Campaigns and Attribution GCTI Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which set of IOCs would be most useful for linking two separate intrusions to the same campaign?

   • AThe same IP address for the victim's public-facing server
   • BThe same command-and-control domain and a similar phishing lure used in both intrusions
   • CThe same victim industry and similar time of day for the attacks
   • DTwo different malware hashes that are both detected by the same antivirus product
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An intelligence team is analyzing a campaign that uses a malware strain previously attributed to Country A, but the campaign's strategic objectives appear to align with Country B. The malware contains a debug path that references a developer in Country A, and the C2 infrastructure is hosted in Country B. The team must decide whether this is a false flag. Which evidence would most strongly support the false flag hypothesis?

   • AThe malware strain was previously attributed to Country A, which rules out a false flag.
   • BThe C2 infrastructure in Country B is a reliable indicator of Country B's involvement.
   • CThe debug path is a deliberate artifact that is inconsistent with the malware's normal build process.
   • DThe strategic objectives align with Country B, which is sufficient to conclude a false flag.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst is trying to attribute a series of attacks to a specific threat actor. The analyst has identified the malware family, observed the attacker's working hours, and noted that the victim industries align with a known actor's interests. Which combination of attribution methodologies is the analyst applying?

   • ATechnical (malware family), operational (working hours), and strategic (victim industry alignment)
   • BStrategic (malware family), technical (working hours), and operational (victim industry alignment)
   • CTechnical (malware family), strategic (working hours), and operational (victim industry alignment)
   • DOperational (malware family), technical (working hours), and strategic (victim industry alignment)
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How do indicators of compromise (IOCs) support the linking of disparate events into a single campaign?

   • ABy identifying the motivation of the threat actor
   • BBy providing common technical artifacts that can be matched across different intrusions
   • CBy proving that the same threat actor is responsible for all events
   • DBy eliminating the need for further analysis of the events
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An intelligence team has gathered the following evidence for attribution: a unique malware hash, a consistent set of TTPs, and a victim profile that matches a known actor's interests. The team is preparing a report. Which confidence level is most appropriate?

   • ALow confidence, because the malware hash could be coincidental.
   • BNo confidence, because attribution is inherently impossible.
   • CHigh confidence, because the malware hash is unique and cannot be spoofed.
   • DModerate to high confidence, because the evidence is corroborated across multiple independent categories.
   Reveal Solution Discussion Select an answer first