CCOA Adversarial Tactics Practice Test 2 — 15 Questions

Question 1

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

Accepted Answer

Using stolen credentials obtained via phishing. Adversaries often use stolen credentials or social engineering to obtain legitimate user credentials to access systems as authorized users.

Answer

Exploiting a software vulnerability

Answer

Brute forcing a firewall

Answer

Installing a rootkit

Question 2

What is the primary goal of the 'Command and Control' (C2) tactic?

Accepted Answer

To manage the compromised host and receive instructions. C2 is about maintaining a communication channel between the compromised host and the attacker's infrastructure.

Answer

To encrypt data

Answer

To create user accounts

Answer

To steal user credentials

Question 3

Which of these is a typical 'Lateral Movement' technique?

Accepted Answer

Using RDP. Remote Desktop Protocol (RDP) is a standard tool used by adversaries to move laterally between machines.

Answer

Running a keylogger

Answer

Encrypting local files

Answer

Setting a registry key

Question 4

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

Accepted Answer

Disabling Windows Defender or modifying firewall rules. Impair Defenses involves disabling security software, such as antivirus or EDR agents, to remain undetected.

Answer

Downloading a remote tool

Answer

Running a password brute force

Answer

Listing files on a share

Question 5

What is the primary function of a 'C2 Beacon'?

Accepted Answer

To periodically check for new tasks. Beacons are small packets sent periodically from the infected host to the attacker's server to check for instructions.

Answer

To encrypt the local drive

Answer

To log user keystrokes

Answer

To transfer large files

Question 6

An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?

Accepted Answer

It evades detection by appearing as normal activity. LotL binaries are legitimate system tools, making them harder to flag as malicious by signature-based defenses.

Answer

It is faster to execute

Answer

It is easier to compile

Answer

It requires less memory

Question 7

Which of these is a 'Defense Evasion' technique?

Accepted Answer

Masquerading as a system process. Using masquerading (renaming files to look like system files) is a common way to hide malicious processes.

Answer

Creating a scheduled task

Answer

Stealing a hash

Answer

Scanning ports

Question 8

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

Accepted Answer

Browser 'Login Data' SQLite databases. Password stores include browser data, local vaults, and credential managers.

Answer

Active Directory logs

Answer

Network packets

Answer

System logs

Question 9

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

Accepted Answer

Searching for files with specific extensions like .docx or .xlsx. Data from Local System involves searching for and copying files from a user's machine.

Answer

Modifying a service

Answer

Creating a new user

Answer

Scanning the network

Question 10

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

Accepted Answer

Exploiting an exposed VPN gateway. T1133 involves exploiting VPNs, Citrix, or other external-facing access points to enter a network.

Answer

Exploiting an internal web server

Answer

Phishing a user

Answer

Using a USB drive

Question 11

Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?

Accepted Answer

Exfiltration. This is a form of Exfiltration.

Answer

Execution

Answer

Discovery

Answer

Persistence

Question 12

During a simulation, you notice a process spawning child processes from 'wmic.exe'. What is this technique often used for?

Accepted Answer

Execution. WMIC is often used for remote execution and discovery in Windows environments.

Answer

Exfiltration

Answer

Collection

Answer

Impact

Question 13

Which TWO of the following are examples of 'Initial Access' tactics?

Accepted Answer

Phishing. Phishing and exploiting public-facing applications are two common ways to gain the first foothold in an environment.

Answer

Registry modification

Answer

Screen capture

Answer

Network scanning

Question 14

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

Accepted Answer

The attacker targeted a software vulnerability in an application. This technique involves exploiting a client-side application (like a browser or PDF reader) to execute code.

Answer

The user clicked a link

Answer

The attacker used social engineering

Answer

The user was logged in via RDP

Question 15

Which TWO of the following are examples of 'Persistence' tactics?

Accepted Answer

Scheduled tasks. Creating scheduled tasks and adding items to the Startup folder are standard ways to ensure malware survives reboot.

Answer

Credential dumping

Answer

Port scanning

Answer

Data encryption