2.25 Determine the Tactics, Techniques, and Procedures (TTPs) from an Attack 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is investigating a breach where an attacker used a phishing email to deliver a malicious macro. The macro executed PowerShell to download a C2 agent. The agent then used a legitimate Windows utility (bitsadmin) to download additional tools. The attacker also used a previously compromised domain admin account to access multiple servers via SMB. The team needs to document the TTPs in a way that prioritizes the most critical actions. Which TTP should be documented as the primary technique for the initial access?

   • AValid Accounts
   • BExploit Public-Facing Application
   • CPhishing
   • DCommand and Scripting Interpreter
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An incident responder is analyzing a host that was compromised via a malicious USB device. The USB device presented itself as a keyboard and typed commands to open a PowerShell console and download a payload. The payload then established persistence by modifying the registry run key. Which MITRE ATT&CK technique is NOT directly observed?

   • AExploitation for Privilege Escalation
   • BCommand and Scripting Interpreter
   • CHardware Additions
   • DRegistry Run Keys / Startup Folder
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During a threat hunt, you notice that a user account was used to create a new local administrator account on multiple workstations. The account creation was followed by a scheduled task that ran a script to exfiltrate data to an external IP. Which two MITRE ATT&CK tactics are primarily demonstrated?

   • ADefense Evasion and Command and Control
   • BPrivilege Escalation and Collection
   • CLateral Movement and Impact
   • DPersistence and Exfiltration
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst observes that an attacker used a spearphishing email to deliver a malicious attachment, which then executed a script to download a remote access tool. In categorizing this behavior, which of the following is the 'procedure'?

   • ASpearphishing attachment
   • BInitial access
   • CThe remote access tool used
   • DThe exact content of the spearphishing email and the specific commands in the script
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is examining a memory dump from a compromised server. The analysis reveals that a process injected code into another legitimate process (e.g., explorer.exe). The injected code then made a network connection to an external IP address. Which MITRE ATT&CK technique is most directly indicated by the process injection?

   • ACommand and Scripting Interpreter
   • BExploitation for Privilege Escalation
   • CApplication Layer Protocol
   • DProcess Injection
   Reveal Solution Discussion Select an answer first