Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of a technical indicator of compromise (IoC) for an APT?

   • AAn employee reporting a suspicious email
   • BA change in company policy
   • CA sudden increase in help desk tickets
   • DAn unusual outbound connection to a known malicious IP address
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An incident responder is analyzing a breach where the attacker gained access through a phishing email, then used a legitimate remote administration tool to move to the domain controller, and finally exfiltrated data via DNS queries. The responder needs to identify the earliest stage where detection could have occurred to minimize damage. Which stage of the Cyber Kill Chain should the responder focus on to prevent the attack from progressing?

   • AActions on objectives, by monitoring data transfers.
   • BCommand and control, by detecting DNS exfiltration.
   • CExploitation, by patching the vulnerability used by the email attachment.
   • DDelivery, by blocking the phishing email before it reaches the user.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A mid-sized financial services firm has been experiencing a series of targeted phishing emails that contain no malware but ask employees to click links that lead to fake login pages. The emails are personalized with job titles and recent projects. The firm's leadership wants to understand the most likely threat actor and their primary motivation to guide defensive priorities. Which assessment is most accurate?

   • AA cybercriminal group motivated by financial gain, using spear-phishing to steal credentials for fraud or resale.
   • BAn insider threat motivated by revenge, attempting to discredit the firm by leaking credentials.
   • CA hacktivist group motivated by ideology, aiming to expose the firm's business practices.
   • DA nation-state actor motivated by espionage, seeking long-term intelligence on the firm's clients.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A hospital experiences a ransomware attack that encrypts patient records and disrupts its appointment system for three days. The hospital's reputation suffers, and it faces regulatory fines. Which impact category is most directly illustrated by the disruption of the appointment system?

   • AFinancial loss only.
   • BReputational damage only.
   • CLegal consequences only.
   • DOperational disruption.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An incident response team is mapping an APT attack to the Cyber Kill Chain. They have identified the following events: (1) an attacker scanned the network for open ports, (2) sent a spear-phishing email with a malicious link, (3) exploited a browser vulnerability, (4) installed a backdoor, (5) established C2, and (6) exfiltrated data. Which stage is missing from this mapping?

   • AWeaponization
   • BActions on Objectives
   • CDelivery
   • DExploitation
   Reveal Solution Discussion Select an answer first