key modification. A host-based IOC is an artifact found on an endpoint or host system, such as a modified registry key, a suspicious file hash, a rogue process, or a persistence entry. Registry key modification is a classic host-based indicator because attackers use registry Run keys, services, or COM hijacking to establish persistence on Windows systems. It is observable only by inspecting the host, distinguishing it from network-based IOCs.

Answer

User-Agent string in HTTP header

Answer

Domain name for C2 beaconing

Answer

Source IP address in firewall logs

Question 7

What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?

Accepted Answer

Data Exfiltration. This is the final phase where the adversary achieves their ultimate goal, such as data exfiltration or system destruction.

Answer

Reconnaissance of the target

Answer

Establishing a backdoor

Answer

Sending phishing emails

Question 8

A security analyst is using the Diamond Model to document an incident. The analyst notes that the adversary used a specific Command and Control (C2) server IP address. In the context of the Diamond Model, where does this IP address belong?

Accepted Answer

Infrastructure. In the Diamond Model, Infrastructure represents the physical and logical communication paths and services, such as IPs and domains, used by the adversary.

Answer

Capability

Answer

Adversary

Answer

Victim

Question 9

You are analyzing an APT threat group that consistently uses 'living-off-the-land' techniques. How should you approach identifying their presence using the MITRE ATT&CK framework?

Accepted Answer

Monitor for anomalous process execution patterns. Because they use legitimate tools, you must focus on behavioral detection (Tactic-Technique-Procedure analysis) rather than signature-based file detection.

Answer

Scan for known malware signatures

Answer

Update firewall rules for all known ports

Answer

Focus on file hash blacklisting

Question 10

When evaluating an adversary's TTPs, you notice they use 'Process Hollowing'. Which ATT&CK Tactic does this technique primarily support?

Accepted Answer

Defense Evasion. Process Hollowing (T1055.012) is a sub-technique of Process Injection, which falls under the Defense Evasion tactic in MITRE ATT&CK. The technique involves creating a legitimate process in a suspended state, hollowing out its memory, and replacing it with malicious code, so the malicious activity appears to originate from a trusted process. This masks the adversary's code from security tools that rely on process reputation or signature-based detection, directly supporting the goal of evading defenses.

Answer

Lateral Movement

Answer

Credential Access

Answer

Persistence

Question 11

An adversary is performing internal reconnaissance using 'net view' commands. In the MITRE ATT&CK framework, which technique ID maps to this behavior?

Accepted Answer

T1018. The 'net view' command is used to enumerate shared resources on a network, such as computers and shared folders. In MITRE ATT&CK, this activity is classified under T1018: Remote System Discovery, which covers techniques used to identify remote systems and shares. Therefore, T1018 is the correct mapping for internal reconnaissance using 'net view'.

Answer

T1071

Answer

T1059

Answer

T1027

Question 12

You are mapping an adversary behavior to the MITRE ATT&CK framework. The attacker uses PowerShell to execute a Base64 encoded payload that downloads a secondary script. Under which Tactic should this specific execution behavior be primarily classified?

Accepted Answer

Execution. While PowerShell can be used for execution, the act of running the script to download the payload is categorized under Execution. The Tactic is the 'why' of the action, and Execution covers running malicious code.

Answer

Discovery

Answer

Persistence

Answer

Command and Control

Question 13

You are assessing a company's incident response capability against the Cyber Kill Chain. If an attacker has successfully completed the 'Installation' phase, which defensive control should you have triggered?

Accepted Answer

Endpoint Detection and Response (EDR). The Installation phase involves the malware establishing a persistent foothold on the host, which is best detected by host-based security tools like EDR.

Answer

DNS sinkholing

Answer

Email gateway filtering

Answer

Social engineering training

Question 14

Which phase of the Cyber Kill Chain is primarily mitigated by effective security awareness training for employees?

Accepted Answer

Delivery. Social engineering and phishing attacks occur during the Delivery phase, which is best addressed by human-centric training.

Answer

Weaponization

Answer

Installation

Answer

Actions on Objectives

Question 15

You observe an adversary using a legitimate VPN tunnel to communicate with their C2 server. Under the MITRE ATT&CK framework, which technique is this?

Accepted Answer

T1572: Protocol Tunneling. This is T1572 (Protocol Tunneling) or T1071.001 (Web Protocols), where the adversary leverages existing network protocols or channels to mask C2 traffic.

Answer

T1204: User Execution

Answer

T1133: External Remote Services

Answer

T1053: Scheduled Task

Question 16

Which of the following best describes an Advanced Persistent Threat (APT)?

Accepted Answer

Sophisticated, long-term, targeted attacks. APTs are characterized by their long-term, targeted, and sophisticated nature, often backed by nation-states.

Answer

Automated script kiddies

Answer

Uncoordinated network scanning

Answer

Short-term ransomware campaigns

Question 17

An analyst is examining logs and finds a pattern of periodic heartbeat pings to an unknown external domain. Which MITRE ATT&CK tactic does this activity suggest?

Accepted Answer

Command and Control. Beaconing is a primary method for establishing and maintaining Command and Control.

Answer

Exfiltration

Answer

Privilege Escalation

Answer

Collection

Question 18

Which of the following is considered an 'Indicator of Attack' (IOA) rather than an IOC?

Accepted Answer

A command-line execution sequence. An Indicator of Attack (IOA) focuses on the behavior or intent of an attack in progress — such as a suspicious command-line execution sequence — rather than static artifacts. IOAs are behavioral and can detect novel attacks even when no known signature exists.

Answer

A known malicious file hash

Answer

A specific registry key for malware persistence

Answer

A blacklisted IP address

Question 19

You are performing threat hunting based on the Diamond Model. You identified a new Infrastructure node (IP). What is the logical next step in the Diamond Model analysis?

Accepted Answer

Pivot to identify the Capability or Adversary. After identifying infrastructure, the next step is to pivot to identify the associated Capability or Adversary, creating a chain of evidence.

Answer

Update the firewall blacklist only

Answer

Change all user passwords

Answer

Close the incident ticket

Question 20

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Accepted Answer

SHA-256 File Hash. IOCs are typically digital forensic artifacts like file hashes or network connection logs.

Answer

Server rack temperature

Answer

Employee behavior patterns

Answer

Project management timeline