3.3 Describe the Role of Attribution in an Investigation 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization has experienced a data breach. The incident response team is preparing to attribute the attack. They have identified several affected systems, including a domain controller, a file server, and a workstation. Which step is most important for the attribution process?

   • AFocus only on the domain controller because it is the most critical asset.
   • BInventory all affected assets and determine their roles in the attack path.
   • CContact law enforcement before collecting any evidence.
   • DImmediately reimage all affected systems to prevent further damage.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A SOC analyst is monitoring a network and observes a series of actions: multiple failed logins, then a successful login, then the creation of a new user account, and finally the execution of a script that downloads additional tools. The analyst needs to determine if this is an ongoing attack and what to report for attribution. Which finding is most indicative of an ongoing attack?

   • AThe downloaded tools are IOCs that prove the attack is from a known actor.
   • BThe creation of a new user account is a typical administrative action and not suspicious.
   • CThe sequence of actions shows a clear attack chain, indicating an active adversary.
   • DThe failed logins are evidence of a brute-force attack that has already ended.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC analyst is monitoring an ongoing attack where the attacker is using a known technique, but the specific tools and infrastructure are new. The analyst needs to decide whether to focus on IOAs or IOCs for attribution. Which approach is most effective?

   • AFocus on IOAs because they reveal the attacker's behavior and can be compared to known actor tactics, even if the tools are new.
   • BFocus on IOCs because they are more concrete and easier to attribute.
   • CWait until the attack is over to collect IOCs for attribution.
   • DIgnore both IOAs and IOCs and focus on the attacker's motivation.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During an incident, a security analyst finds a malicious PowerShell script on a compromised workstation. The script contains a unique hardcoded IP address and a user-agent string that matches a known adversary's toolset. The analyst wants to use these artifacts to support attribution. Which action best leverages these findings?

   • ADocument the IP address and user-agent as indicators of compromise and correlate them with threat intelligence feeds.
   • BAttribute the attack to the actor associated with the IP address without further analysis.
   • CImmediately block the IP address at the firewall and close the case, since the attack is contained.
   • DDelete the script from the workstation to prevent further spread and note the incident as resolved.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is considering whether to share IOCs from a recent breach with a government agency. The legal team is concerned about the chain of custody and potential legal exposure. What is the best course of action?

   • ADo not share any IOCs to protect the company from legal liability.
   • BShare only the IOCs that are not considered sensitive.
   • CShare the IOCs under a non-disclosure agreement and maintain a detailed record of what was shared.
   • DShare the IOCs without any restrictions to help the government's investigation.
   Reveal Solution Discussion Select an answer first