Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the Cyber Kill Chain framework, which stage follows 'Weaponization'?

   • ADelivery
   • BInstallation
   • CCommand and Control
   • DExploitation
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a potential reputational impact of a cyber threat?

   • AHigher employee retention
   • BLoss of customer trust and confidence
   • CImproved brand image
   • DIncreased stock price
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a type of cyber threat that involves sending fraudulent emails to trick recipients into revealing sensitive information?

   • APhishing
   • BMalware
   • CMan-in-the-middle attack
   • DDDoS attack
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A threat intelligence analyst is comparing two APT groups. Group A uses spear-phishing with malicious macros and then uses PsExec for lateral movement. Group B uses watering hole attacks and then uses WMI for lateral movement. Which statement best describes the TTPs of these groups?

   • ABoth groups use the same initial access and lateral movement techniques.
   • BBoth groups use the same lateral movement technique but different initial access.
   • CGroup A uses watering holes and WMI, while Group B uses spear-phishing and PsExec.
   • DGroup A uses spear-phishing and PsExec, while Group B uses watering holes and WMI.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst notices a series of events over several months: an initial spear-phishing email, followed by periodic beaconing to an external IP, then lateral movement using PowerShell, and finally large data transfers to a cloud storage service. The analyst needs to document these events in a way that maps them to a standard framework for presentation to management. Which approach best aligns with the observed sequence?

   • AMap each event to the corresponding stage of the Cyber Kill Chain, from reconnaissance through actions on objectives.
   • BFocus only on the final data exfiltration event because it represents the most damaging impact.
   • CUse the Diamond Model to assign a single actor, capability, infrastructure, and victim for the entire campaign.
   • DGroup all events as indicators of compromise and report them as a single intrusion set without stage classification.
   Reveal Solution Discussion Select an answer first