3.3 Describe the Role of Attribution in an Investigation 200-201 Practice Questions (Page 7)

Questions 31–31

1. 31expert · hard

   A security team is investigating a series of attacks that appear to be from the same actor. The attacks use different malware families but share the same command-and-control infrastructure and similar phishing lures. The team wants to attribute all attacks to one actor. Which approach is most defensible?

   • AIgnore the phishing lures because they are not technical indicators.
   • BUse the shared C2 infrastructure and phishing lures as common indicators to link the attacks to a single actor.
   • CConclude that the attacks are from different actors because the malware families are different.
   • DAttribute the attacks to the actor most commonly associated with the most sophisticated malware used.
   Reveal Solution Discussion Select an answer first