1.4 Identify and Describe the Characteristics of an Advanced Persistent Threat (APT) CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common motivation behind advanced persistent threats (APTs)?

   • AIntellectual property theft or espionage
   • BTesting security defenses for fun
   • CFinancial gain through ransomware
   • DPersonal notoriety and bragging rights
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst is investigating a potential APT and finds that a user account has been used to log in from a location the user has never visited, at a time when the user was on vacation. The account also shows a recent password change. Which indicator of compromise (IoC) is most directly indicated by the login from an unusual location?

   • AData exfiltration
   • BUnusual account activity
   • CCommand and control
   • DPresence of malware
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which stage of the APT lifecycle involves the attacker moving from one system to another within the network to reach high-value assets?

   • ALateral movement
   • BInitial compromise
   • CReconnaissance
   • DPersistence establishment
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A government contractor that develops technology for military drones has detected a sophisticated intrusion that has been active for over a year. The attackers have stolen design documents and seem interested in the drone's navigation algorithms. Which motivation is most likely driving this APT?

   • ACybercrime to steal personal data for identity theft
   • BHacktivism to promote a political cause
   • CFinancial gain through ransomware
   • DEspionage to gain a strategic advantage
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is reviewing logs and notices that a server is making outbound connections to a domain that was registered only a week ago and has no legitimate business purpose. The server also has a scheduled task that runs a PowerShell script every night. Which indicator of compromise (IoC) is most directly associated with the outbound connections?

   • ACommand and control communication
   • BLateral movement
   • CData exfiltration
   • DPrivilege escalation
   Reveal Solution Discussion Select an answer first