Understanding Threats and Attacks – Final Quiz Answers

Understanding Threats and Attacks – Final Quiz Answers

The Understanding Threats and Attacks Final Quiz Answers provides a comprehensive review of the key cybersecurity concepts covered throughout the course. This resource helps learners assess their knowledge of common cyber threats, attack methods, vulnerabilities, malware types, social engineering techniques, and security best practices. By studying these questions and explanations, students can strengthen their understanding of how cyberattacks occur and how organizations and individuals can protect their systems, networks, and data from evolving security risks.

1. According to the Pyramid of Pain,  not all indicators of compromise are created equal. Which of the following would be most valuable for blocking the advance of a threat?

  • IP addresses
  • Domain Names
  • Network or host artifacts
  • Hash Values

According to the Pyramid of Pain, indicators higher on the pyramid are more difficult for attackers to change and therefore cause them more pain when detected and blocked.

From lowest to higher value:

  • Hash Values
  • IP Addresses
  • Domain Names
  • Network/Host Artifacts
  • Tools
  • TTPs (Tactics, Techniques, and Procedures)

Network or host artifacts (such as specific registry keys, mutexes, file paths, beaconing patterns, or unusual network behaviors) are more valuable than IPs, domains, or hashes because attackers must modify their tools or infrastructure to avoid detection.

Correct Answer: ✅ Network or host artifacts

2. Which of the following is NOT one of the main components of the Diamond Model in its simplest form?

  • Adversary
  • Defense Tools
  • Infrastructure
  • Capabilities

The Diamond Model of Intrusion Analysis consists of four core components:

Adversary – The attacker or threat actor.
Infrastructure – The systems, domains, IPs, and resources used by the adversary.
Capabilities – The tools, malware, and techniques used in the attack.
Victim – The target of the attack.

Defense Tools are not one of the four primary vertices of the Diamond Model.

Correct Answer: ✅ Defense Tools

3. In which credential access technique do adversaries use a single list of commonly used passwords against different accounts to attempt to acquire valid account credentials?

  • Credential Stuffing
  • Password Cracking
  • Rainbow Table
  • Password Spraying

Password Spraying is a credential access technique where attackers try a small number of commonly used passwords (such as Password123, Welcome1, or Spring2026!) against many different user accounts.

Example:

  • User1 → Password123
  • User2 → Password123
  • User3 → Password123

This method helps attackers avoid account lockouts that might occur if they repeatedly try many passwords against a single account.

Why the others are incorrect:

  • Credential Stuffing – Uses username/password pairs stolen from previous breaches to log in to other services.
  • Password Cracking – Attempts to recover passwords from hashes using brute force, dictionaries, etc.
  • Rainbow Table – A precomputed table used to crack password hashes.

Correct Answer: ✅ Password Spraying

4. What type of DNS attack involves using altered DNS records to redirect online traffic to a different, most likely, fraudulent site?

  • DNS Tunneling
  • DNS Amplification
  • DNS Spoofing
  • DNS Flooding

DNS Spoofing (also called DNS cache poisoning) occurs when an attacker alters DNS records or injects false DNS information so that users are redirected to a fraudulent or malicious website instead of the legitimate one.

For example:

  • User types: www.bank.com
  • Compromised DNS returns the IP address of a fake banking site.
  • The user is redirected to the attacker’s website and may unknowingly provide credentials.

Why the others are incorrect:

  • DNS Tunneling – Uses DNS queries and responses to covertly transfer data.
  • DNS Amplification – A DDoS attack that uses DNS servers to amplify traffic toward a victim.
  • DNS Flooding – Overwhelms DNS servers with excessive requests to disrupt service.

Correct Answer: ✅ DNS Spoofing

5. Assuming that an event has been mapped to the “Actions on Objective” phase of the Lockheed Martin Cyber Kill Chain (R) , which is the previous phase an Analyst could focus on to search for other related events?

  • Weaponization
  • Command and Control
  • Exploitation
  • Installation

The Lockheed Martin Cyber Kill Chain® phases are:

  • Reconnaissance
  • Weaponization
  • Delivery
  • Exploitation
  • Installation
  • Command and Control (C2)
  • Actions on Objectives

If an event is identified in the Actions on Objectives phase, the immediately preceding phase is Command and Control, where the attacker communicates with compromised systems to issue commands and receive data.

Therefore, an analyst investigating an Actions on Objectives event should look for related Command and Control activity that occurred beforehand.

Correct Answer: ✅ Command and Control

6. In the context of cyber attacks, what is considered a “bot”?

  • An AI operated piece of malware
  • A compromised device that has become part of a network of compromised devices
  • A device that controls other compromised devices in a bigger network
  • A server used to test and investigate pieces of malware in a controlled environment

A bot (short for “robot”) is a device that has been infected with malware and is under the control of an attacker. These compromised devices are often grouped together into a botnet, which can be used for activities such as:

  • Distributed Denial-of-Service (DDoS) attacks
  • Sending spam
  • Cryptocurrency mining
  • Credential attacks
  • Malware distribution

Why the others are incorrect:

  • An AI operated piece of malware ❌ – Bots do not require AI.
  • A device that controls other compromised devices ❌ – This is typically a Command-and-Control (C2) server or botmaster system.
  • A server used to test and investigate malware ❌ – This is known as a sandbox.

