Tactics, Techniques, and Procedures (TTPs) SCE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC is investigating a series of intrusions. In each case, the attacker used a different malware family, but the following behaviors were consistent: initial access via spear-phishing, use of scheduled tasks for persistence, and data exfiltration via DNS queries. The SOC has limited resources and must choose one detection strategy. Which strategy best leverages TTPs to detect future intrusions by this adversary?

   • ADeploy new antivirus signatures for each malware family
   • BIncrease logging on all workstations to capture scheduled task creation
   • CBlock all email attachments from external senders
   • DMonitor for unusual DNS queries that match the exfiltration pattern
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is creating a threat profile for an adversary that uses USB drives to deliver malware, then uses a keylogger to capture credentials, and finally uses those credentials to access a cloud application. The analyst notes the adversary's objective is credential theft. Which of the following is correctly identified as a tactic?

   • AUsing a keylogger to capture credentials
   • BCredential theft
   • CUsing USB drives to deliver malware
   • DAccessing a cloud application
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   During incident response, how can knowledge of TTPs aid in containing an active threat?

   • ABy automatically patching all vulnerabilities on the network
   • BBy deleting all files that match known malware signatures
   • CBy identifying the adversary's identity and nationality
   • DBy predicting the adversary's next likely actions and proactively disrupting them
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst observes that an adversary sent a targeted email with a malicious attachment to a finance employee. After the attachment was opened, the adversary established a command-and-control (C2) channel. Which TTP components are demonstrated in this scenario?

   • ATactic: Initial Access; Technique: Spear Phishing; Procedure: The specific email content and attachment used
   • BTactic: Exfiltration; Technique: Email Phishing; Procedure: The C2 channel
   • CTactic: Persistence; Technique: Malicious Attachment; Procedure: The finance employee's email address
   • DTactic: Execution; Technique: Command and Control; Procedure: The C2 channel setup
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC team is reviewing a series of alerts where an attacker used a previously unknown malware variant to exfiltrate data over HTTPS. The team's signature-based IDS did not detect the malware, but the team noticed the attacker used the same command-line arguments and file paths as a known threat group. How can the team best improve detection for this specific adversary?

   • ADeploy additional signature updates for the new malware variant
   • BBlock all HTTPS traffic to external destinations
   • CCreate behavioral detections based on the attacker's TTPs
   • DIsolate the affected workstation and reimage it
   Reveal Solution Discussion Select an answer first