Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best describes an attack surface?

   • AThe security policies of an organization
   • BThe specific malware used in an attack
   • CThe total set of points where an unauthorized user can try to enter or extract data from a system
   • DThe network bandwidth available to an attacker
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a typical long-term objective of an APT?

   • ATemporary disruption of services
   • BImmediate financial gain
   • CContinuous data exfiltration
   • DQuick website defacement
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's security team is reviewing its attack surface and identifies that its public-facing web application is accessible from the internet, employees can receive external emails, and the corporate network is connected to the internet via a firewall. Which combination of threat vectors is most relevant to the company's risk?

   • ASupply chain and insider vectors.
   • BRemovable media and wireless vectors.
   • CPhysical and social engineering vectors.
   • DWeb, email, and network vectors.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A small business has experienced a ransomware attack that encrypted its file server, and the attackers demanded payment in cryptocurrency. The business also suffered a DDoS attack that took its website offline for several hours. Which statement best categorizes these two incidents?

   • ABoth are advanced persistent threats because they caused significant damage.
   • BBoth are cyber threats, but ransomware is a malware-based attack while DDoS is a network availability attack.
   • CBoth are insider threats because they originated from within the network.
   • DBoth are phishing attacks because they involve social engineering.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an incident response engagement, an analyst observes that an attacker used a legitimate administrative tool to move laterally between servers, scheduled tasks to maintain persistence, and communicated with an external server using encrypted HTTPS traffic that blended with normal web traffic. Which set of TTPs is the attacker employing?

   • AUse of zero-day exploits, fileless malware, and peer-to-peer C2.
   • BSocial engineering via phone, USB drop, and physical intrusion.
   • CExploit public-facing application, modify system firmware, and use DNS tunneling.
   • DLiving-off-the-land binaries, scheduled task persistence, and HTTPS covert C2.
   Reveal Solution Discussion Select an answer first