Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A threat intelligence analyst is documenting the TTPs of an APT group. The analyst notes that the group uses spear-phishing with malicious Office documents, then uses PowerShell to download additional tools, and finally uses SMB for lateral movement. Which TTP is the analyst documenting?

   • AExecution via PowerShell.
   • BInitial access via spear-phishing.
   • CLateral movement via SMB.
   • DA combination of initial access, execution, and lateral movement TTPs.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which threat actor is most commonly motivated by financial gain?

   • AState-sponsored actors
   • BHacktivists
   • CCybercriminals
   • DInsiders
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization's security team notices that a small number of files in a shared drive have been modified over several months, with timestamps that appear legitimate. Network logs show periodic, brief connections to an external IP address that is not on any blocklist. The team suspects an APT. Which combination of characteristics most strongly supports this suspicion?

   • ARapid, noisy exploitation with immediate financial gain and public disclosure.
   • BAutomated worm propagation with no human interaction and mass data destruction.
   • CStealthy, persistent presence with long-term objectives and low-and-slow data exfiltration.
   • DSingle-stage attack using commodity malware and short-lived command-and-control.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial institution suffers a data breach that exposes customer credit card numbers. The breach leads to fraudulent transactions, a drop in customer trust, and a fine from regulators. Which impact is most directly associated with the fraudulent transactions?

   • AFinancial loss.
   • BLegal penalties.
   • CReputational damage.
   • DOperational disruption.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A threat intelligence analyst is profiling an attacker who has been conducting targeted attacks against government agencies. The attacker uses sophisticated malware, operates during business hours in the target's time zone, and appears to be funded by a nation-state. Which threat actor type and motivation best describe this attacker?

   • ACybercriminal motivated by financial gain.
   • BState-sponsored actor motivated by espionage.
   • CInsider threat motivated by disgruntlement.
   • DHacktivist motivated by ideology.
   Reveal Solution Discussion Select an answer first