Advanced Persistent Threats (APTs) TIE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which characteristic is most essential to the definition of an Advanced Persistent Threat (APT)?

   • AThe attacker uses sophisticated zero-day exploits exclusively
   • BThe attacker maintains long-term, stealthy access to achieve a specific objective
   • CThe attack is launched by a single individual with limited resources
   • DThe attack is fully automated and spreads rapidly across the internet
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which type of indicator of compromise (IoC) is a unique value that can be used to identify a specific malicious file?

   • AIP address
   • BRegistry key
   • CDomain name
   • DFile hash
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is studying the 2017 Equifax breach, where attackers exploited a vulnerability in the Apache Struts web framework to gain access, then moved laterally and exfiltrated sensitive data over several months. The analyst wants to apply lessons learned to improve their own organization's defenses. Which lesson is most directly applicable from this case study?

   • APrioritize timely patch management for internet-facing applications
   • BRely on network segmentation to contain all lateral movement
   • CUse only signature-based detection to identify known malware
   • DFocus exclusively on preventing initial exploitation
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security architect is designing a detection strategy for a high-value research organization that is a likely APT target. The organization has a mature SIEM and EDR, but the architect is concerned about attackers using living-off-the-land binaries (LOLBins) and legitimate administrative tools to avoid detection. Which approach would be most effective in detecting this type of APT behavior?

   • ADeploying additional signature-based antivirus products
   • BIncreasing the frequency of vulnerability scans
   • CFocusing threat hunting on anomalous use of administrative tools and PowerShell
   • DImplementing application whitelisting for all endpoints
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is studying the 2020 SolarWinds attack to improve their defenses. They note that the attackers compromised the Orion software update mechanism, which allowed them to distribute malicious code to thousands of organizations. Which lesson from this case study is most directly applicable to preventing a similar supply-chain attack?

   • ARequire all employees to use VPNs
   • BDisable all external DNS queries
   • CIncrease the frequency of penetration tests
   • DImplement strict code-signing and integrity checks for software updates
   Reveal Solution Discussion Select an answer first