What happens during reconnaissance?
A. Installing malware
B. Gathering information
C. Executing payload
D. Exfiltration
Answer: B
Explanation:
Reconnaissance is the first stage where the attacker gathers information about the target. This may include OSINT, scanning, and identifying vulnerabilities to prepare for the attack.
What is the purpose of Command & Control?
A. Encrypt data
B. Communicate with attacker
C. Delete logs
D. Install malware
Answer: B
Explanation:
Command and Control (C2) is the communication channel between the attacker and the compromised system. It allows the attacker to send commands, control the system, and maintain access using protocols like HTTP or DNS.
First kill chain stage?
A. Delivery
B. Reconnaissance
C. Exploitation
D. Installation
Answer: B
Explanation:
Reconnaissance is the first stage where attackers gather information about the target. This includes OSINT, scanning, and identifying vulnerabilities. It helps attackers plan their attack strategy effectively.
Weaponization involves:
A. Logs
B. Payload creation
C. Detection
D. Backup
Answer: B
Explanation:
Weaponization is the stage where attackers combine malware and an exploit into a payload. This payload is designed to exploit a vulnerability on the target system when delivered.
Delivery example?
A. Encryption
B. Phishing email
C. Logging
D. Backup
Answer: B
Explanation:
Delivery is how the payload reaches the victim. Common methods include phishing emails, malicious websites, and infected USB devices. This stage is critical for initiating the attack.
Exploitation involves:
A. Data theft
B. Using vulnerability
C. Recovery
D. Logs
Answer: B
Explanation:
Exploitation occurs when the attacker successfully uses a vulnerability to gain access to the system. This may involve executing malicious code or triggering a software flaw.
Final stage?
A. Detection
B. Exfiltration
C. Installation
D. Parsing
Answer: B
Explanation:
The final stage involves achieving the attacker’s objective, often data exfiltration. This includes stealing sensitive data, escalating privileges, or moving laterally within the network.
What is lateral movement?
A. Data encryption
B. Moving within network after access
C. Logging activity
D. Backup
Answer: B
Explanation:
Lateral movement occurs after initial compromise, where attackers move across systems to find valuable data. It is a key stage in advanced attacks and often hard to detect.
What happens in installation?
A. Detection
B. Backdoor creation
C. Logging
D. Encryption
Answer: B
Explanation:
In this stage, attackers establish persistence by installing backdoors, web shells, or modifying services. This ensures continued access even after reboots.
Answer: B
Explanation:
In this stage, attackers establish persistence by installing backdoors, web shells, or modifying services. This ensures continued access even after reboots.
What is MITRE ATT&CK?
A. Firewall
B. Threat framework of TTPs
C. SIEM
D. Antivirus
Answer: B
Explanation:
MITRE ATT&CK is a framework that categorises attacker behaviours using tactics, techniques, and procedures (TTPs). It helps organisations understand and detect attack patterns.
What does TTP stand for?
A. Tools, Targets, Protocols
B. Tactics, Techniques, Procedures
C. Threat, Tools, Processes
D. Tactics, Targets, Payloads
Answer: B
What is threat hunting?
A. Blocking traffic
B. Proactively searching for threats
C. Logging data
D. Encryption
Answer: B
Explanation:
Threat hunting is a proactive approach where analysts actively search for hidden threats that automated tools may miss. It goes beyond alerts and assumes attackers may already be present.
Structured hunting is based on:
A. Random search
B. Known attack patterns
C. Logs only
D. Encryption
Answer: B
Explanation:
Structured hunting uses known patterns such as MITRE ATT&CK techniques to guide investigations. It is systematic and based on prior knowledge of attacker behaviour
Unstructured hunting is:
A. Based on intelligence
B. Random or hypothesis-free
C. Based on logs only
D. Detection only
Answer: B
Explanation:
Unstructured hunting is exploratory and does not follow predefined patterns. Analysts search for anomalies without specific indicators, making it more flexible but less focused.
Situational hunting is based on:
A. Random
B. Specific triggers or alerts
C. Encryption
D. Logs only
Answer: B
Explanation:
Situational hunting is triggered by specific events, such as new vulnerabilities or alerts. Analysts investigate based on current threats or incidents.
-
Week 1 Questions11
-
Week 2 Questions6
-
Week 3 Questions5
-
Week 4 Questions1
-
Week 5 Questions5
-
Week 6 Questions14
-
Practice Questions16
-
Chapter 2 Questions23
-
Chapter 3 Questions19
-
Chapter 4 Questions18
-
Chapter 5 Questions21
-
Chapter 6 Questions17
-
Chapter 7 Questions17
-
Chapter 8 Questions15
-
Chapter 10 Questions8
