CCOA Adversarial Tactics Practice Test 1 — 15 Questions

Question 1

An adversary performs a 'Pass-the-Hash' attack. Which tactic does this primarily fall under?

Accepted Answer

Credential Access. Pass-the-Hash is used to authenticate as a user without needing the original password, serving the goal of Credential Access.

Answer

Initial Access

Answer

Exfiltration

Answer

Persistence

Question 2

You are auditing an environment for 'T1083 File and Directory Discovery'. Which log source provides the most visibility into this activity?

Accepted Answer

Sysmon Event ID 11. File and Directory Discovery often involves listing files, which generates audit events when monitoring directory access via Sysmon Event ID 11 or Windows Security logs.

Answer

NetFlow

Answer

DHCP logs

Answer

Firewall logs

Question 3

While analyzing an EDR alert, you observe a process modifying 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run'. What is the primary adversary objective at this stage?

Accepted Answer

Persistence. Modifying registry run keys is a standard technique to ensure a program executes automatically upon system startup, which defines Persistence.

Answer

Discovery

Answer

Execution

Answer

Privilege Escalation

Question 4

In the context of the MITRE ATT&CK framework, what distinguishes 'T1059 Command and Scripting Interpreter' from 'T1204 User Execution'?

Accepted Answer

T1059 describes the execution mechanism, T1204 describes the delivery. T1059 focuses on the interpretation of code (PowerShell, Bash), while T1204 focuses on the user-driven triggering of the malicious file.

Answer

There is no distinction

Answer

T1059 is for Windows, T1204 is for Linux

Answer

T1059 is the technique, T1204 is the outcome

Question 5

You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?

Accepted Answer

WriteProcessMemory to a remote process. Process hollowing involves creating a legitimate process in a suspended state and replacing its memory with malicious code, a hallmark of execution techniques.

Answer

CreateServiceW

Answer

GetSystemTime

Answer

RegCreateKeyEx

Question 6

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

Accepted Answer

Lateral Movement. The spawning of a command shell from a remote management process is a classic indicator of Lateral Movement using remote execution.

Answer

Credential Access

Answer

Exfiltration

Answer

Persistence

Question 7

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

Accepted Answer

Impact. Deleting shadow copies is a specific technique used to hinder forensic analysis and recovery, categorized under Impact.

Answer

Credential Access

Answer

Defense Evasion

Answer

Initial Access

Question 8

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Accepted Answer

Email filtering policies. Defender for Office 365 / MDE integration provides specialized filtering for malicious attachments and URLs linked to phishing.

Answer

Network Isolation

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control

Question 9

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

Accepted Answer

Running 'whoami' or 'net view'. Discovery involves gathering information about the system and network to plan subsequent steps.

Answer

Installing a backdoor

Answer

Deleting logs to hide traces

Answer

Encrypting files for ransom

Question 10

What is the purpose of 'T1027 Obfuscated Files or Information'?

Accepted Answer

To evade detection by signature-based tools. Obfuscation is used to hide code or scripts from static analysis and security tools, aiding Defense Evasion.

Answer

To escalate privileges

Answer

To increase execution speed

Answer

To facilitate lateral movement

Question 11

Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?

Accepted Answer

PowerShell scripts. Execution involves running malicious code on a system.

Answer

Password spraying

Answer

Data encryption

Answer

Network mapping

Question 12

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

Accepted Answer

Monitor for handle access to lsass.exe. LSASS.exe is the process that handles local security; monitoring it for non-system process access is a high-fidelity detection method.

Answer

Monitor for lsass.exe process termination

Answer

Monitor for failed login attempts

Answer

Monitor registry read operations

Question 13

What is the primary difference between a Red Team and a Blue Team in a security simulation?

Accepted Answer

Red Team acts as the adversary, Blue Team performs incident response. The Red Team performs the offensive actions to emulate threats, while the Blue Team defends and monitors.

Answer

Red Team creates policy, Blue Team audits it

Answer

Red Team handles infrastructure, Blue Team handles software

Answer

Red Team identifies vulnerabilities, Blue Team remediates them

Question 14

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

Accepted Answer

Command and Control. DNS tunneling is a technique used to bypass network firewalls and communicate with C2 servers, falling under Command and Control.

Answer

Discovery

Answer

Exfiltration

Answer

Lateral Movement

Question 15

You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?

Accepted Answer

Defense Evasion. Clearing logs is an explicit attempt to remove traces of activity to evade detection.

Answer

Impact

Answer

Persistence

Answer

Discovery