5.10 Classify Intrusion Events into Categories as Defined by Security Models, Such as Cyber Kill Chain Model and Diamond Model of Intrusion 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security operations center is evaluating how to improve their incident analysis. They have a large number of intrusion alerts that need to be correlated to identify patterns and relationships between different attacks. They also need to understand the full lifecycle of an attack to improve detection. Which combination of models would be most effective?

   • AUse the Cyber Kill Chain to understand the attack lifecycle and the Diamond Model to analyze relationships between elements.
   • BUse only the Diamond Model to identify the adversary, capability, infrastructure, and victim for each alert.
   • CUse MITRE ATT&CK to replace both models.
   • DUse only the Cyber Kill Chain to map each alert to a phase.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An intrusion event involves an attacker using a remote access trojan (RAT) to connect to a victim's computer via a command-and-control server. In the Diamond Model, what is the RAT?

   • AAdversary
   • BInfrastructure
   • CCapability
   • DVictim
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a strength of the Diamond Model compared to the Cyber Kill Chain?

   • AIt is the only model that can be used for threat intelligence sharing.
   • BIt focuses solely on the technical aspects of the attack, ignoring the human element.
   • CIt provides a step-by-step timeline of the attack from initial reconnaissance to data exfiltration.
   • DIt emphasizes the relationships between the attacker, infrastructure, capability, and victim, which helps in identifying patterns across multiple intrusions.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the Diamond Model of Intrusion, which core feature is the organization or person that is being attacked?

   • AVictim
   • BAdversary
   • CInfrastructure
   • DCapability
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an incident investigation, the analyst identifies that a known threat actor used a compromised web server as a relay to deliver a custom backdoor to a targeted employee's laptop. The backdoor communicates with a domain registered specifically for this campaign. In the Diamond Model of Intrusion, which element is the compromised web server?

   • ACapability
   • BAdversary
   • CVictim
   • DInfrastructure
   Reveal Solution Discussion Select an answer first