Attacker Methodology and Cyber Kill Chain CSA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is an example of an action on objectives?

   • AAn attacker installs a backdoor on a compromised system.
   • BAn attacker sends a phishing email to a target.
   • CAn attacker scans a network for open ports.
   • DAn attacker exfiltrates sensitive customer data from a compromised database.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common method used by attackers to establish command and control?

   • AUsing HTTP or HTTPS to communicate with a malicious server.
   • BSending phishing emails to employees.
   • CExploiting a buffer overflow vulnerability.
   • DScanning for open ports on the target network.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary goal of the delivery phase in the Cyber Kill Chain?

   • ATo identify vulnerabilities in the target's systems.
   • BTo create a malicious payload tailored to the target.
   • CTo get the weaponized payload to the target system or user.
   • DTo execute the payload on the target system.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC analyst is monitoring network traffic and sees a series of TCP connection attempts to multiple IP addresses on port 445 from a single internal host. The attempts are unsuccessful and occur in a short time frame. Which kill chain phase does this activity represent, and what is the most likely goal?

   • ADelivery; attempting to transfer a malicious payload
   • BReconnaissance; identifying vulnerable systems on the network
   • CCommand and Control; establishing communication with other hosts
   • DExploitation; attempting to exploit the SMB service
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC team detects a large outbound transfer of data from a database server to an external IP address. The transfer occurs outside business hours and uses a protocol not typically used by the application. The server has been compromised for several weeks. Which kill chain phase is the attacker currently in?

   • ACommand and Control
   • BExploitation
   • CActions on Objectives
   • DInstallation
   Reveal Solution Discussion Select an answer first