Attacker Methodology and Cyber Kill Chain CSA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of the command and control (C2) phase in the Cyber Kill Chain?

   • ATo install malware on the target system.
   • BTo establish a communication channel between the attacker and the compromised system.
   • CTo exploit vulnerabilities in the target system.
   • DTo deliver the malicious payload to the target.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a common method used by attackers to create a weaponized payload?

   • AUsing a vulnerability scanner to identify open ports.
   • BSending a phishing email with a link to a malicious website.
   • CExploiting a vulnerability in a public-facing server.
   • DEmbedding a malicious macro in a Microsoft Word document.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After a successful phishing attack, the attacker runs a script that creates a scheduled task on the compromised Windows host. The scheduled task runs a PowerShell command every hour to check for a specific file on a remote server. Which two kill chain phases are directly supported by this scheduled task?

   • AExploitation and Actions on Objectives
   • BReconnaissance and Weaponization
   • CInstallation and Command and Control
   • DWeaponization and Delivery
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   A SOC analyst is reviewing a compromised host. The analyst has identified the following artifacts: a scheduled task that runs a PowerShell script, a registry key that adds a backdoor user, and a network connection to a known C2 server. Which of the following kill chain phases are represented by these artifacts? (Select all that apply.)

   • ACommand and Control
   • BDelivery
   • CActions on Objectives
   • DWeaponization
   • EInstallation
   Check answers Discussion Select an answer first
6. 5expert · hard

   A SOC analyst is investigating a potential attack. The analyst notices that an external IP address has been performing port scans on the company's public-facing servers for the past week. The scans are low and slow, and no exploitation has been detected. The analyst must decide whether to block the IP address. Which consideration is most important in this decision?

   • AThe IP address is likely a false positive and should be ignored
   • BThe IP address should be blocked immediately to prevent further reconnaissance
   • CThe IP address is not a threat because no exploitation has occurred
   • DThe IP address may be a legitimate security scanner used by a third party
   Reveal Solution Discussion Select an answer first