Advanced Persistent Threats (APTs) TIE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is reviewing a report that describes an attack where the threat actor used a previously unknown vulnerability in a web server, then installed a rootkit that hid their presence, and finally stole customer data over a period of several weeks. Which combination of APT characteristics is most clearly demonstrated?

   • APersistence and exfiltration
   • BAdvanced techniques and persistence
   • CTargeted nature and lateral movement
   • DAdvanced techniques and exfiltration
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A cybersecurity analyst at a government defense contractor is reviewing threat intelligence reports. One report describes a group that has repeatedly targeted aerospace and defense organizations, uses spear-phishing with zero-day exploits, and is believed to be state-sponsored with a focus on intellectual property theft. Another report describes a financially motivated group that uses ransomware against hospitals. Which threat actor profile is most consistent with the first report?

   • AAn insider threat actor who is disgruntled and sells secrets for personal gain
   • BA hacktivist group that defaces websites to promote political causes
   • CA state-sponsored APT group with a focus on espionage and intellectual property theft
   • DA cybercriminal syndicate focused on financial gain through ransomware
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat intelligence analyst is compiling a report on APT groups that target the energy sector. The analyst has information about a group that has been active since 2015, uses custom malware, and has been linked to attacks on power grids in Eastern Europe. The group's motivation appears to be geopolitical disruption. Which classification best fits this group?

   • AInsider threat actor with personal grievances
   • BState-sponsored APT group with a geopolitical agenda
   • CFinancially motivated cybercrime group
   • DHacktivist group seeking media attention
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is reviewing network logs and sees a series of DNS queries to a domain that is algorithmically generated (DGA). The analyst also notices that the queries occur at regular intervals and are made by a host that has been infected with a known APT malware. Which action would be most effective in disrupting the attacker's command and control (C2) communication?

   • AUpdating the antivirus signatures on the host
   • BImplementing a DNS sinkhole to redirect all DGA queries
   • CBlocking the specific DGA domain on the DNS server
   • DDisabling the infected host's network connection
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is analyzing the 2013 Target breach, where attackers gained access through a third-party HVAC vendor and then moved laterally to the point-of-sale (POS) system. The team wants to apply lessons from this case study to their own environment. Which combination of controls would be most effective in preventing a similar attack?

   • AEndpoint detection and response (EDR) and antivirus
   • BNetwork segmentation and strict third-party vendor access controls
   • CData loss prevention (DLP) and encryption
   • DPerimeter firewall and intrusion prevention system (IPS)
   Reveal Solution Discussion Select an answer first