Attack Techniques GMON Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During an incident review, a security team maps the attacker's actions to the Cyber Kill Chain. They observe that the attacker delivered a weaponized PDF via a spear-phishing email, which then installed a backdoor that beaconed to an external server. Later, the attacker used stolen credentials to access a file server and began staging data. At which stage of the kill chain should the team focus their monitoring to detect the attack earliest?

   • AInstallation
   • BDelivery
   • CExploitation
   • DActions on Objectives
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In the context of threat intelligence, what does the 'T' in TTPs specifically refer to?

   • AThe specific tools or malware variants used by an attacker
   • BThe specific procedures or step-by-step methods used by an attacker
   • CThe high-level goals or techniques an attacker uses to achieve an objective
   • DThe indicators of compromise such as IP addresses or hashes
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security analyst is investigating an alert that shows a user downloaded a file from a file-sharing site, and then the file executed a PowerShell script that made an outbound connection to a non-standard port. The analyst needs to determine if this is a malicious attack or a false positive. Which piece of evidence would most strongly indicate a malicious attack?

   • AThe PowerShell script made an outbound connection to a non-standard port
   • BThe user has downloaded files from the same site before
   • CThe PowerShell script encoded its commands and used a known obfuscation technique
   • DThe file was downloaded from a file-sharing site
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   During an incident response, the team reconstructs the attack timeline: an employee clicked a link in a phishing email, which led to a drive-by download of a remote access trojan (RAT). The RAT established a C2 channel and then downloaded additional tools. The attacker used these tools to enumerate the network and eventually exfiltrated data. The team wants to identify the earliest detection point that would have allowed them to stop the attack before data exfiltration. Which stage should they prioritize for monitoring?

   • AC2 communication
   • BNetwork enumeration
   • CTool download
   • DData exfiltration
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A malware analyst is analyzing a sample that, when executed, injects code into a legitimate process (e.g., svchost.exe) and then communicates with a C2 server using HTTP. The analyst wants to identify a detection opportunity that is specific to this malware's behavior. Which detection is most effective?

   • AMonitor for high network traffic to a single external IP.
   • BMonitor for process injection, such as unusual memory allocations or cross-process writes.
   • CMonitor for changes to the Windows registry.
   • DMonitor for new services being created.
   Reveal Solution Discussion Select an answer first