Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's website is flooded with traffic from many compromised devices, causing it to become unavailable. The company also discovers that a malicious attachment in an email has infected several computers with spyware. Which two types of cyber threats are demonstrated?

   • ADDoS attack and malware.
   • BPhishing and ransomware.
   • CSocial engineering and APT.
   • DInsider threat and DDoS.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common TTP used by APT groups to gain an initial foothold?

   • ASpear-phishing
   • BLateral movement
   • CCommand-and-control communication
   • DData exfiltration
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A threat intelligence analyst is profiling an APT group that uses spear-phishing with malicious macros, then employs PowerShell to download additional tools, and finally uses SMB for lateral movement. The analyst wants to create detection signatures that are resilient to changes in the group's tools but focus on their behavior. Which approach is most effective?

   • ASignature-based detection of the specific malware hashes used by the group.
   • BNetwork detection of the specific C2 domains used by the group.
   • CBehavioral detection of PowerShell execution and SMB lateral movement patterns.
   • DYARA rules matching the exact macro code used in the phishing documents.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which TTP involves an attacker moving from one compromised system to another within a network?

   • APrivilege escalation
   • BSpear-phishing
   • CLateral movement
   • DPersistence
   Reveal Solution Discussion Select an answer first
6. 35expert · medium

   A security analyst is investigating a data breach at a non-profit organization that advocates for environmental protection. The breach involved defacement of the website and release of internal emails. The attacker did not demand money and did not appear to be state-sponsored. Which threat actor type and motivation best fit this scenario?

   • ACybercriminal motivated by financial gain through selling the emails.
   • BHacktivist motivated by ideological opposition to the organization's cause.
   • CInsider threat motivated by revenge against the organization.
   • DState-sponsored actor motivated by espionage.
   Reveal Solution Discussion Select an answer first