Advanced Persistent Threats (APTs) TIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security manager is evaluating a new security tool for a research organization that has been targeted by a known APT group. The tool must be able to detect the APT's custom malware, which is not detected by signature-based antivirus. The tool should also provide visibility into the APT's command-and-control communications. Which type of tool is most appropriate for this requirement?

   • AA web application firewall (WAF) to block malicious HTTP requests
   • BA network firewall with application control
   • CEndpoint detection and response (EDR) with behavioral analysis and network visibility
   • DTraditional antivirus with updated signature databases
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is designing a detection strategy for a potential APT that has been using legitimate administrative tools to move laterally. The team wants to detect this activity without disrupting legitimate administrative work. Which detection strategy is most effective for this scenario?

   • AMonitor and alert on unusual usage patterns of administrative tools, such as execution outside of normal business hours or from unexpected hosts
   • BRely solely on antivirus signatures for known administrative tool exploits
   • CDisable all remote management protocols to prevent lateral movement
   • DBlock all administrative tools from running on user workstations
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A threat intelligence analyst is profiling a series of attacks against multiple government agencies and defense contractors. The attacks use custom malware, have been ongoing for years, and appear to be sponsored by a nation-state. The primary motivation appears to be espionage. Which type of threat actor is most likely responsible?

   • ANation-state actor
   • BCybercriminal
   • CHacktivist
   • DInsider threat
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which mitigation measure is specifically designed to limit the impact of an APT that has already gained a foothold by preventing lateral movement?

   • AUsing a single strong password for all accounts
   • BDisabling the Windows firewall on all endpoints
   • CRegularly updating antivirus definitions
   • DNetwork segmentation and least-privilege access controls
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which strategy is most effective for detecting APT activity that has already evaded traditional signature-based defenses?

   • ARelying solely on antivirus signatures
   • BProactive threat hunting based on hypotheses and behavioral analytics
   • CDisabling all external network connections
   • DPerforming periodic full disk backups
   Reveal Solution Discussion Select an answer first