CCOA Adversarial Tactics Practice Test 2 — 15 Questions

Question 1

You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?

Accepted Answer

Lateral Movement. The spawning of a command shell from a remote management process is a classic indicator of Lateral Movement using remote execution.

Answer

Credential Access

Answer

Exfiltration

Answer

Persistence

Question 2

An adversary uses 'vssadmin.exe delete shadows /all /quiet' during an attack. Which tactic is this technique categorized under?

Accepted Answer

Impact. Deleting volume shadow copies with 'vssadmin.exe delete shadows /all /quiet' is a classic pre-ransomware step that removes the victim's ability to restore files from local backups. In MITRE ATT&CK, this maps to T1490 'Inhibit System Recovery,' which falls under the Impact tactic (A). The goal is to maximize the destructive effect of the subsequent encryption by eliminating recovery options.

Answer

Credential Access

Answer

Defense Evasion

Answer

Initial Access

Question 3

You are configuring Microsoft Defender for Endpoint. Which feature is most effective against 'T1566 Phishing'?

Accepted Answer

Email filtering policies. T1566 Phishing is an initial-access technique delivered primarily via email, so email filtering policies that block malicious senders, attachments, and URLs are the most direct and effective control. Defender for Endpoint integrates with Exchange Online Protection and Defender for Office 365 to inspect inbound mail and neutralize phishing before it reaches the endpoint. This addresses the attack at its delivery vector.

Answer

Network Isolation

Answer

Attack Surface Reduction (ASR) rules

Answer

Device Control

Question 4

Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?

Accepted Answer

Running 'whoami' or 'net view'. Discovery involves gathering information about the system and network to plan subsequent steps.

Answer

Installing a backdoor

Answer

Deleting logs to hide traces

Answer

Encrypting files for ransom

Question 5

What is the purpose of 'T1027 Obfuscated Files or Information'?

Accepted Answer

To evade detection by signature-based tools. Obfuscation is used to hide code or scripts from static analysis and security tools, aiding Defense Evasion.

Answer

To escalate privileges

Answer

To increase execution speed

Answer

To facilitate lateral movement

Question 6

Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?

Accepted Answer

PowerShell scripts. PowerShell scripts are classified under the Execution tactic in MITRE ATT&CK because they represent a technique (T1059.001) adversaries use to run malicious code on a target system. Execution covers techniques that result in adversary-controlled code running on a local or remote system.

Answer

Password spraying

Answer

Data encryption

Answer

Network mapping

Question 7

You are reviewing a Purple Team exercise involving 'T1003 OS Credential Dumping'. What is the most reliable way to detect credential dumping via LSASS process access?

Accepted Answer

Monitor for handle access to lsass.exe. The most reliable detection for T1003 OS Credential Dumping is monitoring for suspicious handle access to lsass.exe. Attackers using tools like Mimikatz must open a handle to the LSASS process with rights such as PROCESS_VM_READ (0x0010) to read credential material from memory. Security tools like Sysmon (Event ID 10) or EDR sensors can flag non-standard processes requesting these access rights, which is the canonical behavioral indicator for credential dumping.

Answer

Monitor for lsass.exe process termination

Answer

Monitor for failed login attempts

Answer

Monitor registry read operations

Question 8

What is the primary difference between a Red Team and a Blue Team in a security simulation?

Accepted Answer

Red Team acts as the adversary, Blue Team performs incident response. In security simulations, the Red Team emulates adversary tactics, techniques, and procedures (TTPs) to test defenses, while the Blue Team defends, detects, and responds to those attacks. This adversarial/defensive split is the defining characteristic of red vs. blue teaming. Option C captures both roles accurately.

Answer

Red Team creates policy, Blue Team audits it

Answer

Red Team handles infrastructure, Blue Team handles software

Answer

Red Team identifies vulnerabilities, Blue Team remediates them

Question 9

You see a process performing DNS queries for unusually long subdomains. Which tactic is the adversary likely exercising?

Accepted Answer

Command and Control. DNS tunneling is a technique used to bypass network firewalls and communicate with C2 servers, falling under Command and Control.

Answer

Discovery

Answer

Exfiltration

Answer

Lateral Movement

Question 10

You detect an adversary attempting to clear Windows Event Logs using 'wevtutil cl'. This falls under which tactic?

Accepted Answer

Defense Evasion. Clearing Windows Event Logs with 'wevtutil cl' is a Defense Evasion technique (MITRE ATT&CK T1070.001 — Indicator Removal: Clear Windows Event Logs). Adversaries clear logs to destroy evidence of their activity and hinder forensic investigation, which is explicitly categorized under Defense Evasion, not Impact or Persistence.

Answer

Impact

Answer

Persistence

Answer

Discovery

Question 11

Which technique is most effective for an adversary to perform 'T1078 Valid Accounts'?

Accepted Answer

Using stolen credentials obtained via phishing. Adversaries often use stolen credentials or social engineering to obtain legitimate user credentials to access systems as authorized users.

Answer

Exploiting a software vulnerability

Answer

Brute forcing a firewall

Answer

Installing a rootkit

Question 12

What is the primary goal of the 'Command and Control' (C2) tactic?

Accepted Answer

To manage the compromised host and receive instructions. The Command and Control (C2) tactic in the MITRE ATT&CK framework (TA0011) is the phase where an adversary establishes a communication channel to remotely manage compromised systems. The primary goal is to maintain interactive control over the victim host, allowing the attacker to send commands and receive output, exfiltrate data, or pivot to other systems. This is distinct from other tactics like Credential Access or Exfiltration, which focus on specific objectives rather than the management channel itself.

Answer

To encrypt data

Answer

To create user accounts

Answer

To steal user credentials

Question 13

Which of these is a typical 'Lateral Movement' technique?

Accepted Answer

Using RDP. Remote Desktop Protocol (RDP) is a standard tool used by adversaries to move laterally between machines.

Answer

Running a keylogger

Answer

Encrypting local files

Answer

Setting a registry key

Question 14

You are implementing threat hunting for 'T1562 Impair Defenses'. Which activity are you searching for?

Accepted Answer

Disabling Windows Defender or modifying firewall rules. Impair Defenses involves disabling security software, such as antivirus or EDR agents, to remain undetected.

Answer

Downloading a remote tool

Answer

Running a password brute force

Answer

Listing files on a share

Question 15

What is the primary function of a 'C2 Beacon'?

Accepted Answer

To periodically check for new tasks. A C2 (command-and-control) beacon is the implant's periodic callback mechanism that reaches out to the attacker's infrastructure to check for new instructions, receive tasking, and confirm the host is still alive. Its primary function is to periodically check for new tasks (D), enabling the operator to maintain persistent, asynchronous control without needing an inbound connection. This pull-based model is what makes C2 resilient to firewalls and NAT.

Answer

To encrypt the local drive

Answer

To log user keystrokes

Answer

To transfer large files