3.3 Describe the Role of Attribution in an Investigation 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During an investigation, an analyst identifies a series of IOCs that include a specific malware family, a command-and-control domain, and a unique encryption routine. The analyst wants to use these to infer the likely threat actor. Which approach is most effective?

   • AAssume the attack is from a nation-state because the malware is sophisticated.
   • BCompare the IOCs against known threat actor profiles and malware repositories to find a match.
   • CConclude the attack is from a known cybercrime group because the malware is available for sale.
   • DUse the encryption routine to directly identify the individual hacker's identity.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is an indicator of compromise (IOC)?

   • AA piece of forensic evidence that suggests a system has been breached or is infected with malware
   • BA real-time alert that indicates an attack is currently in progress
   • CA type of firewall rule that blocks malicious traffic
   • DA list of all software installed on a system
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A large enterprise has suffered a data breach. The incident response team has identified several IOCs, including a unique malware hash and a C2 domain. The team also has a list of affected assets. However, the CEO wants to know who is behind the attack. The team has limited time and budget. What is the most appropriate approach to attribution?

   • AImmediately attribute the attack to a known APT group based on the malware hash.
   • BHire an external threat intelligence firm to conduct attribution.
   • CConduct a full forensic analysis of all affected assets to find any additional IOCs.
   • DCorrelate the identified IOCs with threat intelligence feeds and prioritize assets that are most critical.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of an indicator of attack (IOA)?

   • AAn email attachment with a malicious macro
   • BA file hash matching known malware
   • CA suspicious registry entry left by a trojan
   • DAn unusual sequence of commands executed by a user account that indicates privilege escalation
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A forensic analyst is collecting evidence from a compromised server. The analyst takes a forensic image of the hard drive and then begins analyzing it. Later, the analyst needs to present the evidence in court. What must the analyst have maintained to ensure the evidence is admissible?

   • AA written report summarizing the findings, without any documentation of the collection process.
   • BA detailed log of who accessed the original evidence and when, along with a secure storage history.
   • CA copy of the original hard drive stored in a safe location.
   • DThe original hard drive kept in the analyst's desk drawer for easy access.
   Reveal Solution Discussion Select an answer first