Attacker Methodology and Cyber Kill Chain CSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium · select all that apply

   A SOC analyst is reviewing logs from a compromised Linux server. Which of the following are indicators of compromise (IoCs) that would be associated with the Installation and Command and Control phases of the kill chain? Select all that apply.

   • AA recently added user account with UID 0
   • BOutbound connections to an IP address on port 4444
   • CA new cron job that runs a script every 5 minutes
   • DA large number of DNS queries to a single domain
   Check answers Discussion Select an answer first
2. 17expert · hard

   A SOC team is mapping an incident to MITRE ATT&CK. The attacker used a vulnerability in an internet-facing web server to gain a foothold, then moved laterally to internal hosts using pass-the-hash, and finally exfiltrated data via DNS tunneling. Which ATT&CK tactics correspond to the kill chain phases of Exploitation, Installation, and Actions on Objectives, respectively?

   • AExecution, Defense Evasion, Exfiltration
   • BInitial Access, Lateral Movement, Exfiltration
   • CInitial Access, Persistence, Exfiltration
   • DExecution, Persistence, Collection
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An incident responder is analyzing a compromised Windows host. The attacker has established persistence by creating a Windows service that runs a malicious binary. The service is configured to restart automatically if it fails. Additionally, the attacker has set up a C2 channel using HTTPS. Which of the following is the MOST effective way to disrupt the attacker's persistence and C2 while preserving evidence for further analysis?

   • ATake a memory image, then stop the service and block the C2 domain
   • BDelete the malicious service and block the C2 domain at the firewall
   • CDisable the service and change the firewall rules to allow the C2 traffic for monitoring
   • DQuarantine the host and immediately reimage it
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An attacker crafts a malicious PDF file and hosts it on a website. The attacker then sends a link to the PDF via a social media message to a targeted employee. In the Cyber Kill Chain, which phase is the act of sending the link?

   • AInstallation
   • BExploitation
   • CDelivery
   • DWeaponization
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a potential indicator of compromise (IoC) associated with the command and control phase?

   • AA file with a suspicious name is downloaded from the internet.
   • BA new user account is created on a domain controller.
   • CA system makes periodic connections to an IP address that is not on any allowlist.
   • DA user receives a phishing email with a malicious attachment.
   Reveal Solution Discussion Select an answer first