Cyber Kill Chain and MITRE ATT&CK Frameworks CTIA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary goal of the delivery phase?

   • ATo gather information about the target
   • BTo maintain persistence on the target
   • CTo execute the malicious code on the target
   • DTo get the weaponized payload to the target system
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How do ATT&CK techniques and sub-techniques support detection?

   • ABy identifying the exact malware family used
   • BBy automatically blocking all malicious activity
   • CBy providing a list of vulnerabilities to patch
   • DBy providing specific behaviors to look for in logs and alerts
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a common C2 communication method?

   • AHTTP requests to a malicious domain
   • BCreating a scheduled task
   • CSending a phishing email
   • DExploiting a buffer overflow
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A threat intelligence team is analyzing a new malware sample and wants to document its behavior in a way that can be compared with other samples. The team has identified that the malware uses a specific technique to evade detection by disabling security tools. Which ATT&CK element should the team use to record this behavior?

   • AMitigation
   • BTactic
   • CTechnique
   • DGroup
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In an attack scenario, if an attacker uses a spear-phishing email to deliver a malicious attachment, which Cyber Kill Chain phase is being observed?

   • AExploitation
   • BDelivery
   • CInstallation
   • DActions on Objectives
   Reveal Solution Discussion Select an answer first