Campaigns and Attribution GCTI Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   During an incident response engagement, a threat intelligence analyst reconstructs the timeline of an intrusion. The analyst notes that the attackers conducted port scans and vulnerability scans of the external perimeter three months before the first phishing email was sent. After the phishing email, the attackers used a previously unknown remote access trojan (RAT) and then spent several weeks exploring the network before deploying ransomware. Which stage of the campaign lifecycle does the port scanning activity represent?

   • AWeaponization
   • BPost-exploitation
   • CInitial reconnaissance
   • DDelivery
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   An organization has observed a series of intrusions over the past year. In each intrusion, the attackers used a different malware family and a different initial access vector, but the post-exploitation activity was identical: the attackers created a new local administrator account, used PowerShell to download additional tools, and exfiltrated data via a specific file-sharing service. The organization's threat intelligence team is trying to determine if these intrusions are part of a single campaign. What is the most important factor in this determination?

   • AThe identical post-exploitation activity is a strong indicator that the intrusions are part of the same campaign
   • BThe different malware families and initial access vectors indicate that the intrusions are unrelated
   • CThe use of a file-sharing service for exfiltration indicates that the intrusions are part of a false flag operation
   • DThe intrusions should be considered a single intrusion because they all affected the same organization
   Reveal Solution Discussion Select an answer first
3. 38foundation · easy

   An analyst observes several phishing emails, a malware download, and later data exfiltration from a victim network. What is the most appropriate way to describe this collection of events?

   • AA cyber threat campaign, because the events are linked by a common objective and likely a common actor
   • BA false flag operation, because the events appear to be unrelated
   • CAn advanced persistent threat, because the events are sophisticated
   • DA single intrusion, because all events occurred in the same organization
   Reveal Solution Discussion Select an answer first