Attack Methodology Frameworks CS0-003 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the Diamond Model of Intrusion Analysis, what does the 'Capability' component represent?

   • AThe motivation or intent behind the attack
   • BThe tools, techniques, or procedures used by the adversary
   • CThe network infrastructure used to communicate with the victim
   • DThe organization or individual targeted by the attack
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat intelligence analyst is correlating data from two separate incidents. In Incident A, a known APT group used a specific malware variant against a financial institution. In Incident B, a different malware variant was used against a utility company, but the analyst notices the same command-and-control server IP address was used. Using the Diamond Model, which of the following is the most logical hypothesis to form?

   • AThe two incidents are unrelated because the malware variants are different.
   • BThe same adversary is likely responsible for both incidents because they share the same infrastructure.
   • CThe utility company is the adversary in Incident B because it was the victim.
   • DThe financial institution is the infrastructure in Incident A because it was attacked.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During an incident investigation, an analyst identifies that a specific IP address (10.0.0.50) was used to brute-force a web server. The analyst then finds the same IP address was used to log into a VPN with a stolen account. The analyst creates a graph showing the IP address as a central node connected to both the web server and the VPN. In the Diamond Model, which element is the analyst primarily documenting?

   • AThe victim
   • BThe adversary
   • CThe infrastructure
   • DThe capability
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A penetration tester is assessing a web application. The tester has identified a potential SQL injection vulnerability in the login form. The tester wants to confirm the vulnerability and understand its impact. Which of the following actions, guided by the OWASP Testing Guide, is the most appropriate next step?

   • AImmediately exploit the vulnerability to extract the entire database.
   • BReport the vulnerability as confirmed based on the initial finding.
   • CUse a boolean-based technique to confirm the vulnerability without causing damage.
   • DMove on to test other vulnerabilities and report the SQLi as a potential issue.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is investigating a breach where an attacker exploited a vulnerability in a public-facing web application to gain a foothold. The analyst then observes the attacker using a known hacking tool to escalate privileges on the server. In the Diamond Model, how would the analyst classify the 'known hacking tool'?

   • AAs the victim
   • BAs the adversary
   • CAs the infrastructure
   • DAs the capability
   Reveal Solution Discussion Select an answer first