Cyber Threats and Advanced Persistent Threats CTIA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security operations center is reviewing alerts for a potential APT. The following indicators have been observed: (1) a new user account created in a privileged group, (2) unusual PowerShell activity on a server, (3) outbound connections to a domain that is only 24 hours old, and (4) a file hash matching a known malware sample. Which combination of indicators is most indicative of an APT?

   • AOnly the known malware hash is indicative of an APT.
   • BNew privileged account and unusual PowerShell activity.
   • COutbound connection to a new domain and known malware hash.
   • DAll four indicators combined.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team is analyzing a breach where the attacker maintained access to a network for over a year, moving slowly between systems and using encrypted communications. The attacker's objective appeared to be continuous collection of intellectual property rather than immediate financial gain. Which characteristic is most definitive in classifying this as an APT?

   • AThe long-term presence and sustained access over a year.
   • BThe use of encrypted communications to avoid detection.
   • CThe collection of intellectual property.
   • DThe slow movement between systems.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is a potential financial impact of a cyber threat on an organization?

   • AIncreased employee morale
   • BReduced regulatory scrutiny
   • CImproved system performance
   • DDirect monetary losses from theft or fraud
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An analyst is documenting an APT attack and notes the following sequence: the attacker researched employees on LinkedIn, sent a targeted email with a malicious attachment, the attachment exploited a vulnerability, the attacker installed a backdoor, and then moved to other systems. Which two stages of the Cyber Kill Chain are missing from this documentation?

   • AInstallation and Actions on Objectives.
   • BWeaponization and Command and Control.
   • CDelivery and Exploitation.
   • DReconnaissance and Lateral Movement.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A security team observes that an attacker is using spear-phishing emails that appear to come from the CEO, and when a user clicks the link, the attacker uses a remote access tool to control the machine. Which TTP is the attacker using for initial access?

   • ADrive-by download.
   • BWatering hole attack.
   • CSupply chain compromise.
   • DSpear-phishing with a malicious link.
   Reveal Solution Discussion Select an answer first