Advanced Persistent Threats (APTs) TIE Practice Questions (Page 9)

Questions 41–42

1. 41application · medium

   A security analyst notices a series of small, encrypted data transfers from a research lab's file server to an external IP address during off-hours. The transfers occur every few days and are just under the threshold that triggers the existing data-loss prevention alerts. The analyst also finds a scheduled task on the server that runs a PowerShell script to compress and encrypt files in a specific folder before the transfers. Which stage of the APT lifecycle does this activity most directly represent?

   • ACommand and control
   • BInitial compromise
   • CLateral movement
   • DExfiltration
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A threat hunter is reviewing logs from a company that discovered a breach. The timeline shows: (1) an employee received a spear-phishing email with a malicious attachment, (2) the attachment installed a backdoor, (3) the backdoor established outbound connections to a command-and-control server, (4) the attacker used stolen credentials to move laterally to a database server, and (5) the attacker compressed and encrypted files before transferring them out. The hunter wants to map these events to the APT lifecycle to prioritize detection controls. Which stage of the APT lifecycle is most directly associated with the attacker's use of stolen credentials to access the database server?

   • AInitial compromise
   • BLateral movement
   • CCommand and control
   • DExfiltration
   Reveal Solution Discussion Select an answer first