2.25 Determine the Tactics, Techniques, and Procedures (TTPs) from an Attack 350-201 Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A security analyst is reviewing logs from a compromised workstation. The logs show that a user received a spear-phishing email with a malicious macro-enabled document. After opening the document, a PowerShell command executed that downloaded and ran a remote script. The script then created a scheduled task to maintain persistence. Which sequence of MITRE ATT&CK tactics best matches this attack chain?

   • AInitial Access → Persistence → Execution
   • BPersistence → Execution → Initial Access
   • CInitial Access → Execution → Persistence
   • DExecution → Initial Access → Persistence
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is investigating a sophisticated attack. The attacker used a zero-day exploit in a web browser to gain initial access. After gaining access, the attacker used a PowerShell script to download and execute a C2 agent. The C2 agent then used a legitimate cloud storage service (e.g., Dropbox) for command and control. The team needs to document the TTPs. Which technique is most appropriate for the use of cloud storage for C2?

   • AExfiltration Over Web Service
   • BWeb Service
   • CIngress Tool Transfer
   • DApplication Layer Protocol
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is reviewing a web server access log. The log shows a request to '/admin/login.php' with a POST parameter containing a long string of SQL commands. The response was a 200 OK with an error message revealing database table names. The analyst needs to identify the TTP. Which MITRE ATT&CK technique is most clearly indicated?

   • AInput Validation
   • BCommand and Scripting Interpreter
   • CExploitation of Remote Services
   • DSQL Injection
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst is categorizing an attack where an attacker used a phishing email to deliver a malicious attachment. The attachment, when opened, executed a PowerShell script that downloaded a second-stage payload. The payload then established persistence by creating a Windows service. Which combination of MITRE ATT&CK tactics is most directly observed?

   • AInitial Access, Execution, Defense Evasion
   • BInitial Access, Execution, Privilege Escalation
   • CInitial Access, Execution, Command and Control
   • DInitial Access, Execution, Persistence
   Reveal Solution Discussion Select an answer first