Campaigns and Attribution GCTI Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A threat intelligence team is attributing a campaign that uses a known malware family but with a new obfuscation layer. The team has three hypotheses: a known APT group, a copycat using leaked source code, or a false flag by a different actor. The team has limited time and resources. Which approach best balances analytical rigor and resource constraints?

   • APrioritize the copycat hypothesis because leaked source code is a common explanation for new obfuscation.
   • BGather additional technical and operational evidence to test all three hypotheses, starting with the most likely based on available data.
   • CAttribute to the known APT group because the malware family is familiar.
   • DFocus on the false flag hypothesis because it is the most difficult to disprove.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A threat intelligence team has gathered the following evidence about a campaign: (1) the malware shares a unique code signing certificate with a known actor, (2) the C2 infrastructure overlaps with infrastructure previously used by that actor, and (3) the TTPs match the actor's known playbook. However, the team has not identified the motive behind the campaign. How should the team communicate attribution confidence?

   • ANo confidence, because the team cannot be certain without knowing the motive
   • BModerate confidence, because the lack of motive reduces the reliability of the attribution
   • CLow confidence, because attribution requires strategic intelligence to be reliable
   • DHigh confidence, because the technical and operational evidence strongly corroborates the attribution
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An analyst is reviewing multiple security incidents that occurred over the past year. The analyst notices that several incidents share the same malicious IP address for C2 communications, but the malware families are different. Additionally, the phishing emails in each incident use different lures and are sent from different email accounts. What is the most appropriate use of the shared IP address in this context?

   • AIgnore the shared IP because different malware families mean the incidents are unrelated
   • BUse the shared IP as one of several indicators to correlate the incidents, but corroborate with other evidence
   • CImmediately attribute all incidents to the same threat actor based on the shared IP
   • DTreat the shared IP as a strong indicator that all incidents are part of the same campaign
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During a campaign analysis, an analyst is mapping the observed activities to the campaign lifecycle. The analyst notes that the attackers conducted extensive open-source intelligence gathering on the target organization's employees, then crafted a spear-phishing email using information from social media. After the email was opened, the attackers exploited a vulnerability in the email client to gain initial access. Which stages of the campaign lifecycle are represented by these activities?

   • AReconnaissance and weaponization
   • BDelivery and exploitation
   • CWeaponization and exploitation
   • DReconnaissance and delivery
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is examining a campaign that uses malware with code that is identical to a known state-sponsored actor's malware, but the C2 infrastructure is hosted in a country that is a known adversary of that state. Additionally, the malware contains a unique string that appears to be a reference to a different threat actor. The analyst is considering whether this is a false flag operation. What is the most appropriate conclusion?

   • AThe campaign is definitely a false flag because the unique string references a different actor
   • BThe campaign is likely a false flag because the C2 infrastructure is in an adversary country
   • CThe campaign could be a false flag, but the evidence is inconclusive and requires further analysis
   • DThe campaign is likely not a false flag because the malware code is identical to the known actor's malware
   Reveal Solution Discussion Select an answer first