1.1 Demonstrate Knowledge of the Cyber Kill Chain (e.g., Reconnaissance, Scanning, Enumeration, Gaining Access, Escalation of Privileges, Maintaining Access, Covering Tracks) and Recognize Intelligence Gaps CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An incident responder is examining a compromised Windows host and finds a new local user account that was created and added to the Administrators group. The account has a password that never expires. The responder also finds a service that is configured to run as this new user. Which phase of the cyber kill chain does the creation of this account and service most directly represent?

   • AMaintaining access.
   • BEscalation of privileges.
   • CGaining access.
   • DCovering tracks.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A threat hunter is analyzing a Linux server and discovers that a process is running with root privileges, but the process was started by a non-root user. The hunter traces the process and finds it exploited a vulnerable service to gain root access. Which phase of the cyber kill chain does the exploitation of the vulnerable service to gain root access represent?

   • ACovering tracks.
   • BMaintaining access.
   • CEscalation of privileges.
   • DGaining access.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary goal of the privilege escalation phase?

   • ATo establish a persistent presence on the system
   • BTo gather information about the target network
   • CTo obtain higher-level permissions than initially granted
   • DTo remove evidence of the intrusion
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A forensic analyst is investigating a breach and notices that the timestamps on several critical files have been modified to dates in the past. The analyst also finds that the security event logs have been cleared. Which phase of the cyber kill chain do these actions most directly represent?

   • ACovering tracks.
   • BMaintaining access.
   • CEscalation of privileges.
   • DGaining access.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst is reviewing threat intelligence and sees that a known adversary group has been observed using a specific set of IP addresses and domains. The analyst wants to search their own environment for any signs of this group's activity. Which type of reconnaissance technique is the analyst performing, and what is the primary intelligence gap?

   • APassive reconnaissance; the gap is whether the adversary has used the same infrastructure against the analyst's organization.
   • BActive reconnaissance; the gap is whether the adversary has scanned the analyst's network.
   • CEnumeration; the gap is whether the adversary has extracted user details.
   • DScanning; the gap is whether the adversary has identified a vulnerability.
   Reveal Solution Discussion Select an answer first