CCOA Adversarial Tactics Practice Test 5 — 15 Questions

Question 1

A threat hunter is reviewing logs for signs of adversary reconnaissance. Which TWO of the following activities are considered Discovery techniques in the MITRE ATT&CK framework? (Choose two.)

Accepted Answer

Running 'net user /domain' to list domain users. The correct answers are running 'net user /domain' and using 'netstat -ano' because both are Discovery techniques that gather information about users and network connections. The other options are Persistence, Credential Access, and Defense Evasion, which serve different purposes in the attack lifecycle.

Answer

Creating a scheduled task to run a payload at logon

Answer

Using 'wevtutil cl' to clear Windows event logs

Answer

Dumping LSASS memory to extract credentials

Question 2

An analyst observes an adversary using 'reg save HKLM\SAM sam.hive' and 'reg save HKLM\SYSTEM system.hive' on a compromised workstation. The files are then compressed and moved to a staging directory. Which MITRE ATT&CK tactic does this activity represent?

Accepted Answer

Credential Access. Extracting the SAM and SYSTEM registry hives with reg save is a classic credential access technique because those hives together allow offline recovery of local account password hashes. The adversary is targeting credential material, which places the activity squarely under Credential Access, even though the files are later staged for potential exfiltration.

Answer

Exfiltration

Answer

Collection

Answer

Defense Evasion

Question 3

During threat hunting, an analyst sees a workstation authenticate to multiple servers using a single NTLM authentication event that is relayed to a different host within seconds. The workstation account is not the user's account, and the target servers log successful logons with the workstation's machine account. Which adversarial tactic is best supported by this evidence?

Accepted Answer

Lateral Movement. Relayed NTLM authentication that lets a machine account access several servers is a hallmark of an adversary extending control across the network. Because the activity moves access from one internal host to others, it fits Lateral Movement rather than initial entry, pre-attack staging, or destructive impact.

Answer

Impact

Answer

Initial Access

Answer

Resource Development

Question 4

An adversary has gained access to a workstation and is attempting to escalate privileges. Which TWO of the following actions are examples of the Privilege Escalation tactic in MITRE ATT&CK? (Choose two.)

Accepted Answer

Creating a scheduled task to run a malicious script with highest privileges. Exploiting a local service vulnerability and creating a scheduled task with highest privileges are both Privilege Escalation techniques. They directly result in the adversary gaining higher-level permissions on the compromised system. Keylogging, DNS queries, and network scanning are associated with other tactics such as Credential Access, Command and Control, and Discovery, respectively.

Answer

Using a keylogger to capture user credentials

Answer

Performing DNS queries to a command and control server

Answer

Scanning the local network for open ports

Question 5

An analyst observes that an attacker has modified the Windows Registry to add a value under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Run' that points to a malicious executable. Which MITRE ATT&CK tactic is the attacker attempting to achieve?

Accepted Answer

Persistence. The correct answer is Persistence because modifying the Run key ensures the malicious executable runs automatically at logon, maintaining the attacker's access. The other tactics—Privilege Escalation, Defense Evasion, and Execution—describe different goals not achieved by this specific registry modification.

Answer

Defense Evasion

Answer

Execution

Answer

Privilege Escalation

Question 6

An analyst notices that a process on a finance workstation is repeatedly writing compressed archives to a hidden directory and then uploading them to an external IP address during non-business hours. No user is logged in interactively at the time. Which adversarial tactic does this activity most directly represent?

Accepted Answer

Exfiltration. Repeatedly creating compressed archives and sending them to an external IP address during non-business hours reflects data being removed from the environment. That transfer of stolen data to an external destination is the defining characteristic of Exfiltration, distinguishing it from local staging or control-channel activity.

Answer

Collection

Answer

Discovery

Answer

Command and Control

Question 7

A threat hunter is reviewing logs from a workstation and finds evidence of an adversary attempting to impair defenses before deploying ransomware. Which TWO of the following observed actions are Defense Evasion techniques? (Choose two.)

Accepted Answer

Using 'sc stop WinDefend' to stop the Windows Defender service.. Defense Evasion includes actions that impair defenses or remove evidence. Clearing the Security event log destroys forensic artifacts, and stopping the Windows Defender service disables a primary security control. Both directly reduce the environment's ability to detect or block the adversary, distinguishing them from discovery, lateral movement, and persistence actions that serve different objectives.

Answer

Executing 'whoami /all' to enumerate current user privileges.

Answer

Creating a scheduled task that runs a payload every 15 minutes.

Answer

Mapping a remote administrative share with 'net use'.

Question 8

A security operations centre analyst reviewing endpoint telemetry sees a process named 'rundll32.exe' executing with the command line 'rundll32.exe C:\Users\Public\upd.dat,Start'. The DLL was written to the Public folder minutes earlier by a macro-enabled document. The analyst must map this behaviour to the most appropriate MITRE ATT&CK technique. Which technique best fits this activity?

Accepted Answer

T1218.011 Signed Binary Proxy Execution: Rundll32. The combination of a signed Microsoft binary (rundll32.exe) executing a DLL from a user-writable location such as C:\Users\Public, immediately after a macro-enabled document ran, is textbook signed binary proxy execution. The technique abuses trust in legitimate system binaries to bypass application control and blend into normal process activity, which is why the rundll32 sub-technique is the accurate mapping rather than injection, scheduled tasks, or Run key persistence.

