3.3 Describe the Role of Attribution in an Investigation 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of threat actor profiling in an investigation?

   • ATo determine the exact geographic location of the attacker in real time
   • BTo identify the specific individual responsible for the attack
   • CTo categorize the attacker's behavior, motivations, and techniques to help narrow down likely culprits
   • DTo create a psychological profile of the attacker for courtroom testimony
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an investigation, an analyst finds a malicious file on a compromised host. The analyst wants to determine if this file is associated with a known threat actor. What is the most effective way to use this IOC for attribution?

   • ARun the file in a sandbox to observe its behavior.
   • BUpload the file to a public malware analysis service.
   • CSearch the file's strings for any usernames or paths.
   • DCompare the file's hash against a threat intelligence database.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During an investigation, an analyst discovers that a compromised workstation was used to pivot to a database server. The analyst needs to understand the full scope of the attack for attribution. Which step is most important?

   • AIdentify all assets involved in the attack path, including the workstation and database server.
   • BFocus on the database server because it contains sensitive data.
   • CIsolate the workstation and database server from the network immediately.
   • DCheck the database server's logs for the attacker's IP address.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An incident response team is analyzing a breach where the attacker used a zero-day exploit, custom malware, and a unique command-and-control protocol. The team wants to attribute the attack to a specific threat actor. Which information would be most useful?

   • ALook at the time of day the attack occurred to infer the actor's time zone.
   • BIdentify the vulnerability that was exploited and patch it immediately.
   • CCompare the custom malware and C2 protocol with known threat actor toolsets and infrastructure.
   • DDetermine the attacker's motivation by analyzing the data that was stolen.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a malware infection. The analyst finds a file hash, a registry key, and a network connection to a known malicious domain. The analyst wants to use these to support attribution. Which action is most appropriate?

   • ADelete the registry key and block the domain to contain the infection.
   • BSearch threat intelligence platforms for the file hash and domain to see if they are associated with a known threat actor.
   • CAttribute the attack to a specific actor based on the file hash alone.
   • DIgnore the network connection because it is not a reliable indicator.
   Reveal Solution Discussion Select an answer first