Advanced Persistent Threats (APTs) TIE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security analyst is studying the 2016 Democratic National Committee (DNC) breach, which involved spear-phishing and custom malware attributed to a Russian state-sponsored group. The analyst wants to identify a key lesson from this case study that applies to defending against similar APT attacks. Which lesson is most directly applicable?

   • ASpear-phishing is a common initial vector, so email security and user awareness are critical
   • BNetwork segmentation is the only effective defense against APTs
   • CCustom malware is always undetectable, so prevention is impossible
   • DState-sponsored attackers only target government entities
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which stage of the APT attack chain involves the attacker identifying potential entry points and vulnerabilities in the target environment?

   • AWeaponization
   • BDelivery
   • CReconnaissance
   • DInstallation
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A threat hunter is analyzing a network where an APT has established a foothold. The hunter has limited resources and must choose where to focus detection efforts. The hunter has observed: (1) the attacker is using a previously unknown malware variant, (2) the malware communicates with a C2 server using HTTP on a non-standard port, and (3) the attacker is using stolen credentials to access multiple systems. Which detection approach is most likely to yield the earliest warning of the attacker's activities?

   • AIncrease logging on all endpoints to capture every process execution
   • BFocus on file-based detection using the malware's hash
   • CDeploy a network signature to detect the C2 traffic on the non-standard port
   • DMonitor for anomalous authentication patterns, such as logins from unusual locations or at unusual times
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a common indicator of compromise (IoC) associated with APT activity?

   • AAnomalous outbound network connections to a known malicious domain
   • BA scheduled antivirus scan completing without detection
   • CA sudden increase in legitimate outbound email traffic
   • DA user receiving a phishing email that is quarantined by the email gateway
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A SOC analyst is reviewing a report that lists several indicators of compromise (IoCs) for a known APT group. The report includes a file hash, a domain name, and an IP address. The analyst wants to search their environment for these IoCs. Which tool or technique would be most effective for searching for all three types of IoCs?

   • AA SIEM platform that can ingest and correlate logs from multiple sources
   • BA vulnerability scanner
   • CA packet capture tool
   • DA host-based firewall
   Reveal Solution Discussion Select an answer first