Campaigns and Attribution GCTI Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a campaign analysis, an analyst maps the observed activities to the campaign lifecycle. The analyst notes that the attackers sent a spear-phishing email with a malicious attachment, which was opened by a user, leading to the installation of a backdoor. The backdoor then established persistence and began collecting credentials. Which stage of the campaign lifecycle is the credential collection activity part of?

   • AInitial reconnaissance
   • BDelivery
   • CExploitation
   • DPost-exploitation
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   An intelligence team is attributing a campaign to a specific actor. The technical evidence includes a unique malware family and a specific C2 protocol. The operational evidence includes the actor's working hours and the use of a particular VPN provider. The strategic evidence includes the selection of victims in the defense industry. The team is deciding how to combine these evidence types. What is the most appropriate way to use these methodologies together?

   • ARely primarily on strategic evidence because victim selection is the most telling indicator.
   • BWeigh all three types of evidence together, recognizing that technical evidence is often strong but operational and strategic evidence add context.
   • CRely primarily on technical evidence because it is the most objective and reliable.
   • DUse only operational evidence because it reflects the actor's behavior.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A threat intelligence analyst is documenting a campaign that began with reconnaissance of a target's email system, then used a phishing email to deliver a backdoor, and later moved laterally to a database server. The analyst is describing the campaign lifecycle. Which stage is missing from this description?

   • APost-exploitation activities such as data exfiltration or persistence
   • BInitial access via a vulnerability exploit
   • CDelivery of the phishing email
   • DCommand and control establishment
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is the correct sequence of stages in a typical cyber threat campaign lifecycle?

   • AReconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives
   • BPhishing → Malware Installation → Data Theft → Cleanup
   • CReconnaissance → Initial Intrusion → Establish Foothold → Escalate Privileges → Move Laterally → Maintain Presence → Complete Mission → Exfiltrate Data → Cover Tracks
   • DInitial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Exfiltration → Impact
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   An organization has experienced three separate intrusions over six months. Each intrusion used a different malware family and different infrastructure, but all targeted the same type of sensitive data and used similar spear-phishing lures. An analyst is determining whether these are one campaign or three separate campaigns. Which additional evidence would most strongly indicate a single campaign?

   • AThe targeted data was stored in the same database.
   • BThe same attacker email address was used in all three spear-phishing lures.
   • CThe intrusions occurred during the same time of year.
   • DThe three malware families are all publicly available and commonly used.
   Reveal Solution Discussion Select an answer first