CCOA Adversarial Tactics Practice Test 3 — 15 Questions

Question 1

An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?

Accepted Answer

It evades detection by appearing as normal activity. Living-off-the-land (LotL) binaries are legitimate, signed system executables (e.g., PowerShell, WMI, certutil, rundll32) already present on the host, so their execution blends into normal administrative activity and bypasses application allowlisting and signature-based detection. Custom malware introduces new files, hashes, and behaviors that EDR and antivirus can flag, whereas LotL activity uses trusted processes that defenders are reluctant to block outright. This makes LotL the preferred technique for stealth and persistence in mature environments.

Answer

It is faster to execute

Answer

It is easier to compile

Answer

It requires less memory

Question 2

Which of these is a 'Defense Evasion' technique?

Accepted Answer

Masquerading as a system process. Using masquerading (renaming files to look like system files) is a common way to hide malicious processes.

Answer

Creating a scheduled task

Answer

Stealing a hash

Answer

Scanning ports

Question 3

You are investigating a breach where the attacker used 'T1555 Credentials from Password Stores'. Where would they look?

Accepted Answer

Browser 'Login Data' SQLite databases. Password stores include browser data, local vaults, and credential managers.

Answer

Active Directory logs

Answer

Network packets

Answer

System logs

Question 4

You suspect an adversary is performing 'T1005 Data from Local System'. Which of these actions is relevant?

Accepted Answer

Searching for files with specific extensions like .docx or .xlsx. Data from Local System involves searching for and copying files from a user's machine.

Answer

Modifying a service

Answer

Creating a new user

Answer

Scanning the network

Question 5

An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?

Accepted Answer

Exploiting an exposed VPN gateway. T1133 External Remote Services refers to adversaries leveraging legitimate, externally facing remote access services — most commonly VPN gateways, RDP, Citrix, or VDI — to gain initial access using valid or stolen credentials. Exploiting an exposed VPN gateway is the textbook example, as attackers frequently target unpatched VPN appliances (e.g., Pulse Secure, Fortinet, Citrix ADC) or use credential stuffing against VPN portals to establish a foothold.

Answer

Exploiting an internal web server

Answer

Phishing a user

Answer

Using a USB drive

Question 6

Which tactic is associated with 'T1537 Transfer Data to Cloud Account'?

Accepted Answer

Exfiltration. MITRE ATT&CK T1537 (Transfer Data to Cloud Account) is classified under the Exfiltration tactic because it describes an adversary moving data from a victim environment into an adversary-controlled cloud account (e.g., AWS S3 bucket, Azure Blob) to exfiltrate it. The technique's goal is data theft via cloud storage, which is exfiltration.

Answer

Execution

Answer

Discovery

Answer

Persistence

Question 7

Which TWO of the following are examples of 'Initial Access' tactics?

Accepted Answer

Phishing. In the MITRE ATT&CK framework, Initial Access consists of techniques that adversaries use to gain an entry point into a network, and Phishing (B) is a canonical example because it delivers malicious content via email, links, or attachments to compromise a user's credentials or execute code. Exploiting public-facing applications (D) is also an Initial Access technique (T1190), since it leverages vulnerabilities in internet-exposed services such as web servers or VPN gateways to establish a foothold. Registry modification (A) is a Defense Evasion/Persistence technique, not Initial Access, because it occurs after the adversary already has access. Screen capture (C) is a Collection technique used to gather data from an already-compromised host. Network scanning (E) is Discovery (or Reconnaissance), used to enumerate targets rather than to gain initial entry.

Answer

Registry modification

Answer

Screen capture

Answer

Network scanning

Question 8

You are assessing an attacker's use of 'T1203 Exploitation for Client Execution'. What does this imply?

Accepted Answer

The attacker targeted a software vulnerability in an application. This technique involves exploiting a client-side application (like a browser or PDF reader) to execute code.

Answer

The user clicked a link

Answer

The attacker used social engineering

Answer

The user was logged in via RDP

Question 9

Which TWO of the following are examples of 'Persistence' tactics?

Accepted Answer

Scheduled tasks. Creating scheduled tasks and adding items to the Startup folder are standard ways to ensure malware survives reboot.

Answer

Credential dumping

Answer

Port scanning

Answer

Data encryption

Question 10

Which TWO of the following behaviors are typical of 'Lateral Movement'?

