A Security Analyst Is Attempting to Utilize the Following Threat

question 82

Multiple Choice

A security analyst is attempting to utilize the following threat intelligence for developing detection capabilities: APT X's approach to a target would be sending a phishing email to the target after conducting active and passive reconnaissance. Upon successful compromise, APT X conducts internal reconnaissance and attempts to move laterally by utilizing existing resources. When APT X finds data that aligns to its objectives, it stages and then exfiltrates data sets in sizes that can range from 1GB to 5GB. APT X also establishes several backdoors to maintain a C2 presence in the environment. In which of the following phases in this APT MOST likely to leave discoverable artifacts?

• A) Data collection/exfiltration
• B) Defensive evasion
• C) Lateral movement
• D) Reconnaissance

---

Definitions:

Restitution

The act of compensating for loss, damage, or injury caused, often involving the return of stolen or lost property to the rightful owner.

Partially Executed

Refers to a contract or agreement where some, but not all, of the required actions have been completed by the parties involved.

Illegal Contract

An agreement between parties that is prohibited by law or violates legal statutes, making it unenforceable.

Breach

To violate a law, by an act or an omission, or to break a legal obligation that one owes to another person or to society.