Cyber Attack Stages CCOA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What occurs during the weaponization stage of a cyber attack?

   • AThe attacker establishes persistence by installing a backdoor
   • BThe attacker creates or obtains a malicious payload tailored to the target
   • CThe attacker delivers the payload to the victim via email or web
   • DThe attacker exploits a vulnerability to gain initial access
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst observes a large volume of data being transferred from a database server to an external IP address via an encrypted tunnel. The analyst also sees that the attacker has been using the C2 channel to issue commands. Which stage of the cyber attack lifecycle is the attacker currently in?

   • ACommand and Control
   • BInstallation
   • CActions on Objectives
   • DExploitation
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An incident responder discovers that a compromised workstation is periodically sending small encrypted packets to a known malicious IP address on port 443. The workstation is also running a scheduled task that re-establishes this communication if it is interrupted. Which stage of the cyber attack lifecycle is the attacker in?

   • AActions on Objectives
   • BDelivery
   • CInstallation
   • DCommand and Control
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the context of the cyber attack lifecycle, what is the primary purpose of the 'Installation' stage?

   • ATo exfiltrate sensitive data from the victim's network
   • BTo scan the network for additional vulnerable systems
   • CTo establish persistent access to the compromised system
   • DTo deliver the malicious payload to the target
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst is investigating a compromised Linux server. The analyst finds a modified system binary that was replaced with a version that includes a backdoor. The backdoor listens on a non-standard port and is configured to start automatically at boot. The analyst also notices that the backdoor communicates with an external IP address. Which stage of the cyber attack lifecycle is the attacker in, and what is the primary purpose of the modified binary?

   • ACommand and Control, to establish communication
   • BExploitation, to gain initial access
   • CInstallation, to establish persistence
   • DActions on Objectives, to exfiltrate data
   Reveal Solution Discussion Select an answer first