3.3 Describe the Role of Attribution in an Investigation 200-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC analyst is monitoring a network and sees a series of failed login attempts followed by a successful login from an unusual location. The analyst also notices that the user is downloading a large amount of data. Which observation is an indicator of attack (IOA) rather than an indicator of compromise (IOC)?

   • AThe unusual location of the login.
   • BThe series of failed login attempts.
   • CThe user downloading a large amount of data.
   • DThe successful login from an unusual location.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a breach and has collected several IOCs, including a file hash, a domain, and an IP address. The analyst wants to attribute the attack to a specific threat actor. However, the file hash is not found in any threat intelligence feed, the domain is known to be used by multiple actors, and the IP address is a proxy. Which action is most appropriate?

   • AConclude that the attack cannot be attributed because the file hash is unknown.
   • BUse the combination of the domain and IP address to narrow down the possible actors, while acknowledging the uncertainty.
   • CAttribute the attack to the actor most commonly associated with the domain.
   • DIgnore the IP address because it is a proxy and not useful.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is investigating a breach where an attacker exfiltrated data from a finance server. The analyst has identified a suspicious file hash and a domain used for command-and-control. The incident response team needs to preserve evidence for potential legal action. What should the analyst do to support attribution while maintaining evidence integrity?

   • AIsolate the finance server and wipe the suspicious file to prevent further damage.
   • BRecord the file hash and domain, and ensure all evidence is collected and stored following chain of custody procedures.
   • CCopy the suspicious file to a forensic workstation and begin analyzing it immediately.
   • DDocument the file hash and domain in the case file and continue monitoring for additional IOCs.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An incident response team is investigating a breach where the attacker used a known exploit kit, but also used a custom dropper that has never been seen before. The team has limited time and must decide how to allocate resources for attribution. Which approach balances effort and accuracy best?

   • AFocus only on the exploit kit because it is known and has public attribution.
   • BPrioritize analysis of the custom dropper and correlate it with the exploit kit's known infrastructure.
   • CConclude that the attack is from a nation-state because the custom dropper is sophisticated.
   • DSpend all available time analyzing the custom dropper, ignoring the exploit kit.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which action is a key requirement for maintaining a proper chain of custody?

   • ADocumenting every person who handles the evidence and when
   • BDeleting original evidence after analysis is complete
   • CStoring evidence on the investigator's personal laptop for convenience
   • DMaking copies of the evidence and distributing them to all team members
   Reveal Solution Discussion Select an answer first