Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A security analyst is using the Diamond Model to analyze an intrusion. The analyst identifies that the adversary used a specific domain for command and control. Which element of the Diamond Model does the domain represent?

   • ACapability
   • BInfrastructure
   • CVictim
   • DAdversary
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A forensic investigator is examining a compromised Windows system. The investigator needs to determine which programs were set to run automatically at startup. Which digital artifact would provide the MOST reliable evidence?

   • AWindows Event Logs
   • BRegistry keys under Run and RunOnce
   • CBrowser history
   • DPrefetch files
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic investigator has collected a laptop from a suspect and needs to ensure the evidence is admissible in court. The investigator has documented who collected the evidence, when, and where. What additional step is essential to maintain the chain of custody?

   • ACreate a forensic image of the laptop's hard drive.
   • BDocument every person who handled the evidence and the duration of their possession.
   • CTake a photograph of the laptop at the scene.
   • DStore the laptop in a locked cabinet with limited access.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An incident responder is analyzing a series of intrusions and notices that the same adversary has used different infrastructure (e.g., different domains and IPs) but the same malware family and similar TTPs. The responder wants to use the Diamond Model to link these intrusions. Which element is most useful for linking the intrusions to the same adversary?

   • AThe infrastructure (the domains and IPs) used in each intrusion.
   • BThe capability (the malware family) and the TTPs used.
   • CThe time of day when the intrusions occurred.
   • DThe victim (the targeted organization) in each intrusion.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is analyzing an attack where the adversary used a previously unknown vulnerability in a web application, then used a legitimate system tool to move laterally, and finally encrypted files for ransom. The team wants to use MITRE ATT&CK to identify detection gaps. Which approach is most effective?

   • AFocus only on the malware family used, since it is the most important indicator.
   • BSearch for the specific exploit code used in the attack.
   • CMap the observed behaviors to specific techniques under the relevant tactics, such as Initial Access, Lateral Movement, and Impact.
   • DUse the Cyber Kill Chain to identify the phase of the attack.
   Reveal Solution Discussion Select an answer first