Threat Prioritization, Actor Profiling, and Attribution TIE Practice Questions (Page 9)

Questions 41–42

1. 41expert · hard

   A threat intelligence analyst is preparing an attribution report for a joint government-industry task force. The evidence includes a unique malware family, a C2 domain that was previously used by a known APT, and a malware sample that contains a string in a language commonly associated with another country. The analyst has high confidence in the malware family but low confidence in the C2 domain link. How should the analyst present the attribution?

   • AAttribute to the country associated with the language string because it is a unique clue
   • BAttribute to the APT group because the C2 domain is a strong indicator
   • CConclude that the attack is a false flag because the language string contradicts the C2 domain
   • DPresent the malware family as the primary evidence, note the C2 domain as a secondary indicator with low confidence, and discuss the language string as a potential false flag
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security team notices that a previously observed malware family now uses a new packer and communicates with different C2 domains, but the decryption routine and the target industries remain identical. What should the team conclude about the threat actor?

   • AThe actor has ceased operations and a copycat has taken over
   • BThe malware family should be renamed because the packer changed
   • CThe same actor is likely evolving its tools, so the campaign should be tracked under the same actor profile
   • DThis is a new, unrelated actor because the technical indicators changed
   Reveal Solution Discussion Select an answer first