Attack Methodology Frameworks CS0-003 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A threat hunting team is reviewing a series of alerts. They notice a pattern where an attacker uses a legitimate system tool (PowerShell) to download a script from a remote server and execute it in memory. The team wants to document this behavior in a way that maps to the MITRE ATT&CK framework. Which two tactics should they assign to the actions of 'downloading the script' and 'executing it in memory', respectively?

   • AExecution and Exfiltration
   • BPersistence and Defense Evasion
   • CIngress Tool Transfer and Execution
   • DCommand and Scripting Interpreter and Execution
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A penetration tester is assessing a web application and has identified a potential cross-site scripting (XSS) vulnerability in a search field. The tester wants to confirm the vulnerability and understand its impact. Which of the following actions, guided by the OWASP Testing Guide, is the most appropriate next step?

   • AReport the vulnerability as confirmed based on the initial finding.
   • BImmediately exploit the vulnerability to steal session cookies.
   • CMove on to test other vulnerabilities and report the XSS as a potential issue.
   • DUse a harmless payload to confirm the vulnerability without causing damage.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center (SOC) analyst is documenting a recent incident. The attacker used a spear-phishing email to get an employee to click a link that downloaded a malicious file. The file then created a scheduled task for persistence. In MITRE ATT&CK, which two tactics are being documented by the actions of 'clicking the link' and 'creating a scheduled task'?

   • ACollection and Exfiltration
   • BCredential Access and Lateral Movement
   • CInitial Access and Persistence
   • DExecution and Defense Evasion
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An incident responder is analyzing a breach. The attacker used a phishing email to deliver a malicious attachment. The attachment was opened, and the malware executed. The malware then beaconed out to a command-and-control server. The responder is trying to map this to the Cyber Kill Chain. Which stage does the 'beaconing out to a command-and-control server' represent?

   • AExploitation
   • BCommand & Control
   • CInstallation
   • DActions on Objectives
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An incident responder is analyzing a breach. The attacker used a zero-day exploit to gain access to a server. After gaining access, the attacker downloaded a tool to the server to maintain persistence. The responder is trying to map this to the Cyber Kill Chain. Which stage does the 'downloading a tool to maintain persistence' represent?

   • AExploitation
   • BInstallation
   • CActions on Objectives
   • DCommand & Control
   Reveal Solution Discussion Select an answer first