Cyber Kill Chain and MITRE ATT&CK Frameworks CTIA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An analyst is creating a report that combines the Cyber Kill Chain and MITRE ATT&CK to describe an intrusion. The attacker performed reconnaissance, then sent a spearphishing email, and later established persistence. Which mapping is correct?

   • AReconnaissance → Reconnaissance; Delivery → Initial Access; Installation → Persistence
   • BReconnaissance → Discovery; Delivery → Persistence; Installation → Execution
   • CReconnaissance → Initial Access; Delivery → Execution; Installation → Defense Evasion
   • DReconnaissance → Resource Development; Delivery → Initial Access; Installation → Execution
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is reviewing an incident where an attacker used a legitimate remote administration tool to move laterally and exfiltrate data. The team is debating whether to block the tool entirely or allow it with restrictions. The tool is used by IT staff for legitimate remote support. Which approach best balances security and operational needs?

   • ABlock the tool entirely to prevent misuse
   • BAllow the tool but restrict its use to approved IT staff and monitor its usage
   • CUse a different tool for remote support that is not used by attackers
   • DAllow the tool without restrictions to avoid impacting operations
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A threat intelligence analyst is compiling a report on an intrusion that used a specific remote access trojan and a custom dropper. The analyst wants to link this activity to a known threat actor group to enrich the report. Which ATT&CK resource should the analyst consult to find the association between the malware and the group?

   • AThe ATT&CK Tactics page, which lists the goals of the adversary
   • BThe ATT&CK Techniques page, which lists all known techniques
   • CThe ATT&CK Groups page, which lists groups and their associated software
   • DThe ATT&CK Mitigations page, which lists defensive measures
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is a common persistence mechanism used during the installation phase?

   • AExploiting a buffer overflow
   • BSending a phishing email
   • CCreating a scheduled task
   • DScanning for open ports
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An incident response team is analyzing a compromised host that is beaconing to a domain that resolves to a CDN IP address. The beaconing is over HTTPS and uses a legitimate-looking user agent. The team suspects data exfiltration but cannot confirm. Which action would provide the most useful information to confirm exfiltration while minimizing disruption to the business?

   • ACapture and analyze the TLS session keys from the compromised host
   • BPerform a memory dump of the compromised host
   • CReview DNS logs for other domains
   • DBlock the domain at the firewall
   Reveal Solution Discussion Select an answer first