Kill Chain, Diamond Model, and Courses of Action Matrix GCTI Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst is documenting a cyber event using the Diamond Model. The event involved a phishing email that delivered a remote access trojan (RAT). The RAT connected to a server hosted on a bulletproof hosting provider. The victim was a specific employee at a financial institution. Which of the following is the correct classification of the bulletproof hosting server?

   • AVictim
   • BAdversary
   • CInfrastructure
   • DCapability
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of the cyber kill chain model in threat intelligence?

   • ATo replace the need for human analysis by automatically attributing attacks to specific threat actors
   • BTo provide a legal framework for prosecuting cybercriminals
   • CTo assign a numerical severity score to a specific malware family
   • DTo describe the sequence of actions an adversary takes to achieve an objective in an intrusion
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A threat intelligence team is analyzing an intrusion where the adversary used a previously unknown malware variant to establish persistence on a victim's workstation. The team has identified the C2 infrastructure and the victim. They need to develop a response strategy that both disrupts the adversary's current operations and degrades their ability to use the same infrastructure in the future. Which combination of courses of action is most appropriate?

   • ADegrade the C2 infrastructure and deny the adversary's ability to use the same malware
   • BDisrupt the adversary's current operations and degrade the C2 infrastructure
   • CDisrupt the C2 communication and deny the adversary access to the victim's network
   • DDetect the intrusion and destroy the malware on the victim
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which COA category is focused on making an adversary's tools or techniques less effective, such as throttling bandwidth to slow data exfiltration?

   • ADestroy
   • BDegrade
   • CDeceive
   • DDetect
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During an incident response, an analyst observes the following sequence: an attacker scanned the network for open ports, sent a phishing email with a malicious link, the victim clicked the link and downloaded malware, the malware beaconed to an external server, and then the attacker used the compromised host to access a file share. Which two kill chain stages are most directly demonstrated by the scanning and the file share access?

   • AExploitation and Lateral Movement
   • BDelivery and Installation
   • CReconnaissance and Actions on Objectives
   • DWeaponization and Command and Control
   Reveal Solution Discussion Select an answer first