Cyber Kill Chain and MITRE ATT&CK Frameworks CTIA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   When analyzing an attack scenario using the Cyber Kill Chain and ATT&CK, what is a key benefit?

   • AIt helps identify gaps in defenses at each stage of the attack
   • BIt automatically blocks the attack in real time
   • CIt provides a legal basis for prosecuting the attacker
   • DIt guarantees the attack will not succeed
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   After exploiting a vulnerability in a web server, an attacker modifies a system service to run a malicious binary automatically at every boot. Which Cyber Kill Chain phase does this activity represent?

   • AActions on Objectives
   • BCommand and Control
   • CExploitation
   • DInstallation
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat intelligence team is documenting an adversary's behavior observed in a recent intrusion. They have identified that the adversary used PowerShell scripts to download and execute payloads, and then used scheduled tasks to maintain persistence. The team wants to structure this information using MITRE ATT&CK to improve detection coverage. Which approach best aligns with the ATT&CK framework's structure?

   • AClassify both actions as procedures under the same technique because they are part of the same intrusion.
   • BRecord the PowerShell usage as a tactic and the scheduled task as a technique under that tactic.
   • CCreate a new tactic called 'Scripting' to capture both behaviors, since ATT&CK allows custom tactics.
   • DMap the PowerShell execution to the Execution tactic and the scheduled task to the Persistence tactic, then identify the specific techniques and sub-techniques for each.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An attacker has established command and control over a compromised workstation and is now moving laterally across the network to access a database containing sensitive customer records. The attacker plans to copy the data to an external server. Which Cyber Kill Chain phase best describes the attacker's current activity?

   • AWeaponization
   • BActions on Objectives
   • CCommand and Control
   • DInstallation
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A threat actor is preparing a targeted attack against a financial institution. The actor has identified a vulnerability in a commonly used PDF reader and has created a malicious PDF that exploits this vulnerability. The actor plans to email the PDF to employees. Which Cyber Kill Chain phase is the actor currently in?

   • AExploitation
   • BWeaponization
   • CDelivery
   • DReconnaissance
   Reveal Solution Discussion Select an answer first