Answer

T1055 Process Injection

Answer

T1547.001 Registry Run Keys / Startup Folder

Answer

T1053.005 Scheduled Task/Job: Scheduled Task

Question 9

A security operations center (SOC) analyst notices that an attacker has been using the 'at' command to schedule a job that runs a reverse shell every day at 9 AM on a compromised Linux server. Which MITRE ATT&CK tactic does this activity represent?

Accepted Answer

Persistence. The correct answer is Persistence because scheduling a recurring job with 'at' ensures the reverse shell runs regularly, maintaining the attacker's access. The other tactics—Execution, Command and Control, and Privilege Escalation—describe different aspects of the attack that are not the primary purpose of this scheduling action.

Answer

Privilege Escalation

Answer

Execution

Answer

Command and Control

Question 10

A security analyst is reviewing alerts on a server and observes the following behaviors: (1) a scheduled task was created to run a script at startup, (2) a new local administrator account was created, and (3) the host file was modified to redirect a security vendor domain. Which TWO of these behaviors are most consistent with the Persistence tactic? (Choose two.)

Accepted Answer

A scheduled task was created to run a script at startup.. Scheduled tasks that run at startup and newly created local administrator accounts both provide continued access after reboots or remediation, which is the essence of Persistence. Hosts file modification is defense evasion, log archiving is collection or staging, and user enumeration is discovery, so those do not fit the persistence objective.

Answer

The host file was modified to redirect a security vendor domain.

Answer

An archive of log files was created in a temporary directory.

Answer

A process was observed querying the domain controller for a list of users.

Question 11

An analyst observes an endpoint resolving hundreds of unique subdomains under a single parent domain, each subdomain encoded as a long hexadecimal string, and the responses frequently return NXDOMAIN. The endpoint process generating these queries is a signed Office add-in. Which adversarial tactic is the endpoint most likely exhibiting?

Accepted Answer

Command and Control. Encoded subdomain labels under a single parent domain, repeated queries, and NXDOMAIN-heavy responses are the classic fingerprint of DNS-based command and control. Adversaries use this channel because DNS is widely permitted through perimeter controls and blends with normal name resolution. The signed Office add-in generating the queries indicates a trusted process has been co-opted to reach the C2 server, which places the behaviour firmly in the Command and Control tactic.

Answer

Exfiltration Over Alternative Protocol

Answer

Reconnaissance

Answer

Resource Development

Question 12

During an incident, an analyst finds that an adversary used a legitimate remote monitoring and management (RMM) tool already installed in the environment to execute commands, then deleted the tool's logs and renamed the executable to match a system process. Which adversarial tactic is most clearly being used to avoid detection and prolong the intrusion?

Accepted Answer

Defense Evasion. The adversary leveraged a trusted RMM tool, erased its logs, and renamed the binary to resemble a system process. Each of these actions is intended to avoid detection and blend into normal activity, which aligns with Defense Evasion. Execution and Discovery describe different objectives, and no evidence of privilege gain is present.

Answer

Privilege Escalation

Answer

Discovery

Answer

Execution

Question 13

During an incident, an analyst finds that a domain controller's NTDS.dit file was accessed by a process running under the context of a service account, and shortly afterwards the same account authenticated to several member servers using NTLM. The analyst must determine which adversarial tactic the combined activity represents. Which tactic does this activity primarily represent?

Accepted Answer

Credential Access. Accessing NTDS.dit is a credential theft technique that yields password hashes for domain accounts, which is the essence of the Credential Access tactic. The follow-on NTLM authentications to member servers show the adversary using those credentials to move laterally, but they are a downstream effect. Correctly mapping the primary activity to Credential Access keeps the analysis focused on the enabling action and prevents conflating cause with consequence.

Answer

Collection

Answer

Lateral Movement

Answer

Privilege Escalation

Question 14

A red team member uses the Windows Management Instrumentation (WMI) command-line utility to create a new process on a remote host, specifying credentials of a compromised domain user. Which tactic does this activity primarily illustrate?

Accepted Answer

Lateral Movement. Using WMI to create a process on a remote host with compromised credentials is a Lateral Movement technique. It enables the adversary to execute code on other systems, expanding their foothold. This is a common method because WMI is built into Windows and often allowed through firewalls.

Answer

Execution

Answer

Credential Access

Answer

Defense Evasion

Question 15

An analyst is reviewing host telemetry to identify behaviours that map to the Defense Evasion tactic. Which two of the following observed actions should be mapped to Defense Evasion? (Choose two.)

Accepted Answer

An attacker timestomps a dropped executable by setting its creation time to match a legitimate system file in the same directory.. Defense Evasion covers actions that impair defenses or hide adversary activity. Disabling Windows Defender real-time protection directly removes a security control, and timestomping alters file metadata to avoid scrutiny, so both qualify. Enumerating domain trusts is Discovery, reading the SAM hive is Credential Access, and creating a reboot-surviving scheduled task is Persistence, which is why those three do not map to Defense Evasion.

Answer

A process uses the Windows API to read the contents of the SAM registry hive for offline password hash extraction.

Answer

An adversary runs 'net user /domain' and 'nltest /domain_trusts' to enumerate domain accounts and trust relationships.

Answer

An adversary establishes a scheduled task that launches a beacon every 30 minutes to maintain access across reboots.