Advanced Persistent Threats (APTs) TIE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A threat intelligence analyst is comparing two APT groups. Group A has been active for five years, targets government and defense organizations, uses custom malware, and is believed to be state-sponsored. Group B has been active for two years, targets financial institutions, uses ransomware, and is believed to be financially motivated. The analyst must advise a defense contractor on which group poses the greater risk to their organization. Which consideration is most important in this risk assessment?

   • AThe alignment of the group's targeting and motivation with the organization's sector and value to potential adversaries
   • BThe group's use of custom malware versus ransomware, with custom malware being inherently more dangerous
   • CThe group's activity duration, with longer-active groups always posing a greater threat
   • DThe group's belief to be state-sponsored, which always makes them a higher risk than financially motivated groups
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security operations manager at a large enterprise is reviewing a year-long intrusion that was only discovered after a third-party threat intelligence report matched a domain used by the attackers. The attackers used a combination of spear-phishing, living-off-the-land binaries, and encrypted C2 traffic. The manager must now justify additional security investments to the board. Which argument best justifies the investment in threat hunting and behavioral analytics, given the characteristics of this intrusion?

   • AThe intrusion lasted a year, so investing in faster incident response will reduce the dwell time of future attacks
   • BThe intrusion evaded signature-based tools for months, so proactive hunting based on behavioral indicators is necessary to detect similar adversaries
   • CThe attackers used a domain that was only identified by external intelligence, so investing in more threat intelligence feeds is the only way to prevent future attacks
   • DThe attackers used living-off-the-land binaries, so investing in application whitelisting will completely prevent such attacks
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which well-known APT group is widely reported to be sponsored by the North Korean government and has been linked to cyber-espionage and financially motivated attacks?

   • AAPT29 (Cozy Bear)
   • BFancy Bear (APT28)
   • CAPT1 (Comment Crew)
   • DLazarus Group
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is reviewing the 2013 Target breach, where attackers gained access through a third-party HVAC vendor's credentials, then moved laterally to the POS system and exfiltrated payment card data. The team wants to apply lessons learned to their organization, which uses multiple third-party vendors with network access. Which combination of measures is most directly aligned with the lessons from this case study?

   • AConducting more frequent penetration tests on internet-facing applications
   • BImplementing strict vendor access controls, network segmentation, and monitoring for anomalous access from vendor accounts
   • CEncrypting all payment card data in transit and at rest
   • DDeploying more antivirus software on all POS systems
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's security team has identified a sophisticated threat actor that has been silently collecting credentials and moving laterally for several months. The team wants to implement a strategy that focuses on proactively searching for signs of the attacker's presence rather than relying solely on automated alerts. Which approach best aligns with this goal?

   • AEnforcing multi-factor authentication for all users
   • BIncreasing the frequency of vulnerability scans
   • CDeploying a next-generation firewall with intrusion prevention
   • DConducting threat hunting based on the MITRE ATT&CK framework
   Reveal Solution Discussion Select an answer first