Define Tactics, Techniques and Procedures and How They Are Regarded in the Industry. SPLK-5001 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An incident response team is investigating a ransomware attack. They have identified that the attacker used a specific technique to disable security tools. The team wants to ensure that this technique is detected in the future. What is the most effective way to achieve this?

   • ACreate a detection rule that monitors for the general technique, such as 'disabling security tools'.
   • BQuarantine all files with similar names to the tool used in the attack.
   • CBlock the IP addresses that the attacker used during the incident.
   • DAdd the specific tool's file hash to a blocklist.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In threat intelligence, how do TTPs help analysts attribute an attack to a specific threat actor?

   • ABy comparing the observed procedures and techniques to known patterns associated with different actors.
   • BBy analyzing only the IP addresses used in the attack.
   • CBy determining the attacker's motivation from the attack timing.
   • DBy identifying the victim's industry and location.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A threat intelligence team is analyzing a series of attacks that appear to be linked to a known adversary group. The team has collected data on the group's TTPs from multiple incidents. Which action would best help the team track the group's evolving behavior?

   • ACreate a static report of the group's TTPs and do not update it.
   • BFocus on collecting the group's IP addresses and domain names from each incident.
   • CShare the group's malware hashes with other organizations to block them.
   • DMaintain a database of the group's TTPs and update it as new incidents are analyzed.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A threat intelligence analyst is creating a report on a new malware campaign. The analyst wants to include information that will be most useful for other organizations to defend against the campaign. Which information should the analyst prioritize?

   • AThe domain names used for command-and-control communication
   • BThe TTPs observed, such as the initial access vector and persistence mechanism
   • CThe email subject lines used in the phishing campaign
   • DThe SHA256 hashes of the malware samples
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a primary way TTPs are used to track adversary activity over time?

   • ABy measuring the financial losses caused by the adversary.
   • BBy tracking the adversary's social media accounts.
   • CBy counting the number of malware samples attributed to the adversary.
   • DBy monitoring for changes in an adversary's tactics, techniques, and procedures.
   Reveal Solution Discussion Select an answer first