1.2 Categorize Techniques Used by Malicious Actors as Defined by the MITRE ATT&CK Framework CYBERSECURITY-PRACTITIONER Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A security analyst is investigating a compromised email account. The attacker is observed reading emails and forwarding them to an external address. Which MITRE ATT&CK technique is the attacker using to collect data?

   • AInput Capture
   • BScreen Capture
   • CClipboard Data
   • DEmail Collection
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   An attacker uses PowerShell to run a script that downloads and executes a payload. Which MITRE ATT&CK tactic does this action primarily represent?

   • AExecution
   • BInitial Access
   • CDefense Evasion
   • DCommand and Control
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A penetration tester is on a compromised host with standard user privileges. They use a known vulnerability in the Windows kernel to gain SYSTEM-level access. Which MITRE ATT&CK technique best describes this action?

   • AProcess Injection
   • BExploitation for Privilege Escalation
   • CValid Accounts
   • DAccess Token Manipulation
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of an Exfiltration technique?

   • AProcess Injection
   • BService Stop
   • CEmail Collection
   • DExfiltration over Command and Control channel
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A malware analyst is examining a sample that uses a technique to hide its true file extension by using a right-to-left override (RLO) character. The file appears as 'invoice.pdf' but is actually 'invoice.exe'. Which MITRE ATT&CK technique is the malware using?

   • AFile and Directory Discovery
   • BDeobfuscate/Decode Files or Information
   • CObfuscated Files or Information
   • DMasquerading
   Reveal Solution Discussion Select an answer first