2.25 Determine the Tactics, Techniques, and Procedures (TTPs) from an Attack 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is reviewing a Windows event log from a compromised host. The log shows that a process named 'svchost.exe' executed a PowerShell command that downloaded a file from a remote server. The file was then executed and made a network connection to an IP address on port 445. Which TTP is most likely indicated by the network connection to port 445?

   • AImpact – Data Destruction
   • BCommand and Control – Application Layer Protocol
   • CLateral Movement – Remote Services (SMB/Windows Admin Shares)
   • DExfiltration – Exfiltration Over C2 Channel
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the context of TTP categorization, which of the following correctly orders the levels from broadest to most specific?

   • ATechnique → Tactic → Procedure
   • BProcedure → Technique → Tactic
   • CTactic → Technique → Procedure
   • DTactic → Procedure → Technique
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A security analyst is reviewing firewall logs and sees a series of outbound connections to a known command-and-control (C2) IP address on port 443. Which TTP is most directly indicated by this evidence?

   • AExfiltration
   • BPersistence
   • CPrivilege Escalation
   • DCommand and Control
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   During an incident, a security analyst observes that the attacker first gained access through a phishing email, then moved laterally using SMB, and finally exfiltrated data via HTTPS. Which term best describes the overall sequence of these actions?

   • AIndicators of compromise (IOCs)
   • BTactics, techniques, and procedures (TTPs)
   • CThreat intelligence feed
   • DAttack surface
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An incident response team is analyzing a compromised network. The evidence shows that an attacker used a legitimate remote desktop protocol (RDP) to access a workstation, then used a PowerShell script to enumerate Active Directory, and finally used SMB to copy files from a file server. The team needs to determine the most likely TTPs for lateral movement. Which technique is most directly associated with the SMB file copy?

   • ARemote Services – SMB/Windows Admin Shares
   • BValid Accounts
   • CData from Network Shared Drive
   • DAccount Discovery
   Reveal Solution Discussion Select an answer first