Advanced Persistent Threats (APTs) TIE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which notable APT attack was a supply-chain compromise that inserted malicious code into a trusted software update, affecting thousands of organizations?

   • AWannaCry ransomware outbreak
   • BSolarWinds attack (attributed to APT29)
   • CTarget POS breach
   • DEquifax data breach
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security manager is evaluating two detection strategies for a network that is a likely APT target. Strategy 1 is to deploy a network intrusion detection system (NIDS) that uses signatures of known APT malware. Strategy 2 is to implement a threat hunting program that uses behavioral analytics and the MITRE ATT&CK framework. Which strategy is more likely to detect a novel APT attack that uses custom malware?

   • AStrategy 2, because threat hunting focuses on behavior rather than known signatures
   • BNeither strategy is effective against novel malware
   • CBoth strategies are equally effective against novel malware
   • DStrategy 1, because NIDS signatures are effective against known malware
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During an incident response, an analyst finds that an attacker used a spear-phishing email to deliver a malicious document, which then downloaded a remote access trojan (RAT). The RAT established a connection to an external server. The analyst wants to identify the stage of the APT lifecycle that involves the attacker gaining a foothold in the network. Which stage is this?

   • ALateral movement
   • BExfiltration
   • CInitial compromise
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is reviewing the lessons learned from the 2017 NotPetya attack, which used a supply-chain vector (a compromised update) and then spread rapidly across networks. The team wants to apply these lessons to their own environment. Which combination of strategies would be most effective in mitigating a similar wiper-style attack?

   • AData loss prevention (DLP) and encryption
   • BNetwork segmentation and offline backups
   • CPerimeter firewall and intrusion prevention system (IPS)
   • DEndpoint detection and response (EDR) and user awareness training
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which statement best describes the 'advanced' aspect of an Advanced Persistent Threat?

   • AThe attack requires a high level of physical access to the target
   • BThe attackers employ a wide range of techniques and custom tools to evade detection
   • CThe attack is always conducted by a nation-state actor
   • DThe attack uses only the latest commercial hacking tools
   Reveal Solution Discussion Select an answer first