Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which meta-feature in the Diamond Model describes the time when an event occurred?

   • ATimestamp
   • BResult
   • CDirection
   • DPhase
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When applying the Diamond Model to a ransomware event, which element would be classified as the victim?

   • AThe company whose files were encrypted
   • BThe command-and-control server
   • CThe ransomware binary used to encrypt files
   • DThe threat actor group behind the attack
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How do the kill chain, Diamond Model, and COA matrix complement each other in threat intelligence analysis?

   • AThe kill chain maps the stages of an intrusion, the Diamond Model structures the event details, and the COA matrix guides defensive responses
   • BThe kill chain replaces the Diamond Model, and the COA matrix is only used after an attack is complete
   • CThe kill chain is used for attribution, the Diamond Model for detection, and the COA matrix for prevention
   • DThe kill chain identifies the adversary, the Diamond Model maps the stages, and the COA matrix assigns severity scores
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization has experienced a series of intrusions. The Diamond Model shows the adversary using a common capability (a specific exploit kit) but varying infrastructure. The kill chain analysis shows the adversary typically exploits a browser vulnerability to deliver ransomware. The organization wants to implement a course of action that will have the greatest impact across all campaigns while minimizing user disruption. Which course of action is most appropriate?

   • ADeceive the adversary by using honeypots to attract the exploit kit
   • BDegrade the exploit kit by rate-limiting traffic to known exploit kit domains
   • CDisrupt the exploit kit by patching the browser vulnerability
   • DDeny access to known malicious domains associated with the exploit kit
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In the Diamond Model, which meta-feature indicates the stage of the intrusion lifecycle that an event corresponds to?

   • APhase
   • BMethodology
   • CResult
   • DResources
   Reveal Solution Discussion Select an answer first