CST07 - Cyber Kill Chain and Intro to Active Directory

What is the primary purpose of the Cyber Kill Chain model?

• To classify malware types based on severity

• To define stages of a cyber attack for analysis and response

• To identify vulnerabilities in hardware components

• To rank threat actors by sophistication

Which of the following is an example of passive reconnaissance?

• Running a Nessus vulnerability scan

• Sending phishing emails to employees

• Searching LinkedIn for employee roles and skills

• Attempting to brute-force login credentials

Why might an attacker use obfuscated PowerShell commands in a macro-enabled Excel file?

• To improve performance of the script

• To ensure compatibility with older systems

• To evade detection by security tools

• To simplify debugging and error handling

What is the role of the Command and Control (C2) stage in the Cyber Kill Chain?

• To deliver malware to the target system

• To establish communication with compromised systems

• To scan for vulnerabilities in external networks

• To exfiltrate data from the target environment

Which of the following best describes lateral movement in a cyber attack?

• Gaining initial access through phishing

• Moving from one compromised system to others within the network

• Encrypting files on a single endpoint

• Sending spam emails from a hijacked account

Which protocol is designed to improve upon NTLM by using ticket-based authentication?

• LDAP

• Kerberos

• RADIUS

• SAML

What does the Actions on Objectives stage of the Cyber Kill Chain typically involve?

• Initial scanning of the network

• Exploiting a vulnerability

• Data exfiltration or ransomware deployment

• Sending phishing emails

Why might attackers use legitimate services like Dropbox for data exfiltration?

• They offer free encryption tools

• They are less likely to trigger security alerts

• They automatically delete logs

• They block outbound traffic

Why might a company use Managed Service Accounts?

• To allow users to share passwords

• To simplify password rotation and reduce risk

• To enable remote desktop access

• To bypass group policy restrictions

What is the role of the PDC Emulator in Active Directory?

• Manages DNS records

• Synchronizes time across the domain

• Handles schema updates

• Controls DHCP leases