Attacker Methodology and Cyber Kill Chain CSA Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC team is mapping an incident to MITRE ATT&CK. The attacker used a spear-phishing email with a malicious link to gain initial access, then used a PowerShell script to download and execute a payload, and finally established persistence by creating a registry run key. Which ATT&CK tactics correspond to the kill chain phases of Delivery, Exploitation, and Installation, respectively?

   • ADelivery, Execution, Persistence
   • BInitial Access, Execution, Persistence
   • CInitial Access, Exploitation, Persistence
   • DDelivery, Exploitation, Installation
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst discovers a malicious document attached to a phishing email. The document contains an embedded macro that, when executed, downloads a second-stage payload from a remote server. In the Cyber Kill Chain, which phase does the macro execution represent?

   • AWeaponization
   • BExploitation
   • CDelivery
   • DInstallation
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following is a potential indicator of compromise (IoC) associated with the reconnaissance phase of the Cyber Kill Chain?

   • AAn unexpected spike in DNS queries for domain names that resemble the target's domain.
   • BUnusual outbound traffic to a known malicious IP address.
   • CA new scheduled task created on a critical server.
   • DA large number of failed login attempts from a single IP address.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In the Cyber Kill Chain, what occurs during the exploitation phase?

   • AThe attacker creates a malicious document with an embedded exploit.
   • BThe attacker establishes a command and control channel with the compromised system.
   • CThe attacker triggers a vulnerability to execute code on the target system.
   • DThe attacker gathers information about the target from public sources.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A SOC analyst is reviewing firewall logs and notices repeated DNS queries to a domain that was registered three days ago and has no associated web content. The queries originate from a single internal host and occur every 10 minutes. Which kill chain phase does this activity most likely represent, and what should the analyst do first?

   • AActions on Objectives; check for data exfiltration
   • BDelivery; quarantine the host immediately
   • CReconnaissance; block the domain at the firewall
   • DCommand and Control; investigate the host for signs of compromise
   Reveal Solution Discussion Select an answer first