Advanced Persistent Threats (APTs) TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A threat intelligence analyst is reviewing logs and notices that a workstation in the finance department is making DNS queries to a domain that was registered only three days ago and has a very low reputation score. The workstation also established a persistent connection to an IP address in a country where the company has no business operations. Which two indicators of compromise (IoCs) are most directly highlighted by this observation?

   • AUser agent string and cookie value
   • BFile hash and registry key
   • CUnusual network traffic and domain name
   • DEmail subject line and attachment name
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security operations center (SOC) is investigating a potential APT. They notice a series of failed login attempts from a single IP address, followed by a successful login from the same IP using a legitimate account. The account then accessed a large number of files on a file share. Which detection strategy would be most effective in identifying this as malicious activity?

   • ADeploying a honeypot to attract the attacker
   • BRequiring multi-factor authentication for all users
   • CMonitoring for unusual access patterns, such as a successful login after multiple failures
   • DBlocking the IP address after the failed attempts
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC analyst is reviewing a report from an EDR solution that flags a process running from a temporary directory with a known malicious file hash. The analyst also notices that the process is making HTTP requests to a domain that has been associated with a known APT group. Which two indicators of compromise (IoCs) are present in this scenario?

   • ARegistry key and user agent
   • BFile hash and domain name
   • CIP address and cookie
   • DEmail subject and attachment
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst at a mid-sized manufacturing firm notices a series of small, encrypted data transfers from a single engineering workstation to an external IP address over the past three months. The transfers occur every few days, always at 2:00 AM, and the workstation shows no signs of malware in standard scans. The analyst also finds that the workstation has been sending beacon-like signals to a domain registered three years ago that has no web content. Which combination of observations most strongly indicates an APT rather than a typical malware infection?

   • AThe workstation shows no signs of malware in standard scans, proving the attacker used fileless techniques
   • BThe external IP address is not on any public blocklist, indicating a dedicated infrastructure that only APTs use
   • CThe beaconing to a long-registered, dormant domain and the sustained, low-volume exfiltration pattern over months
   • DThe transfers occur at the same time each night, indicating a scheduled task that a typical malware would not create
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which APT group is commonly associated with the Chinese government and has been observed targeting aerospace, technology, and government sectors for intellectual property theft?

   • AAPT1 (Comment Crew)
   • BAPT29 (Cozy Bear)
   • CSandworm Team
   • DLazarus Group
   Reveal Solution Discussion Select an answer first