Attacker Methodology and Cyber Kill Chain CSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard · select all that apply

   A SOC analyst is reviewing logs from a compromised Windows host. Which of the following are indicators of compromise (IoCs) that would be associated with the Exploitation and Installation phases of the kill chain? Select all that apply.

   • AA Windows event ID 4624 showing a successful logon with a new account
   • BA network connection to an external IP on port 443
   • CAn event log entry showing a new service was created
   • DA file creation event in the Startup folder
   Check answers Discussion Select an answer first
2. 32application · medium · select all that apply

   A SOC analyst is reviewing network traffic for indicators of compromise (IoCs). Which of the following are IoCs that could indicate the Command and Control (C2) phase? (Select all that apply.)

   • APeriodic beaconing to a known malicious domain
   • BA spike in outbound DNS queries to a dynamic DNS provider
   • CAn unusual protocol on port 443 with a high volume of data
   • DA new user account created on a server
   • EAn email with a malicious attachment
   Check answers Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of active reconnaissance?

   • ATo deliver a malicious payload to the target system.
   • BTo gather information without the target being aware of the attacker's presence.
   • CTo directly interact with the target's systems to identify vulnerabilities and open services.
   • DTo establish a command and control channel with the target.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In the Lockheed Martin Cyber Kill Chain, which phase involves the attacker creating a malicious payload tailored to exploit a specific vulnerability?

   • AWeaponization
   • BDelivery
   • CExploitation
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An analyst discovers a malicious document attached to a phishing email. The document contains an embedded macro that, when executed, downloads a second-stage payload from a URL. In which kill chain phase does the macro execution occur, and what is the primary IoC to look for in the email gateway logs?

   • AWeaponization; the macro code itself
   • BExploitation; the URL of the second-stage payload
   • CInstallation; the downloaded payload file hash
   • DDelivery; the email attachment
   Reveal Solution Discussion Select an answer first