Select Two (Multi-Select) Questions

Standard application layer protocol

A common C2 channel.

Communication through web service

A common C2 channel.

Non-standard port usage

A common C2 channel.

Scheduled tasks

A common persistence technique.

Startup folder modification

A common persistence technique.

Exploitation for privilege escalation

The core technique.

Process injection

Often used to escalate privileges via an existing process.

Access token manipulation

A core escalation technique.

SIEM log analysis

Monitors and detects events.

IDS alerts

Alerts are core to detection.

User Execution

Triggering by a user is an execution method.

Command and Scripting Interpreter

A standard execution method.

Native API

Calling native APIs directly is an execution method.

Data encrypted for impact

A form of impact.

Data destruction

A form of impact.

Service stop

A form of impact.

Phishing

A primary initial access vector.

Exploiting public-facing applications

A primary initial access vector.

Screen capture

A collection technique.

Audio capture

A collection technique.

Data from local system

A collection technique.

System owner/user discovery

Identifying users is a discovery activity.

Network share enumeration

Finding shares is a discovery activity.

SMB/Admin shares

SMB is a primary protocol for lateral movement.

Remote Desktop Protocol (RDP)

RDP is a primary lateral movement tool.

Risk management strategy

Strategy is a core part of Identify.

Software license management

Managing software assets is part of identification.

Hardware asset inventory

Knowing what you have is critical.

Mitigation status

Critical for tracking progress.

Risk description

Essential to identify the risk.

Asset owner

Necessary for accountability.

Access control policy

A policy document is administrative.

Security awareness training

Management/training is administrative.

Incident response plan

A plan is an administrative procedure.

Brute force

Brute force seeks to gain credentials.

OS credential dumping

Dumping memory is a core credential access technique.

Confidentiality

One of the three pillars.

Availability

One of the three pillars.

Firewall configuration

Software/hardware control.

Intrusion Prevention System (IPS)

Software-based security control.

Clear roles and responsibilities

Essential to ensure a coordinated response.

Defined communication plan

Ensures timely reporting to stakeholders.

Firewall logs

Essential for network perimeter visibility.

End-user authentication logs

Crucial for detecting credential abuse.

Physical door access logs

Useful for correlating physical and digital access.

Installing a malicious system service

Ensures code runs as a background process.

Adding entries to the 'Run' registry key

Executes code at login.

Creating a malicious scheduled task

Runs code periodically or at specific events.

Scope of the affected systems

Indicates the size of the compromise.

Sensitivity of compromised data

Determines the risk level.

Business impact

Crucial for determining priority.