Attacker Methodology and Cyber Kill Chain CSA Practice Questions (Page 10)

Questions 46–49

1. 46application · medium

   A SOC analyst is mapping an incident to MITRE ATT&CK. The attacker used a compromised credential to access a VPN, then used PowerShell to download and execute a payload, and finally established a C2 channel. Which ATT&CK tactic corresponds to the 'Command and Control' phase of the Cyber Kill Chain?

   • AExfiltration
   • BExecution
   • CCommand and Control
   • DPersistence
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A SOC analyst is explaining the Cyber Kill Chain to a new team member. The analyst describes a scenario where an attacker first scans the network for open ports, then sends a phishing email with a malicious attachment, and finally exfiltrates data. Which sequence of kill chain phases is correct?

   • AReconnaissance → Exploitation → Installation
   • BWeaponization → Delivery → Exploitation
   • CReconnaissance → Delivery → Actions on Objectives
   • DDelivery → Exploitation → Actions on Objectives
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which of the following is the most accurate description of the general phases of a cyber attacker's methodology?

   • AReconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
   • BScanning, enumeration, exploitation, privilege escalation, and data exfiltration.
   • CFootprinting, social engineering, phishing, malware installation, and cleanup.
   • DInformation gathering, vulnerability analysis, exploitation, and post-exploitation.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A SOC analyst is reviewing an alert for a web application. The log shows a series of requests to a login page with different usernames and passwords. The requests originate from a single IP address and occur over a short period. No successful login has occurred. Which kill chain phase is the analyst most likely observing?

   • AActions on Objectives
   • BExploitation
   • CDelivery
   • DReconnaissance
   Reveal Solution Discussion Select an answer first