2.25 Determine the Tactics, Techniques, and Procedures (TTPs) from an Attack 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is examining a compromised host. The evidence shows that an attacker used a legitimate remote desktop protocol (RDP) connection to access the host, then disabled the Windows Defender firewall, and finally used a built-in Windows utility (certutil) to download a malicious executable. Which MITRE ATT&CK technique is best associated with the use of certutil?

   • ACommand and Scripting Interpreter
   • BDisable or Modify Tools
   • CIngress Tool Transfer
   • DRemote Desktop Protocol
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When mapping an observed attacker behavior to MITRE ATT&CK, which of the following is the correct approach?

   • AIdentify the tactic (e.g., 'Initial Access') and then the specific technique (e.g., 'Spearphishing Attachment')
   • BIdentify the procedure (e.g., exact commands) and then the tactic
   • CAssign a severity score to the behavior
   • DMap the behavior directly to a CVE number
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team is documenting an attack where the attacker used a spear-phishing email with a malicious attachment to gain initial access. After execution, the attacker used a PowerShell script to enumerate the local network and then used RDP to move to another host. Which MITRE ATT&CK tactic is the PowerShell enumeration most directly associated with?

   • ADiscovery
   • BLateral Movement
   • CCollection
   • DExecution
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an incident, you find that an attacker used a legitimate remote monitoring and management (RMM) tool to access a workstation remotely. The RMM tool was installed silently using a compromised admin account. Which MITRE ATT&CK technique is most directly demonstrated by the use of the RMM tool?

   • AValid Accounts
   • BRemote Access Software
   • CPhishing
   • DCommand and Scripting Interpreter
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is reviewing Windows event logs from a compromised server. The logs show that a user account was created and added to the local administrators group. The analyst also sees that the new account was used to schedule a task that runs a script every hour. Which two MITRE ATT&CK techniques are most clearly indicated?

   • ACreate Account and Account Manipulation
   • BCreate Account and Scheduled Task
   • CCreate Account and Boot or Logon Autostart Execution
   • DValid Accounts and Scheduled Task
   Reveal Solution Discussion Select an answer first