Attacker Methodology and Cyber Kill Chain CSA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following best describes the weaponization phase of the Cyber Kill Chain?

   • AThe attacker gains access to the target system and installs a backdoor.
   • BThe attacker sends a phishing email to a target employee.
   • CThe attacker identifies a vulnerability in the target's web application.
   • DThe attacker creates a malicious document that contains an exploit for a known vulnerability.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC team has detected a compromised server that is exfiltrating data via HTTPS to a legitimate cloud storage service. The data transfer is encrypted and blends in with normal traffic. The team has limited resources and must prioritize containment. Which action is most effective in stopping the exfiltration while preserving evidence?

   • AMonitor the traffic for a few more hours to gather more evidence
   • BBlock the cloud storage service's IP range at the firewall
   • CDisable the server's network interface
   • DIsolate the compromised server from the network
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC analyst notices a large volume of data being transferred from an internal database server to an external IP address during non-business hours. The transfer uses an encrypted channel. Which kill chain phase is this activity most characteristic of, and what is the most relevant IoC to collect?

   • AActions on Objectives; the volume and destination of the transfer
   • BCommand and Control; the external IP address
   • CWeaponization; the encryption method used
   • DInstallation; the database server's logs
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which phase of the Lockheed Martin Cyber Kill Chain occurs after the attacker has successfully executed code on the target system and is focused on ensuring continued access?

   • AActions on Objectives
   • BCommand and Control
   • CExploitation
   • DInstallation
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is mapping an incident to the MITRE ATT&CK framework. The attacker used a spear-phishing email with a malicious attachment to gain initial access, then used PowerShell to download and execute a payload. Which two ATT&CK tactics correspond to the kill chain phases of Delivery and Exploitation, respectively?

   • AExecution and Persistence
   • BInitial Access and Persistence
   • CDelivery and Weaponization
   • DInitial Access and Execution
   Reveal Solution Discussion Select an answer first