Attacker Methodology and Cyber Kill Chain CSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a common method used by attackers to deliver a malicious payload to a target?

   • AExploiting a vulnerability in a web application.
   • BPhishing emails with malicious attachments.
   • CInstalling a backdoor on the target system.
   • DPort scanning the target's network.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During an investigation, you find that a compromised host is using HTTP requests to a legitimate-looking website to receive commands. The requests are formatted as normal web traffic and occur at random intervals. What is the most likely purpose of this behavior, and which IoC would be most useful for detection?

   • ACommand and Control; the domain name and request patterns
   • BData exfiltration; the size of the HTTP responses
   • CPersistence; the scheduled task that runs the HTTP client
   • DReconnaissance; the IP addresses of the web server
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of exploitation?

   • AAn attacker installs a backdoor for persistent access.
   • BAn attacker sends a phishing email to an employee.
   • CAn attacker uses a buffer overflow vulnerability to run a remote shell.
   • DAn attacker scans a network for open ports.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   During an incident response, you discover that an attacker has been exfiltrating data from a database server over the past two weeks. The exfiltration uses the same C2 channel that was established after the initial compromise. The attacker has also deleted some logs on the server. Which action should you take FIRST to preserve evidence and stop further data loss?

   • ABlock the C2 channel at the firewall and take the server offline
   • BChange the database passwords and notify the data owner
   • CTake a memory image and then block the C2 channel
   • DImmediately shut down the server to prevent further access
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the context of attacker methodology, which statement best describes the typical mindset of a cyber attacker?

   • AAttackers focus on achieving their objective with minimal detection, often adapting their approach based on the target's defenses.
   • BAttackers always aim to cause maximum disruption to the target's operations, regardless of the objective.
   • CAttackers primarily rely on luck and random chance rather than systematic planning and reconnaissance.
   • DAttackers follow a linear, predictable sequence of steps that never deviates from a standard playbook.
   Reveal Solution Discussion Select an answer first