Correct Answer: ✅ A compromised device that has become part of a network of compromised devices.

7. What are two examples of Techniques related to Lateral Movement?

  • T1021.006 – Windows Remote Management
  • T1572 – Protocol Tunneling
  • T1563.001 – SSH Hijacking
  • T1040 – Network Sniffing

Lateral Movement refers to techniques attackers use to move from one compromised system to another within a network.

Examples include:

  • ✅ T1021.006 – Windows Remote Management (WinRM)
    Attackers use WinRM to remotely execute commands and access other Windows systems.
  • ✅ T1563.001 – SSH Hijacking
    Attackers hijack existing SSH sessions to gain access to additional systems.

Why the others are incorrect:

  • ❌ T1572 – Protocol Tunneling
    Associated with Command and Control (C2), used to hide malicious communications.
  • ❌ T1040 – Network Sniffing
    Associated with Credential Access and Discovery, used to capture network traffic.

Correct Answers: ✅ T1021.006 – Windows Remote Management and ✅ T1563.001 – SSH Hijacking.

8. Which of the following are common characteristics of an APT? (Select 3).

  • They tend to acquire hidden access to multiple resources to become persistent
  •  They are more advanced or sophisticated than common threats
  • They act quietly so they can remain undetected for as long as possible
  • They use a “spray and pray” approach looking to hit any target available

n APT (Advanced Persistent Threat) is a highly skilled and well-resourced attacker or group that targets specific organizations and maintains long-term access to their networks.

Key characteristics include:

  • Advanced – Uses sophisticated tools, techniques, and procedures.
  • Persistent – Maintains long-term access and establishes multiple footholds.
  • Stealthy – Operates quietly to avoid detection while gathering intelligence or achieving objectives.

Incorrect Option

  • ❌ They use a “spray and pray” approach looking to hit any target available
    This describes opportunistic attacks such as mass phishing or widespread malware campaigns, not APTs, which are typically targeted and strategic.

Correct Answers: ✅ Hidden persistent access, ✅ Advanced/sophisticated techniques, ✅ Stealth and long-term undetected operation.

9. According to the Lockheed Martin Cyber Kill Chain (R), in which phase does an intruder create a remote access malware tailored to an identified vulnerability?

  • Installation
  • Exploitation
  • Weaponization
  • Actions on objectives

In the Lockheed Martin Cyber Kill Chain®, the Weaponization phase is where the attacker creates or modifies malware and couples it with an exploit designed to take advantage of a specific vulnerability.

Example:

  • The attacker identifies a vulnerable application.
  • They create a remote access trojan (RAT) or other malware.
  • They combine the malware with an exploit targeting that vulnerability.

Why the others are incorrect:

  • Installation ❌ – Occurs after exploitation, when malware is installed on the victim system.
  • Exploitation ❌ – The exploit is executed against the target to gain access.
  • Actions on Objectives ❌ – The attacker performs their ultimate goals, such as data theft or system disruption.

Correct Answer: ✅ Weaponization.

10. What is a good resource to learn about vulnerabilities disclosed by vendors?

  • The CVE list
  • The Pyramid of Pain
  • The MITRE ATT&CK Enterprise Matrix
  • The OWASP Top Ten

The CVE (Common Vulnerabilities and Exposures) list is a publicly available catalog of known cybersecurity vulnerabilities and exposures. Vendors, security researchers, and organizations use CVE identifiers to track and reference disclosed vulnerabilities.

Why the others are incorrect:

  • ❌ The Pyramid of Pain – A framework for evaluating the effectiveness of threat indicators.
  • ❌ The MITRE ATT&CK Enterprise Matrix – A knowledge base of attacker tactics, techniques, and procedures (TTPs).
  • ❌ The OWASP Top Ten – A list of the most critical web application security risks, not a database of disclosed vulnerabilities.

Correct Answer: ✅ The CVE list.

11. Which Analytic Framework focuses more on perimeter security and malware prevention?

  • MITRE ATT&CK Enterprise Matrix
  • Diamond Model
  • Lockheed Martin Cyber Kill Chain

The Lockheed Martin Cyber Kill Chain® focuses heavily on perimeter security, malware prevention, and detecting attacks as they progress through the attack lifecycle. The model breaks an attack into seven stages:

  1. Reconnaissance
  2. Weaponization
  3. Delivery
  4. Exploitation
  5. Installation
  6. Command and Control
  7. Actions on Objectives

By disrupting attackers early in these stages, organizations can prevent successful compromises.

Why the others are incorrect:

  • ❌ MITRE ATT&CK Enterprise Matrix – Focuses on attacker behaviors, tactics, and techniques (TTPs) across the entire attack lifecycle.
  • ❌ Diamond Model – Focuses on analyzing relationships between the Adversary, Infrastructure, Capabilities, and Victim.

Correct Answer: ✅ Lockheed Martin Cyber Kill Chain.