Accepted Answer

SMB/Admin shares. Lateral movement describes an attacker pivoting from one compromised host to other systems in the same network, and SMB/Admin shares (Option A) are a classic vector: adversaries use tools like PsExec or Impacket's smbexec to authenticate to remote machines over TCP 445 and execute code via hidden shares such as ADMIN$, C$, or IPC$. Remote Desktop Protocol (Option E) is equally typical, since attackers use stolen credentials to open interactive RDP sessions over TCP 3389 to hop between hosts and expand their foothold. By contrast, DNS query analysis (Option B) is a defensive/detection technique rather than an attacker behavior, Registry key editing (Option C) is a local persistence or configuration-tampering action, and keystroke logging (Option D) is a credential-collection or surveillance activity — none of these inherently involve moving from one host to another.

Answer

DNS query analysis

Answer

Registry key editing

Answer

Keystroke logging

Question 11

Which TWO of the following are considered 'Credential Access' techniques?

Accepted Answer

Brute force. In the MITRE ATT&CK framework, Credential Access consists of techniques for stealing credentials like account names and passwords. Option A, Brute force, is correct because it is listed under Credential Access (T1110) and involves guessing passwords through methods like password spraying or credential stuffing to gain access. Option B, OS credential dumping, is also correct because it is a Credential Access technique (T1003) that extracts credential material such as hashes or plaintext passwords from operating system memory (e.g., LSASS) or registry hives. Option C, File deletion, belongs to the Impact tactic (T1070.004 is Indicator Removal, but file deletion itself is Impact/Defense Evasion), not Credential Access. Option D, Network mapping, falls under Discovery (T1046/T1016) since it enumerates network topology rather than stealing credentials. Option E, Service creation, is a Persistence and Privilege Escalation technique (T1543.003), not Credential Access.

Answer

File deletion

Answer

Network mapping

Answer

Service creation

Question 12

Which TWO of the following are examples of 'Discovery' techniques?

Accepted Answer

System owner/user discovery. Enumerating network shares and identifying current user context are discovery actions.

Answer

Data exfiltration

Answer

Process injection

Answer

System reboot

Question 13

Which THREE of the following are common 'Exfiltration' techniques?

Accepted Answer

Exfiltration over alternative protocol. Exfiltration over alternative protocol (A) is correct because attackers commonly move stolen data out of a network using protocols other than the primary C2 channel, such as DNS, FTP, SMTP, or ICMP, to evade detection and blend with legitimate traffic. Exfiltration over C2 channel (C) is correct because the same command-and-control channel already established for remote access is frequently reused to transfer collected data out of the environment, often encoded or tunneled within the C2 traffic. Exfiltration to cloud storage (E) is correct because adversaries increasingly upload data to legitimate cloud services (e.g., Dropbox, Google Drive, OneDrive) using APIs or web protocols, which can bypass traditional perimeter controls and appear as normal user activity. Keylogging (B) is not an exfiltration technique but a collection technique, as it captures keystrokes for later theft rather than moving data off the system. File system enumeration (D) is also not exfiltration; it is a discovery technique used to identify files and directories of interest before collection or staging occurs.

Answer

Keylogging

Answer

File system enumeration

Question 14

Which THREE of the following are considered 'Execution' techniques?

Accepted Answer

User Execution. In the MITRE ATT&CK framework, the Execution tactic covers techniques adversaries use to run malicious code. Option B, User Execution, is correct because it relies on tricking a legitimate user into running a malicious file or link, which directly triggers code execution on the victim's system. Option C, Command and Scripting Interpreter, is correct because it uses interpreters such as PowerShell, cmd.exe, Bash, or Python to execute commands and scripts. Option D, Native API, is correct because it calls operating system APIs (for example, Windows API functions like CreateProcess or VirtualAlloc) to execute code directly. Option A, Account discovery, belongs to the Discovery tactic, and option E, Registry persistence, belongs to the Persistence tactic (specifically Registry Run Keys or similar), so neither is an Execution technique.

Answer

Account discovery

Answer

Registry persistence

Question 15

Which THREE of the following are common 'Impact' techniques?

Accepted Answer

Data encrypted for impact. Data destruction, ransomware encryption, and service disruption are all forms of impact.

Answer

Credential access

Answer

Persistence setup