12. True or false: Insider threats are always malicious in nature?

  • False
  • True

Insider threats are not always malicious. An insider threat can be:

  • Malicious – An employee intentionally steals data, sabotages systems, or abuses access.
  • Negligent/Accidental – An employee clicks a phishing link, misconfigures a system, or unintentionally exposes sensitive information.
  • Compromised – An attacker’s use of a legitimate user’s account after stealing credentials.
    Because insider threats can result from mistakes or compromised accounts, they are not always intentional or malicious.

Correct Answer: ✅ False.

13. Fill in the blank:

In its simplest form, the Diamond Model explains how an adversary exploits a capability over an infrastructure against a ______victim_______

The Diamond Model of Intrusion Analysis consists of four core elements:

  • Adversary – The attacker
  • Capability – The tools, malware, or techniques used
  • Infrastructure – The systems, domains, or networks used by the attacker
  • Victim – The target of the attack

Therefore, the statement is:

“In its simplest form, the Diamond Model explains how an adversary exploits a capability over an infrastructure against a victim.”

Correct Answer: ✅ Victim.

14. DOS and DDOS Attacks are techniques that attackers use to accomplish which tactic?

  • Execution
  • Exfiltration
  • Impact
  • Command and Control

In the MITRE ATT&CK framework, DoS (Denial of Service) and DDoS (Distributed Denial of Service) attacks are associated with the Impact tactic.

The goal of these attacks is to:

  • Disrupt the availability of systems, services, or networks.
  • Prevent legitimate users from accessing resources.
  • Cause operational or financial damage.

Why the others are incorrect:

  • ❌ Execution – Running malicious code on a target system.
  • ❌ Exfiltration – Stealing or transferring data out of a network.
  • ❌ Command and Control – Communicating with compromised systems.

Correct Answer: ✅ Impact.

15. Which type of attack involves sending emails to induce the CEO of an organization to reveal personal or confidential information?

  • Whaling
  • Spear Phishing
  • Smishing
  • Vishing

Whaling is a specialized form of phishing that targets high-profile individuals, such as:

  • CEOs
  • Executives
  • Directors
  • Senior managers

Attackers craft convincing emails to trick these individuals into revealing sensitive information, authorizing payments, or providing credentials.

Why the others are incorrect:

  • ❌ Spear Phishing – Targets a specific individual or organization, but not necessarily executives.
  • ❌ Smishing – Phishing conducted through SMS/text messages.
  • ❌ Vishing – Phishing conducted through voice calls.

Correct Answer: ✅ Whaling.

16. Which Analytic Framework provides a detailed account of tactics, techniques and procedures?

  • CVE List
  • Diamond Model
  • Lockheed Martin Cyber Kill Chain
  • MITRE ATT&CK Enterprise Matrix

The MITRE ATT&CK Enterprise Matrix is a comprehensive knowledge base that documents adversary Tactics, Techniques, and Procedures (TTPs) based on real-world observations.

It helps security teams:

  • Understand attacker behavior
  • Map threats to specific techniques
  • Improve threat hunting and detection
  • Develop defensive strategies

Why the others are incorrect:

  • ❌ CVE List – Catalog of publicly disclosed vulnerabilities.
  • ❌ Diamond Model – Framework for analyzing relationships between Adversary, Capability, Infrastructure, and Victim.
  • ❌ Lockheed Martin Cyber Kill Chain – Focuses on the stages of an attack lifecycle rather than detailed TTPs.

Correct Answer: ✅ MITRE ATT&CK Enterprise Matrix.

17. Users who reuse credentials across multiple accounts, are more vulnerable to which type of credential access technique?

  • Rainbow Table
  • Password Cracking
  • Password Spraying
  • Credential Stuffing

Credential Stuffing occurs when attackers use username/password combinations obtained from previous data breaches and try them on other websites and services.

Users who reuse the same credentials across multiple accounts are especially vulnerable because:

  • A breach of one service can compromise accounts on many other services.
  • Attackers automate login attempts using stolen credential databases.

Why the others are incorrect:

  • ❌ Rainbow Table – Used to crack password hashes.
  • ❌ Password Cracking – General process of recovering passwords through guessing or computation.
  • ❌ Password Spraying – Uses a few common passwords against many accounts.

Correct Answer: ✅ Credential Stuffing.

18 What is a zero-day attack?

  • An attack that occurs during the transition to a new year
  • An attack that is successfully completed within the same day
  • An attack in which a previously unknown vulnerability is exploited

A zero-day attack occurs when attackers exploit a software or hardware vulnerability before the vendor or defenders are aware of it or have released a patch.

The term “zero-day” means developers have had zero days to fix the vulnerability.

Example

  • A previously unknown flaw is discovered by an attacker.
  • The attacker exploits the flaw.
  • No patch or signature exists yet to protect against it.
  • Systems remain vulnerable until the issue is discovered and fixed.

Why the others are incorrect:

  • ❌ An attack that occurs during the transition to a new year – Not related to cybersecurity terminology.
  • ❌ An attack that is successfully completed within the same day – The duration of the attack is irrelevant to the definition.

Correct Answer: ✅ An attack in which a previously unknown vulnerability is exploited.